{"id":2805,"date":"2010-07-19T11:50:10","date_gmt":"2010-07-19T10:50:10","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=2805"},"modified":"2015-09-09T19:37:29","modified_gmt":"2015-09-09T11:37:29","slug":"mozilla-increases-security-bug-bounty-to-3000","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2010\/07\/mozilla-increases-security-bug-bounty-to-3000\/","title":{"rendered":"Mozilla Increases Security Bug Bounty To $3000"},"content":{"rendered":"

There’s been a number of bounty programs in the past year or so with Mozilla<\/a> being one of the forerunners with their Mozilla Security Bug Bounty Program<\/a>.<\/p>\n

There are others like Google offering rewards for bugs in Chrome<\/a>, and other specific high profile bounties like when Microsoft Offered $250K Bounty for Conficker Author<\/a>.<\/p>\n

Mozilla on Thursday boosted bug bounty payments six-fold by increasing the standard cash award to $3,000.<\/p>\n

The new bounty for vulnerabilities in Firefox, Firefox Mobile and Thunderbird is also six times the normal payment by Google for flaws in its Chrome browser, and more than double the maximum $1,337 that Google pays for the most severe bugs. Mozilla and Google are the only browser makers that pay security researchers for reporting vulnerabilities in their products.<\/p>\n

“A lot has changed in the six years since the Mozilla program was announced, and we believe that one of the best ways to keep our users safe is to make it economically sustainable for security researchers to do the right thing when disclosing information,” said Lucas Adamski, director of security engineering. Mozilla kicked off its bounty program in August 2004 .<\/p>\n

Only bugs that Mozilla ranks “crucial” or “high” — its top two ratings — are eligible for payment. In Mozilla’s hierarchy, critical vulnerabilities are those that allow remote code execution; in other words, ones that when exploited give the attacker full control of the machine. High vulnerabilities are those that expose “high-value” personal information, such as usernames, passwords and credit card numbers. Denial-of-service flaws are not eligible for a bounty, Mozilla said. <\/p><\/blockquote>\n

It’s a big increase too going from $500 all the way to $3000 which is more than double what Google offers for the most critical & clever bugs ($1337). You could earn a decent living if you could find one Mozilla bug a month, especially if you already have a stable monthly salary.<\/p>\n

I doubt anyone would be able to find so many bugs, and even if they did it’s still way below the market rate for a real, remotely exploitable 0-day exploit.<\/p>\n

I still think it’s a good initiative though and they’ve raised the bounty to make it a more viable option for security researchers to submit vulnerabilities directly to them.<\/p>\n