Microsoft to Pay First Bug Bounty for IE 11
Just a few weeks after announcing its first bug bounty programs, Microsoft is already set to pay out a reward to a researcher from Google who discovered a vulnerability in Internet Explorer 11.
Vulnerabilities
Attackers Targeting MS13-055 IE Vulnerability
Attackers are using an Internet Explorer vulnerability, which Microsoft patched yesterday, in targeted attacks that also employ a malicious Flash file installed through a drive-by download launched by compromised Web pages. The exploit that’s being used is capable of bypassing both ASLR and DEP.
Researchers Find Bug Bounty Programs Pay Economic Rewards
Bug bounty programs can be as much as 100 times more cost-effective for finding security vulnerabilities than hiring full-time security researchers to do the same thing. New research from the University of California at Berkeley, which focused on bug bounty programs run by Google and Mozilla, found that each of these programs has cost the vendor about $400,000 over the course of three years, far less than it would’ve cost to hire employees to find the same number of vulnerabilities.
Google has fixed more than 15 vulnerabilities in Chrome and paid out nearly $35,000 in rewards to security researchers for reporting the bugs. One researcher earned an unusually large reward of $21,500 for a series of vulnerabilities he reported in Chrome.
Microsoft’s July Patch Tuesday security bulletins patch numerous critical vulnerabilities, including some related to malicious TrueType Font files used in a number of high-profile targeted attacks.
Adobe’s July security updates include patches for Flash Player, Shockwave Player and ColdFusion vulnerabilities.
The details of the Android vulnerability that enables an attacker to create a malicious update to an APK file without breaking its cryptographic signature have become public but it appears as though Google will have a patch ready for the flaw by the time it’s fully disclosed early next month.
Tomorrow’s Microsoft Patch Tuesday security bulletins are expected to include a patch for a kernel zero-day disclosed by Google engineer Tavis Ormandy. Also, another IE update is expected.
Vulnerabilities in the IPMI protocol that describes how baseboard management controllers communicate on networks put thousands of servers at risk, particularly those at hosting providers.
A security researcher has uncovered a number of serious vulnerabilities in one of the core security components of several secure telephony applications, including the Silent Circle system developed by PGP creator Phil Zimmermann.
