It has been six years now since Google has started its bug bounty program and they have paid
over over $6 million (over $2 million last year alone) to the security
researchers. The company has announced two changes in the Chrome Reward
Program, first they increased the reward for Chromebooks and second they added
a new Bug bounty.
The Bug bounty programs is seen as appreciations for the
individuals and groups of hackers to find out the flaws and to disclose them to the company
instead of selling them to someone else who can exploit the flaw.
According to the company’s security team they have not
received any single successful submission in compromise of a Chromebook in
guest mode which has reward of a $50,000.
Now, Google has doubled the bounty for the top Chrome
reward, to $100,000. “That said, great research deserves great awards, so we’re
putting up a standing six-figure sum, available all year round with no quotas
and no maximum reward pool,” Google declared.
The qualifying reward rules are as follows:
• Safe
Browsing must be enabled on Chrome and have an up-to-date database (this may
take up to a few hours after a new Chrome install).
• Safe
Browsing servers must be reachable on the network.
• Binary
must land in a location a user is likely to execute it (e.g. Downloads folder).
• The user
can’t be asked to change the file extension or recover it from the blocked
download list.
• Any
gestures required must be likely and reasonable for most users. As a guide,
execution with more than three reasonable user gestures (eg: click to download,
open .zip, launch .exe) is unlikely to qualify, but it’ll be judged on a
case-by-case basis. The user can’t be expected to bypass warnings.
• The
download should not send a Download Protection Ping back to Safe Browsing. Download
Protection Pings can be measured by checking increments to counters at
chrome://histograms/SBClientDownload.CheckDownloadStats. If a counter
increments, a check was successfully sent (with exception to counter #7, which
counts checks that were not sent).
• The
binary’s hosting domain and any signature cannot be on a whitelist. You can
measure this by checking
chrome://histograms/SBClientDownload.SignedOrWhitelistedDownload does not
increment.