Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Google has paid some $381,000 to close 1100 legitimate vulnerabilities under its bug bounty programme since its inception.
The vulnerabilities ranged from low to high severity and were reported by more than 200 individuals. Some 730 bugs qualified for reward.
Google security team technical program manager Adam Mein said that the programme "has been a big success".
The company received 43 bug reports in the week after the reward programme, an extension of Chromium Security Research, was launched in November 2010.
“Roughly half of the bugs that received a reward were discovered in software written by approximately 50 companies that Google acquired; the rest were distributed across applications developed by Google (several hundred new ones each year). Significantly, the vast majority of our initial bug reporters had never filed bugs with us before we started offering monetary rewards.”
Google accepts vulnerability reports for its google.com platform, as well as in YouTube, blogger.com and Orkut.
The base reward for qualifying bugs is $469, and if the rewards panel finds a particular bug to be severe or unusually clever, rewards of up to $2936 may be issued. The panel also said that it may also decide a single report actually constitutes multiple bugs requiring reward, or that multiple reports constitute only a single reward.
Mein said Google has gotten better and stronger as a result of this work and said bug bounty programmes help build better relationships with the security research community.
This article originally appeared at scmagazineuk.com
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.