$20,000 Bounty Placed on Windows Flaws, Exploits
Billed as a Hacker Challenge, the $20,000 "special prize" is being offered by Digital Armaments, one of several companies that pay hackers who agree to give them exclusive rights to advance notification of unpublished vulnerabilities or exploit code. [ ALSO SEE: VeriSign Offers Hackers $8,000 Bounty on Vista, IE 7 Flaws ] Not much is known about the people behind Digital Armaments. The company's Web site does not include any details about its backers or its whereabouts. This is not the first high-priced flaw data bounty from Digital Armaments, which previously offered hacking challenges for bugs in the Symbian OS, Oracle Database and VMware. VeriSign's iDefense VCP (Vulnerability Contributor Program) has also placed a public price tag on flaws and exploits in specific products. In December 2007, the company offered between $8,000 and $12,000 for remote arbitrary code execution holes in these e-mail clients and servers:
In the past, iDefense has offered monetary prizes for holes in Windows Vista and Internet Explorer 7. |

A private company has placed a $20,000 bounty on exploitable vulnerabilities in Microsoft's Windows operating system, a move that significantly raises the value of software flaw research.

Comments (5)
Uh-huh... and what's going to stop them from just claiming that they already knew about an exploit, just so they don't have to pony up any capital? Sounds to me like they are just trying to get a bunch of hackers around the world doing their jobs for free.
Posted by Mark | January 15, 2008 5:11 PM
how can you trust a company that can't even spell. check their web page smells like a scam to me.
no phone number just email addresses come on these guys are scam artist. lol
Posted by R Henson | January 16, 2008 12:12 AM
Now even the possbile bad guys are getting very entreprenourial. Next thing you know they'll be seeking patents too.
Posted by Anna | January 16, 2008 12:01 PM
This is the level of reportage I expect from a personal blog, not a professional publication. By comparing this offer to similar-sounding offers from reputable firms, this could even give these guys legitimacy.
Without even picking up a phone or doing any real work, it would be possible to note:
- their site is riddled with spelling and grammatical errors
- that they only state their offices are somewhere "in the U.S."
- there is no record of previously reported exploits, unlike many reputable security firms
This begs the question whether I should see this as lazy regurgitation of a press release or downright negligence by promoting potentially criminal activity.
Posted by Jeff | January 17, 2008 5:09 PM
Now even the possbile bad guys are getting very entreprenourial
Posted by oyun | January 21, 2008 12:37 PM