Story image

$250,000 up for grabs in Microsoft's latest Windows Bounty Program

31 Jul 2017

Microsoft is offering up to US$250,000 (NZ$332,668/AU$313,047) in a new bug bounty program focused exclusively on ironing out the kinks in Windows 10. This time there’s a bigger payout for the Hyper-V bounty.

Last week the company launched the Windows Bounty Program, which includes all aspects of the Windows Insider Preview, as well as Hyper-V, Mitigation bypass, Windows Defender Application Guard and Microsoft Edge.

Microsoft says the program is ‘in the spirit of maintaining a high security bar in Windows’, and complements the company’s long list of defence technologies such as DEP, ASLR, CFC, CIG, ACG, Device Guard, Credential Guard and Windows Defender Application Guard.

The new bug bounty program aims to catch any critical or important remote code execution (RCE), privilege elevation or design flaws that compromise users’ security and privacy.’

However, if anyone discovers a vulnerability that Microsoft has already found, the bounty equated to 10% of the highest amount they could have received. In the case of a Hyper-V bounty ($US250,000), researchers would receive a payout of $25,000 if they found a RCE.

Microsoft has conducted several bounties since 2013, which reflects the changing nature of vulnerabilities and priorities in different points in time.

“Microsoft strongly believes in the value of the bug bounties, and we trust that it serves to enhance our security capabilities,” the company says.

There are also outstanding bounty programs for .NET and cloud applications, worth up to US$15,000 (NZ$19,960/AU$18,782).

Microsoft says that all security bugs are important, and users should report those bugs to secure@microsoft.com via Coordinated Vulnerability Disclosure (CVD) policy.

Interested researchers can also check out Bugcrowd’s list of current bug bounty programs from platforms such as Atlassian, Avira, Centrify, Cylance, HubSpot and 1Password.

However, bug bounty programs may not be alluring enough for some – recent reports suggest that Google’s bug bounties are not doing so well. Earlier this year the company’s Project Zero hacking contest failed to reward a single prize, despite rewards of up to US$200,000.

In the contest, there were no valid entries or bugs - instead there was just spam and entries that did not resemble what the company was after. Read more here. 

Microsoft’s bug bounty categories are below.

Kinetica launches a new active analytics platform
"With the platform now powered by NVIDIA DGX-2, customers can build smart analytical applications that combine historical data analytics and ML-powered analytics."
Avi Networks: Using visibility to build trust
Visibility, also referred to as observability, is a core tenet of modern application architectures for basic operation, not just for security.
Zoom’s new Rooms and Meetings features
Zoom has released information about the upcoming releases for its Rooms and Meeting offerings for 2019.
Aussie company set to democratise direct-to-orbit IoT access
Adelaide-based Myriota has released a developer toolkit that has been trialled and tested by a smart waste management platform.
Dynatrace takes pole position in APM Magic Quadrant
It placed highest on Ability to Execute and furthest on Completeness of Vision in the 2019 Quadrant for Application Performance Monitoring (APM).
HCL and Xerox expand strategic partnership
Under the terms of the agreement, HCL will manage portions of Xerox’s shared services, including global administrative and support functions.
Avaya expands integration with Google Cloud AI
This includes embedding Google’s machine learning within conversation services for the contact centre, enabling integration of AI capabilities.
Inspur announces AI edge computing server with NVIDIA GPUs
“The dynamic nature and rapid expansion of AI workloads require an adaptive and optimised set of hardware, software and services for developers to utilise as they build their own solutions."