Google splashes out the cash for cunning cracks

Boosts bug bounties and offers $2m Pwnium purse


Google's increasing the financial incentives for reporting vulnerabilities with an upgraded bug bounty scheme and a $2m purse for its latest Pwnium Chrome hacking contest, to be held in October.

The Chocolate Factory's Chromium Vulnerability Rewards Program has paid out more than ONE MILLION DOLLARS to researchers who bring in documented new bugs, on top of nearly half a million shelled out for non-Chromium web vulnerabilities. But according to Google security software engineer Chris Evans, this still isn't enough dosh to hold a hacker's interest.

"Recently, we've seen a significant drop-off in externally reported Chromium security issues," he blogged. "This signals to us that bugs are becoming harder to find, as the efforts of the wider community have made Chromium significantly stronger."

To spur interest and reward harder work, Google's adding a bonus of $1,000 for any bugs that are deemed "particularly exploitable," with similar awards for flaws that work on a wide variety of platforms besides Google's, or which are discovered in sections of the code base previously determined to be stable and bug free.

In particular, Google is looking for flaws in GPU drivers, especially in Intel's hardware, as well as any 64-bit code flaws. It's also said extra awards are available for finding vulnerabilities in the stripped-down Linux kernel that powers its Chrome OS, if they can bypass the system's sandboxing.

Presumably these kinds of hacks will be what the judges are looking for at in Google's second Pwnium Chrome hacking contest. The purse for this round, held at the 10th anniversary Hack in the Box conference in Kuala Lumpur in October, has doubled to $2m for people who can kick holes in Chrome's security.

Those who can demonstrate (and document) a "Full Chrome exploit" on a Windows 7 system running the latest build of the browser can bag $60,000. A "Partial Chrome Exploit," which uses at least one bug to get user access earns $50,000, and a successful attack on a "Non-Chrome exploit" via Windows or Flash will net $40,000 to the demonstrator.

All this money sloshing around is good news for security researchers, and the bounty system Google has run since 2010 pays off internally, too. The Chocolate Factory gets a bit more security, which is a useful selling point for Google Apps in enterprise, and the cost is nothing in terms of its marketing budget, while providing pocket money and more for legitimate researchers. ®

Similar topics


Other stories you might like

  • Makers of ad blockers and browser privacy extensions fear the end is near
    Overhaul of Chrome add-ons set for January, Google says it's for all our own good

    Special report Seven months from now, assuming all goes as planned, Google Chrome will drop support for its legacy extension platform, known as Manifest v2 (Mv2). This is significant if you use a browser extension to, for instance, filter out certain kinds of content and safeguard your privacy.

    Google's Chrome Web Store is supposed to stop accepting Mv2 extension submissions sometime this month. As of January 2023, Chrome will stop running extensions created using Mv2, with limited exceptions for enterprise versions of Chrome operating under corporate policy. And by June 2023, even enterprise versions of Chrome will prevent Mv2 extensions from running.

    The anticipated result will be fewer extensions and less innovation, according to several extension developers.

    Continue reading
  • Google has more reasons why it doesn't like antitrust law that affects Google
    It'll ruin Gmail, claims web ads giant

    Google has a fresh list of reasons why it opposes tech antitrust legislation making its way through Congress but, like others who've expressed discontent, the ad giant's complaints leave out mention of portions of the proposed law that address said gripes.

    The law bill in question is S.2992, the Senate version of the American Innovation and Choice Online Act (AICOA), which is closer than ever to getting votes in the House and Senate, which could see it advanced to President Biden's desk.

    AICOA prohibits tech companies above a certain size from favoring their own products and services over their competitors. It applies to businesses considered "critical trading partners," meaning the company controls access to a platform through which business users reach their customers. Google, Apple, Amazon, and Meta in one way or another seemingly fall under the scope of this US legislation. 

    Continue reading
  • I was fired for blowing the whistle on cult's status in Google unit, says contractor
    The internet giant, a doomsday religious sect, and a lawsuit in Silicon Valley

    A former Google video producer has sued the internet giant alleging he was unfairly fired for blowing the whistle on a religious sect that had all but taken over his business unit. 

    The lawsuit demands a jury trial and financial restitution for "religious discrimination, wrongful termination, retaliation and related causes of action." It alleges Peter Lubbers, director of the Google Developer Studio (GDS) film group in which 34-year-old plaintiff Kevin Lloyd worked, is not only a member of The Fellowship of Friends, the exec was influential in growing the studio into a team that, in essence, funneled money back to the fellowship.

    In his complaint [PDF], filed in a California Superior Court in Silicon Valley, Lloyd lays down a case that he was fired for expressing concerns over the fellowship's influence at Google, specifically in the GDS. When these concerns were reported to a manager, Lloyd was told to drop the issue or risk losing his job, it is claimed. 

    Continue reading
  • End of the road for biz living off free G Suite legacy edition
    Firms accustomed to freebies miffed that web giant's largess doesn't last

    After offering free G Suite apps for more than a decade, Google next week plans to discontinue its legacy service – which hasn't been offered to new customers since 2012 – and force business users to transition to a paid subscription for the service's successor, Google Workspace.

    "For businesses, the G Suite legacy free edition will no longer be available after June 27, 2022," Google explains in its support document. "Your account will be automatically transitioned to a paid Google Workspace subscription where we continue to deliver new capabilities to help businesses transform the way they work."

    Small business owners who have relied on the G Suite legacy free edition aren't thrilled that they will have to pay for Workspace or migrate to a rival like Microsoft, which happens to be actively encouraging defectors. As noted by The New York Times on Monday, the approaching deadline has elicited complaints from small firms that bet on Google's cloud productivity apps in the 2006-2012 period and have enjoyed the lack of billing since then.

    Continue reading
  • UK competition watchdog seeks to make mobile browsers, cloud gaming and payments more competitive
    Investigation could help end WebKit monoculture on iOS devices

    The United Kingdom's Competition and Markets Authority (CMA) on Friday said it intends to launch an investigation of Apple's and Google's market power with respect to mobile browsers and cloud gaming, and to take enforcement action against Google for its app store payment practices.

    "When it comes to how people use mobile phones, Apple and Google hold all the cards," said Andrea Coscelli, Chief Executive of the CMA, in a statement. "As good as many of their services and products are, their strong grip on mobile ecosystems allows them to shut out competitors, holding back the British tech sector and limiting choice."

    The decision to open a formal investigation follows the CMA's year-long study of the mobile ecosystem. The competition watchdog's findings have been published in a report that concludes Apple and Google have a duopoly that limits competition.

    Continue reading
  • Google recasts Anthos with hitch to AWS Outposts
    If at first you don't succeed, change names and try again

    Google Cloud's Anthos on-prem platform is getting a new home under the search giant’s recently announced Google Distributed Cloud (GDC) portfolio, where it will live on as a software-based competitor to AWS Outposts and Microsoft Azure Stack.

    Introduced last fall, GDC enables customers to deploy managed servers and software in private datacenters and at communication service provider or on the edge.

    Its latest update sees Google reposition Anthos on-prem, introduced back in 2020, as the bring-your-own-server edition of GDC. Using the service, customers can extend Google Cloud-style management and services to applications running on-prem.

    Continue reading

Biting the hand that feeds IT © 1998–2022