WingNews logo WingNews GitHub [2]
top | item 16608827

Microsoft Offers Bug Bounty to Prevent Another Spectre-Meltdown Fiasco

215 points| rbanffy | 8 years ago |hothardware.com | reply

89 comments

order
[+] WebLLL|8 years ago|reply
The offer is limit to bugs that are not already known to Microsoft or their partners, and they are not disclosing what these bugs are, and they are making no claim to have fixed them. I made a submission to Intel and others weeks after some were claiming to have mitigated this with small reductions in timer resolution, showing that the timer mitigation would not stop these vulnerabilities, no one would pay out, said they were already aware of it, have they informed the public, have they withdrawn their product, have their transitioned their user base to safer products??? No one is going to hand over their well documented exploits under such terms. Let them offer twice the reward for public disclosures of issues that they already know and have not fixed or not warned the public about, and then we might take their offer seriously.
[+] tptacek|8 years ago|reply
I don't understand the disincentive you're describing. Unless you believe that Intel or Microsoft would lie about already knowing about a vulnerability --- which is extremely dumb, given how minimal the expense is, and how much publicity you'd immediately generate by going public --- then what's the risk?
[+] JoachimSchipper|8 years ago|reply
> I [showed] that the timer mitigation would not stop these vulnerabilities

Yes, that was obvious to people with some background in this class of attacks. Good on you for figuring that out independently (seriously!), but you're not going to get a bounty for something widely known.

[+] c3534l|8 years ago|reply
I've heard similar frustrations from bug-hunters before. I don't know enough to side with anyone, but it would be nice if there were some kind of oversight body for this sort of thing, an independent third party that offered some consistency in the experience.
[+] ISL|8 years ago|reply
One presumes that Spectre/Meltdown-level bugs are each worth substantially more to the computer industry than $250k.
[+] Grollicus|8 years ago|reply
On the other hand there are always altruists that release these kinds of bugs for free. So why spend money on it?

250k is a huge bug bounty. It's a step in the right direction.

[+] Waterluvian|8 years ago|reply
The reward doesn't need to be proportional. It has to be sufficient to get people motivated.

When I reward you for finding my wallet I don't give you the entire contents of it, even though I would have lost that much money.

[+] yoodenvranx|8 years ago|reply
If I had the choice I would take 250k$ non-sketchy money from MS over any amount of xxx sketchy money from any other company. Yes, youcould get a lotmore money insome cases but MS will be the easiest way to get it.
[+] electrograv|8 years ago|reply
Related: Why was the $250k edited out of the title just now? That seems rather relevant (and it reflects the actual article title).
[+] GoToRO|8 years ago|reply
You would think. But if you don't buy Microsoft, Apple, Intel, AMD what do you buy? There is no alternative.
[+] davidkopf|8 years ago|reply
Yes but the question is how much is 250k incentivizing bounty hunters?
[+] mastax|8 years ago|reply
Bug bounties are good but they wouldn't have prevented Spectre-Meltdown. The only way to prevent such a fiasco is for the bugs to never exist in the first place. The only difference bounties make is that hopefully vendors patch the issue before it becomes widely exploited. In the case of S/M, vendors got many months of notice and it was still a fiasco - that is the nature of software bugs.
[+] whb07|8 years ago|reply
For bugs to never exist in the first place? Let me put that one in the list of obvious things like “traffic accidents shouldn’t occur”, “drowning accidents shouldn’t occur”, “heart disease shouldn’t occur”.

I’m sure I missed something. Could you help me out ?

[+] icebraining|8 years ago|reply
They wouldn't have prevented the bug, but they might have prevented the size of the fiasco, if they were found earlier, before everyone switched to vulnerable CPUs.
[+] the8472|8 years ago|reply
> this particular set of bug bounty rules is exclusive to vulnerabilities that surround speculative execution bugs

I wonder what the rationale is for that narrow scope. Is it just that there aren't that many potential sources of side-channels?

[+] austincheney|8 years ago|reply
So that they aren't paying out huge sums of money for trivial defects in fringe products. For example a userland defect in editing tools of Sharepoint is not going to be worthy of a $250,000 reward to MS.
[+] sytse|8 years ago|reply
Azure resetted all VMs because of the early disclosure. Glad to see MSFT acting on this. Are they using hackerone?
[+] trisimix|8 years ago|reply
I hope that as time goes on we find the open source approach to crowdsourcing bugs is actually so much more viable than bug bounties and combined with an increased need for security we find that many proprietary softwares are outmatched.
[+] amelius|8 years ago|reply
Perhaps an ignorant question, but does there already exist a practical demonstration of the Spectre/meltdown bugs, or are they still theoretical?
[+] IncRnd|8 years ago|reply
They were never theoretical.