Money for Vista, IE Bugs VeriSign Willing to Pay for Newly Discovered Vulnerabilities Sean Michael Kerner
The race to pick holes in Microsoft's newest operating system and browser is on.
VeriSign's iDefense Labs has kicked off its Vulnerability Contributor Program (VCP), a challenge to find remote arbitrary code execution vulnerabilities in Windows Vista and Internet Explorer 7.0. VCP will pay $8,000 for the first six confirmed vulnerabilities.
It will pay an additional $2,000 to $4,000 for those who also provide working exploit code for the submitted vulnerability, bringing the total potential bounty to $12,000.
IDefense is looking for vulnerabilities that are remotely exploitable and allow arbitrary code execution without additional user interaction (like clicking an e-mail
attachment for example). Social engineering and other attacks that require the user to do something other than actually just browsing a site are not valid for this contest.
IDefense expects to receive well more than six reports of vulnerabilities, but iDefense spokesman Jason Greenwood said the VCP stops at six because of budget constraints.
"We receive hundreds of vulnerability research submissions each month as part of our normal contributor program," Greenwood told internetnews.com. "We expect to get many more than six submissions that may qualify for this promotion."
Microsoft does not endorse the challenge, and Greenwood said the company has not contacted VeriSign about the challenge. "We have a close working relationship with Microsoft and responsibly make them aware of vulnerabilities as we discover them," Greenwood said.
That's not to say that Microsoft isn't aware of the iDefense challenge.
A Microsoft spokesperson told internetnews.com that Microsoft is aware of iDefense offering compensation for information regarding security vulnerabilities. The spokesperson added that Microsoft does not offer compensation for information regarding security vulnerabilities and does not encourage that practice.
"Our policy is to credit security researchers who report vulnerabilities to us in a responsible manner," the spokesperson said.
Though Microsoft will not pay for vulnerabilities, it won't ignore the vulnerabilities exposed by the challenge, either.
"Microsoft doesn't want to speculate on the motives of third-party researchers but will say it is committed to working with them closely on the issues they bring to our attention," the spokesperson said. "Whoever handles vulnerabilities, Microsoft does encourage them to responsibly disclose the vulnerability to the affected software vendor in order to protect all customers/users."
VeriSign's iDefense customers, however, may well get the leg up on Vista and IE7 vulnerabilities, ahead of regular Microsoft users.
"Early notification of vulnerabilities is just one aspect of the research the iDefense team does," iDefense's Greenwood said. "Our customers will benefit from the challenge by knowing about potential threats before they are exploited and giving them information to assess the potential risk prior to a patch being put out by Microsoft."
