Microsoft rules out bounties for security exploits

Microsoft has ruled out paying security researchers bounties for exploits, as practised by other industry firms.

Speaking to vnunet.com at Infosecurity 2007 Microsoft chief security advisor Roger Halbheer ruled out making payments to researchers who discover vulnerabilities.

Instead the company wants to work with security researchers and credit them in monthly updates.

"I do not think paying is a healthy idea," he said. "We run a researcher conference at Redmond, called Bluehat, and once researchers see how we work they will start to trust us. After all, we are not lazy over fixes, but patches are very complex to develop."

Halbheer explained that it can sometimes take several hundred days to build a patch, in part because of a long testing process. For example, a patch for the IE browser has to go through over 400 tests before being released.

Microsoft has not been averse to using bounties before in specific circumstances. Three years ago it offered a $250,000 bounty for the author of the MyDoom worm, and Mozilla offers $500 and a free T-shirt for each vulnerability found.

Others in the industry also use the tactic. The US Federal Trade Commission has suggested bounties of up to $250,000 for information leading to the conviction of spammers.

Security research companies Tipping Point and iDefence also use the tactic.

See also:

TippingPoint seeks bug bounty hunters

Zero Day Initiative offers a fist full of dollars  26 Jul 2005

US ponders $250,000 bounty on spammers

Federal Trade Commission looking for junk mail 'whistleblowers'  20 Sep 2004

Shop a pirate for $10,000

DVD-copying software company offers bounty in response to industry complaints  20 Feb 2003

Bounty on head of porn squatter

The legitimate owner of porn site sex.com has put a bounty on the head of the cybersquatter who he claims stole his domain name and then absconded without paying damages.  31 May 2001

Lastminute.com bounty hunters get only 35 shares

Internet retailer Lastminute.com has not made any of its private investors instant millionaires during its first morning of trading.  14 Mar 2000

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!