eWeek Security Watch
Advertisement
Advertisement
January 15, 2008 1:56 PM

$20,000 Bounty Placed on Windows Flaws, Exploits



$20,000 Bounty Placed on Windows Flaws, Exploits A private company has placed a $20,000 bounty on exploitable vulnerabilities in Microsoft's Windows operating system, a move that significantly raises the value of software flaw research.

Billed as a Hacker Challenge, the $20,000 "special prize" is being offered by Digital Armaments, one of several companies that pay hackers who agree to give them exclusive rights to advance notification of unpublished vulnerabilities or exploit code.

[ ALSO SEE: VeriSign Offers Hackers $8,000 Bounty on Vista, IE 7 Flaws ]

Digital Armaments said the bounty will be available for each submission that results in an exploitable vulnerability or working exploit against Windows or a Windows Diffuse application. To qualify, the flaw data must include examples and documentation, the company said.

Not much is known about the people behind Digital Armaments. The company's Web site does not include any details about its backers or its whereabouts.

This is not the first high-priced flaw data bounty from Digital Armaments, which previously offered hacking challenges for bugs in the Symbian OS, Oracle Database and VMware.

VeriSign's iDefense VCP (Vulnerability Contributor Program) has also placed a public price tag on flaws and exploits in specific products. In December 2007, the company offered between $8,000 and $12,000 for remote arbitrary code execution holes in these e-mail clients and servers:

  • Microsoft Outlook
  • Mozilla Thunderbird
  • Microsoft Outlook Express
  • Sendmail SMTP daemon
  • Microsoft Exchange Server
  • In the past, iDefense has offered monetary prizes for holes in Windows Vista and Internet Explorer 7.

    TrackBack

    TrackBack

    http://securitywatch.eweek.com/cgi-bin/mte/mt-tb.cgi/12468

    Comments (5)

    Mark :

    Uh-huh... and what's going to stop them from just claiming that they already knew about an exploit, just so they don't have to pony up any capital? Sounds to me like they are just trying to get a bunch of hackers around the world doing their jobs for free.

    R Henson :

    how can you trust a company that can't even spell. check their web page smells like a scam to me.
    no phone number just email addresses come on these guys are scam artist. lol

    Anna :

    Now even the possbile bad guys are getting very entreprenourial. Next thing you know they'll be seeking patents too.

    Jeff :

    This is the level of reportage I expect from a personal blog, not a professional publication. By comparing this offer to similar-sounding offers from reputable firms, this could even give these guys legitimacy.

    Without even picking up a phone or doing any real work, it would be possible to note:
    - their site is riddled with spelling and grammatical errors
    - that they only state their offices are somewhere "in the U.S."
    - there is no record of previously reported exploits, unlike many reputable security firms

    This begs the question whether I should see this as lazy regurgitation of a press release or downright negligence by promoting potentially criminal activity.

    oyun :

    Now even the possbile bad guys are getting very entreprenourial

    Post a Comment

     
     
    RSS Syndication
    Advertisement
    Advertisement
    Security Watch     Contact Us | Advertise | Site Map
    eWEEK Quick LInks

    Ziff Davis Enterprise