Windows 10: Microsoft Bounty Program Updates

Brink · Apr 3, 2019

In 2018 The Microsoft Bounty Program awarded over $2,000,000 to encourage and reward external security research in key technologies to protect our customers. Building on that success, we are excited to announce a number of improvements in our bounty programs to better serve the security research community.

Faster bounty review – As of January 2019, the Cloud, Windows, and Azure DevOps programs now award bounties upon completion of reproduction and assessment of each submission, rather than waiting until the final fix has been determined. Shortening the time from submission to award determination is just one way we will get bounty rewards to researchers faster.

Faster bounty payments, with more payment options – Once a vulnerability submission has successfully qualified for bounty award, we want to ensure payments happen quickly. Microsoft is partnering with HackerOne for bounty payment processing and support to deliver bounty awards efficiently and with more options like PayPal, crypto currency, or direct bank transfer in more than 30 currencies. HackerOne also supports award splitting and charity donations. Additionally, Microsoft bounty awards processed through HackerOne will contribute to your overall reputation score on the HackerOne platform. To find out more about our new partnership with HackerOne, check out our FAQ page.

Vulnerability reports should still be sent to the Microsoft Security Response Center directly at L: secure@microsoft.com. Do not send reports of vulnerabilities in Microsoft products and services to HackerOne.
As we accelerate our bounty assessments and rewards, we ask that researchers continue to work with us to protect customers and follow Coordinated Vulnerability Disclosure guidelines.

Increasing awards and scope – Microsoft is rewarding more for vulnerability reports in multiple bounty programs; in January 2019 we raised top award levels from $15K to $50K for the Windows Insider Preview bounty and from $15K to $20K for the Microsoft Cloud Bounty program which includes Azure, O365, and other online services. We’ve also expanded the scope of the Cloud bounty and will continue to expand scope and rewards across our programs throughout the year. Check back regularly for new research areas and follow us on Twitter for bounty program announcements.

New policy for duplicates – Historically, external reports of internally known vulnerabilities were rewarded 10% of the eligible bounty award as the report did not inform us of a new and previously unknown issue. But understanding what external researchers are capable of discovering is valuable insight, and we want to reward researchers for their contributions whenever we can. Therefore, we have updated our policy on duplicate submissions. The first researcher to report a bounty-eligible vulnerability will receive the full eligible bounty award, even if it is internally known. There is no change to our policy regarding duplicate external reports of the same vulnerability.

Microsoft is committed to enhancing our Bounty Programs and strengthening our partnership with the security research community, and I look forward to sharing more updates and improvements in the coming months. As always, if you ever have any questions or concerns about the process, you can reach us at L: msrclistens@microsoft.com.

Happy Hacking!
Jarek Stanley, @JarekMSFT
Senior Program Manager
MSRC
 
All Microsoft Bug Bounty Programs are subject to the terms and conditions outlined here.

The Microsoft Security Response Center is part of the defender community and on the front line of security response evolution. For more than twenty years, we have been engaged with security researchers working to protect customers and the global online community. For more information, please visit our website at www.microsoft.com/msrc and follow our Twitter page at @msftsecresponse.
Click to expand...

Source: Microsoft Bounty Program Updates: Faster bounty review, faster payments, and higher rewards MSRC

Tweet

— Twitter API (@User) View on Twiiter

:)

Raevenlord · Apr 3, 2019

Microsoft Announces the Windows Bounty Program

While Microsoft has been offering bug bounty incentives since at least 2012, Google has arguably been much more vocal in its bug bounty programs. The company recently increased the maximum payout in its bug bounty programs (mainly focused on Android) to a staggering $200,000, and now Microsoft is not only following suit - it's upping the game.

With the Windows Bounty Program, which Microsoft announced yesterday, the company is looking towards an increased incentive to security-hardening suggestions from tech-savvy users. This program will extend to all features of the Windows Insider Preview in addition to focus areas in Hyper-V, Mitigation bypass, Windows Defender Application Guard, and Microsoft Edge. And incentives starting at $500 and going all the way up to $250,000 are very, very respectful.

Source: Blogs.Technet @ Microsoft

Brink · Apr 3, 2019

Extending the Microsoft Office Bounty Program

Microsoft announces the extension of the Microsoft Office Bounty Program through December 31, 2017. This extension is retroactive for any cases submitted during the interim.

The engagement we have had with the security community has been great and we are looking to continue that collaboration on the Office Insider Builds on Windows. This program represents a great chance to identify vulnerabilities prior to broad distribution.

Program Details

Office Insider Builds give users early access to the latest Office capabilities and security innovation. By testing against these early builds, issues can potentially be found prior to production release. This helps improve quality and protect customers.

