Windows 10: Practical advice for earning higher Microsoft bounty awards

Brink · Mar 13, 2019

This year at the Nullcon International Security Conference I shared practical advice for how security researchers can maximize the impact of their security vulnerability submissions and earn higher bounty awards under the Microsoft Bounty Program. For those who couldn’t be there, I had two core pieces of advice.

First, focus vulnerability research on the products and services that are eligible for bounty rewards. The eligible scope is published on our website. We expand our programs throughout the year, so check back regularly for new potential areas to research and follow us on Twitter for announcements of new bounty programs.

Second, when reporting security vulnerabilities, provide clear, concise information to help our engineering teams reproduce the vulnerability for themselves. Detailed and well written instructions, or even short videos can more than double the possible award amount for bounty eligible properties.

In addition to talking about vulnerability hunting in Microsoft’s bounty programs, we also want to help security researchers develop their skills. This year we sponsored more than 20 researchers to attend the conference, which included hands on training and workshops on hardware and software security. With almost 2000 attendees from across India, Nullcon was a great place to connect with the security researcher community across the region and see excellent technical talks from James Forshaw, Jaya Baloo, and others. Thanks to Antriksh Shah and the team at Payatu for bringing everyone together for such a great event.

Thank you to everyone who I met at Nullcon and to those who attended my talk. For more details and some real-world examples of high quality and high reward submissions, check out my presentation slides here.

Happy Hacking!
Jarek Stanley, @JarekMSFT
Senior Program Manager
MSRC
Click to expand...

Source: Practical advice for earning higher Microsoft bounty awards MSRC

:)

Brink · Mar 13, 2019

Extending the Microsoft Office Bounty Program

Microsoft announces the extension of the Microsoft Office Bounty Program through December 31, 2017. This extension is retroactive for any cases submitted during the interim.

The engagement we have had with the security community has been great and we are looking to continue that collaboration on the Office Insider Builds on Windows. This program represents a great chance to identify vulnerabilities prior to broad distribution.

Program Details

Office Insider Builds give users early access to the latest Office capabilities and security innovation. By testing against these early builds, issues can potentially be found prior to production release. This helps improve quality and protect customers.

How it works

Types of vulnerabilities awarded and their details are listed in the Microsoft Office Insider Builds on Windows Bounty Program Terms, including:

Elevation of privilege via Office Protected View

Macro execution by bypassing security policies to block macros

Code execution by bypassing Outlook automatic attachment block policies

The program duration is from March 15 to December 31, 2017

Bounty payout ranges during this period will be $6,000 to $15,000 USD

Call to action: send your vulnerabilities to L: secure@microsoft.com and let us know that you want your submission to be part of this program!

As always, the most up-to-date information about the Microsoft Bounty Programs can be found at https://aka.ms/BugBounty and in the associated terms and FAQs.

Phillip Misner,
Principal Security Group Manager
Microsoft Security Response Center
Click to expand...

Source: Extending the Microsoft Office Bounty Program MSRC

Brink · Mar 13, 2019

Recognizing Q3 Top 5 Bounty Hunters

Throughout the year, security researchers submit some amazing work to us under the Microsoft Bug Bounty program. Starting this quarter, we want to give a shout out to and acknowledge the hard work and dedication of the following individuals and companies who have contributed to securing Microsoft’s products and services over our third quarter (January-March 2018).

Top 5 Bounty Hunters by Award:

Kai Kang (@4B5F5F4B) - $40,000

Nick Freeman - $20,000

Yves Jean Avenard (Mozilla) - $15,000

The UK’s National Cyber Security Centre - $15,000

Yunhai Zhang (NSFOCUS) - $15,000

Top 5 Bounty Hunters by Qualifying Bounty Submissions:

Ashar Javed (@soaj1664ashar) – 22 Submissions

Cameron Vincent (@secretlyhidden1) – 16 Submissions

Suresh Chelladuri – 5 Submissions

Kai Kang (@4B5F5F4B) – 3 Submissions

Mario Gomes (@netfuzzer) – 2 Submissions

Congratulations to these researchers! Starting this year, these tallies will be reflected in updated Top Security Researcher lists we unveil at BlackHat USA. The MSRC team wants to extend our sincere thanks for the continued support and submissions from all of our security researchers. Together we can make the ecosystem more secure.

