Microsoft Doubles Bounty Payouts
Monday, 10 August 2015

Microsoft has announced an increase for its Bounty for Defense program from $50K to $100K and an expansion of its Online Services Bug Bounty program, including and a bonus period during which some authentication vulnerabilities will receive double bounty payouts.

According to Jason Shirk in his announcement on TechNet raising the Bounty for Defense: 

  • Brings defense up on par with offense
  • Rewards the novel defender equally for their research


msbugbountyshield

To clarify, Microsoft has offered rewards up to $100,000 for novel remote code execution vulnerabilities since it introduced its Mitigation Bypass Bounty in June 2013. It also offered an additional Bonus for Defence for submitting a report that described how to block such exploitation techniques. which was set at $50,000.  

Now the two rewards have been decoupled and researchers who submit defensive techniques to Microsoft can be eligible for a bounty up to $100,000. As before all bounties will be paid out at Mirosoft's discretion.

Other news in the announcement, which was timed to coincide with Black Hat 2015, the annual gathering of the security research community, was the extension of the Microsoft Online Services Bug Bounty program, originally launched in September 2014, to include Microsoft Account. To give further impetus to researchers to hunt out authentication vulnerabilities, for the next three months, until October 5, 2015, qualified submissions will be eligible for double bounties to a maximum of $30,000 USD.

The three Microsoft Account domains that are eligible for this are:  

  • login.windows.net
  • login.microsoftonline.com
  • login.live.com 

and the types of vulnerability that will qualify include:

Eligible submissions will include vulnerabilities of the following types: 

  • Cross Site Scripting (XSS)
  • Cross Site Request Forgery (CSRF)
  • Unauthorized cross-tenant data tampering or access (for multi-tenant services)
  • Insecure direct object references
  • Injection Vulnerabilities
  • Authentication Vulnerabilities
  • Server-side Code Execution
  • Privilege Escalation
  • Significant Security Misconfiguration (when not caused by user) 

In addition, Remote App, which lets users run Windows apps hosted in Azure anywhere, and on a variety of devices is being added as a new property of the Online Services Bug Bounty Program.

 

 msbugbountyshield

Banner


Random Gifts For Programmers
24/11/2024

Not really random. Not even pseudo random, more stuff that caught my attention and that I, for one, would like to be given. And, yes, if I'm not given them, I'd probably buy some for myself.



Azure Container Apps Dynamic Sessions Generally Available
02/12/2024

Dynamic Session support has been added to Azure Container Apps. Azure Container Apps is a serverless platform for running containerized applications, and dynamic sessions is designed to provide fast a [ ... ]


More News

 

espbook

 

Comments




or email your comment to: comments@i-programmer.info

Last Updated ( Tuesday, 04 October 2016 )