Microsoft has announced an increase for its Bounty for Defense program from $50K to $100K and an expansion of its Online Services Bug Bounty program, including and a bonus period during which some authentication vulnerabilities will receive double bounty payouts.

According to Jason Shirk in his announcement on TechNet raising the Bounty for Defense: 

• Brings defense up on par with offense
• Rewards the novel defender equally for their research

To clarify, Microsoft has offered rewards up to $100,000 for novel remote code execution vulnerabilities since it introduced its Mitigation Bypass Bounty in June 2013. It also offered an additional Bonus for Defence for submitting a report that described how to block such exploitation techniques. which was set at $50,000.  

Now the two rewards have been decoupled and researchers who submit defensive techniques to Microsoft can be eligible for a bounty up to $100,000. As before all bounties will be paid out at Mirosoft's discretion.

Other news in the announcement, which was timed to coincide with Black Hat 2015, the annual gathering of the security research community, was the extension of the Microsoft Online Services Bug Bounty program, originally launched in September 2014, to include Microsoft Account. To give further impetus to researchers to hunt out authentication vulnerabilities, for the next three months, until October 5, 2015, qualified submissions will be eligible for double bounties to a maximum of $30,000 USD.

The three Microsoft Account domains that are eligible for this are:  

• login.windows.net
• login.microsoftonline.com
• login.live.com 

and the types of vulnerability that will qualify include:

Eligible submissions will include vulnerabilities of the following types: 

• Cross Site Scripting (XSS)
• Cross Site Request Forgery (CSRF)
• Unauthorized cross-tenant data tampering or access (for multi-tenant services)
• Insecure direct object references
• Injection Vulnerabilities
• Authentication Vulnerabilities
• Server-side Code Execution
• Privilege Escalation
• Significant Security Misconfiguration (when not caused by user) 

In addition, Remote App, which lets users run Windows apps hosted in Azure anywhere, and on a variety of devices is being added as a new property of the Online Services Bug Bounty Program.

Comments

Make a Comment or View Existing Comments Using Disqus

or email your comment to: comments@i-programmer.info