Would you like to be in our “Top 5" Bug Bounty program awards? Check out https://aka.ms/bugbounty and send us your submissions to any of the bug bounty programs that we have listed. Send us a high-quality report to ensure the highest possible payout, you might just find yourself in our quarterly “Top 5” awards!
Click to expand...

Source: Recognizing Q3 Top 5 Bounty Hunters MSRC

Brink · Mar 13, 2019

Microsoft Bounty Programs Expansion – Azure and Project Spartan

I am excited to announce significant expansions to the Microsoft Bounty Programs. We are evolving the 'Online Services Bug Bounty, launching a new bounty for Project Spartan, and updating the Mitigation Bypass Bounty.

This continued evolution includes additions to the Online Services Bug Bounty Program:

Azure

Azure is Microsoft’s cloud platform and the backbone of Microsoft cloud services.

This program will include a number of Azure services, such as: Azure virtual machines, Azure Cloud Services, Azure Storage, Azure Active Directory and much more

Sway.com

Sway.com is a web application that lets users express ideas in an entirely new way across many devices and platforms

Raising the maximum payout for the Online Services Bounty Program

We will pay up to $15,000 USD for critical bugs, as always, more for more impactful and better documented bugs.

We’re also launching a new bounty related to the Windows 10 Technical Preview:

Project Spartan Bug Bounty

Microsoft’s new browser will be the onramp to the internet for millions of users when Windows 10 launches later this year. Securing this platform is a top priority for the browser team.

This bounty includes Remote Code Execution and Sandbox Escapes, as well as design-level security bugs.

Always be sure to use the latest version released in the Windows 10 Technical Preview

Microsoft will pay up to $15,000 USD for security vulnerabilities reported in Project Spartan, you can see the specifics in the program terms. Don’t hesitate as the Project Spartan Bug Bounty will run from April 22, 2015 to June 22, 2015

The bounties for Spartan are tiered by the criticality of the issue reported, as well as the quality of the documentation and how reproducible the issue is.

The Mitigation Bypass bounty and the Bonus bounty for Defense are both very active, paying up to $100,000 USD for novel methods to bypass active mitigations (e.g. ASLR and DEP) in our latest released version of operating system (currently Windows 8.1 and Server 2012 R2) and a bonus of up to $50,000 USD for actionable defense techniques to the reported bypass. We have one addition to the Mitigation bypass bounty:

Hyper-V escape

Guest-to-Host

Guest-to-Guest

Guest-to-Host DoS (non-distributed, from a single guest)

These important additions to the Bounty Programs reflect the continued shift and evolution of technology towards the cloud. The additions to the bounty program will be part of the rigorous security programs at Microsoft. They will be worked alongside the Security Development Lifecycle (SDL), Operational Security Assurance (OSA) framework, regular penetration testing of our products and services and Security and Compliance Accreditations by third party audits.

Microsoft has a long history of working closely with security researchers. Having personally done penetration testing and exploit mitigation, I understand that this is intense and difficult work. I can say that we truly value these contributions. Bug bounties are an increasingly important part of the vulnerability research and defense ecosystem and will continue to evolve over time. We will be regularly managing the Microsoft Bounty Programs to help us best protect our many users.

Mark Russinovich will be sharing some information in his “Assume Breach: An Inside Look at Cloud Service Provider Security” talk. You can also come by the Microsoft Booth at RSA on April 23, 2PM for a Bounty Program Q&A or you can always find the most up to date information about our bounty programs at https://aka.ms/BugBounty and in the associated terms and FAQs.

I’m looking forward to seeing some great submissions!
Jason Shirk
Click to expand...

Source: Microsoft Bounty Programs Expansion – Azure and Project Spartan - Microsoft Security Response Center - Site Home - TechNet Blogs

Windows 10: Practical advice for earning higher Microsoft bounty awards

Practical advice for earning higher Microsoft bounty awards

Practical advice for earning higher Microsoft bounty awards

Practical advice for earning higher Microsoft bounty awards

Practical advice for earning higher Microsoft bounty awards - Similar Threads - Practical advice earning

Award winning email by Microsoft

Award winning email by Microsoft

Microsoft Awards !

Microsoft Awards !

Microsoft Awards !

Best practices on PC monitor usage advice sought?

Best practices on PC monitor usage advice sought?

Microsoft Bounty Program Updates

Extending Microsoft Edge Bounty Program