full-disclosure - Re: OT Google raises sploit bounties

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 25 Nov 2012 22:17:18 -0800
From: Michal Zalewski <lcamtuf@...edump.cx>
To: adam <adam@...sy.net>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: OT Google raises sploit bounties

> His question seemed pretty clear to me. As indicated in the article he
> linked to, Google apparently raised their bounty/reward. He's asking if
> something happened to one of their products to cause that, or if they're
> just paranoid (and maybe expecting something to happen to one of their
> products).

FWIW, these choices seem weird... for any announcement of that sort,
it seems more rational to assume any of the following:

1) It's getting harder to find bugs. Reward amounts correspond to the
average time needed to locate a vuln.

2) More reward programs are competing for a fixed pool of skilled
researchers. Reward amounts are just "bids" for their time.

3) Incoming reports are surprisingly good. Reward amounts are set to
recognize high quality work.

4) The vendor thinks that their product is bulletproof, and uses
increasing reward amounts as a publicity stunt.

As far as I know, all reward increases for Google VRPs were driven by
a combination of factors 1 through 3.

I am not sure how "being paranoid" factors in - complex products have
bugs, browsers doubly so. Similarly, malware seems like a weird reason
to bump up rewards.

/mz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/