How it works

Types of vulnerabilities awarded and their details are listed in the Microsoft Office Insider Builds on Windows Bounty Program Terms, including:

Elevation of privilege via Office Protected View

Macro execution by bypassing security policies to block macros

Code execution by bypassing Outlook automatic attachment block policies

The program duration is from March 15 to December 31, 2017

Bounty payout ranges during this period will be $6,000 to $15,000 USD

Call to action: send your vulnerabilities to L: secure@microsoft.com and let us know that you want your submission to be part of this program!

As always, the most up-to-date information about the Microsoft Bounty Programs can be found at https://aka.ms/BugBounty and in the associated terms and FAQs.

Phillip Misner,
Principal Security Group Manager
Microsoft Security Response Center
Click to expand...

Source: Extending the Microsoft Office Bounty Program MSRC

Brink · Apr 3, 2019

Microsoft Bounty Programs Expansion – Azure and Project Spartan

I am excited to announce significant expansions to the Microsoft Bounty Programs. We are evolving the 'Online Services Bug Bounty, launching a new bounty for Project Spartan, and updating the Mitigation Bypass Bounty.

This continued evolution includes additions to the Online Services Bug Bounty Program:

Azure

Azure is Microsoft’s cloud platform and the backbone of Microsoft cloud services.

This program will include a number of Azure services, such as: Azure virtual machines, Azure Cloud Services, Azure Storage, Azure Active Directory and much more

Sway.com

Sway.com is a web application that lets users express ideas in an entirely new way across many devices and platforms

Raising the maximum payout for the Online Services Bounty Program

We will pay up to $15,000 USD for critical bugs, as always, more for more impactful and better documented bugs.

We’re also launching a new bounty related to the Windows 10 Technical Preview:

Project Spartan Bug Bounty

Microsoft’s new browser will be the onramp to the internet for millions of users when Windows 10 launches later this year. Securing this platform is a top priority for the browser team.

This bounty includes Remote Code Execution and Sandbox Escapes, as well as design-level security bugs.

Always be sure to use the latest version released in the Windows 10 Technical Preview

Microsoft will pay up to $15,000 USD for security vulnerabilities reported in Project Spartan, you can see the specifics in the program terms. Don’t hesitate as the Project Spartan Bug Bounty will run from April 22, 2015 to June 22, 2015

The bounties for Spartan are tiered by the criticality of the issue reported, as well as the quality of the documentation and how reproducible the issue is.

The Mitigation Bypass bounty and the Bonus bounty for Defense are both very active, paying up to $100,000 USD for novel methods to bypass active mitigations (e.g. ASLR and DEP) in our latest released version of operating system (currently Windows 8.1 and Server 2012 R2) and a bonus of up to $50,000 USD for actionable defense techniques to the reported bypass. We have one addition to the Mitigation bypass bounty:

Hyper-V escape

Guest-to-Host

Guest-to-Guest

Guest-to-Host DoS (non-distributed, from a single guest)

These important additions to the Bounty Programs reflect the continued shift and evolution of technology towards the cloud. The additions to the bounty program will be part of the rigorous security programs at Microsoft. They will be worked alongside the Security Development Lifecycle (SDL), Operational Security Assurance (OSA) framework, regular penetration testing of our products and services and Security and Compliance Accreditations by third party audits.

Microsoft has a long history of working closely with security researchers. Having personally done penetration testing and exploit mitigation, I understand that this is intense and difficult work. I can say that we truly value these contributions. Bug bounties are an increasingly important part of the vulnerability research and defense ecosystem and will continue to evolve over time. We will be regularly managing the Microsoft Bounty Programs to help us best protect our many users.

Mark Russinovich will be sharing some information in his “Assume Breach: An Inside Look at Cloud Service Provider Security” talk. You can also come by the Microsoft Booth at RSA on April 23, 2PM for a Bounty Program Q&A or you can always find the most up to date information about our bounty programs at https://aka.ms/BugBounty and in the associated terms and FAQs.

I’m looking forward to seeing some great submissions!
Jason Shirk
Click to expand...

Source: Microsoft Bounty Programs Expansion – Azure and Project Spartan - Microsoft Security Response Center - Site Home - TechNet Blogs

Windows 10: Microsoft Bounty Program Updates

Microsoft Bounty Program Updates

Microsoft Bounty Program Updates

Microsoft Bounty Program Updates

Microsoft Bounty Program Updates - Similar Threads - Microsoft Bounty Program

Microsoft Announces the Xbox Bounty program

Microsoft launches Identity Bounty program

Microsoft Announcing Speculative Execution Bounty Program Launch

Microsoft Adds OneDrive to Bug Bounty Program

Extending the Microsoft Office Bounty Program

Announcing the Windows Bounty Program

Extending Microsoft Edge Bounty Program

Microsoft Bounty Programs Expansion – Azure and Project Spartan

Extending the Microsoft Edge Bounty Program