EU to offer bug bounties for finding security flaws in open-source software

By Georgina Torbet December 30, 2018

Bug bounties are a way for companies to check the security of their software by offering cash to freelancers who hunt for security exploits and then report them so that they can be fixed. The idea is that everyone benefits from this process: the company gets its software checked by a larger variety of people than they could employ by themselves, the bug hunters get offered legitimate cash for finding a security flaw instead of selling that information on the black market, and the public gets software which has been more thoroughly checked for security issues. Big tech companies like Google and Intel have been running bug bounty programs for years.

Now the European Union is getting in on the action too. From January 2019, the EU will be launching a bug bounty program as part of their Free and Open Source Software Audit project (FOSSA), focused on security issues with open-source software. The FOSSA project was started back in 2014 when security vulnerabilities were found in the OpenSSL Open Source encryption library which is used for the encryption of internet traffic. As free and open-source software performs a number of vital functions for every internet user, the European Parliament and others decided to take on the challenge of auditing the free software that they use for security issues.

Since 2014 the FOSSA project has been gathering data, sponsoring hackathons, and deciding on which bug bounties to offer. The first phase of the project focused on auditing the security of the essential Apache and KeePass software, then the project was renewed and extended to cover other open-source software as well. Now 14 out of the 15 total bug bounties will be launched in January, selected from open-source software projects that are used by EU institutions.

You can find a list of the programs included in the project and the amount offered as a bounty for each one at the website of Julia Reda, an internet activist and Member of the European Parliament (MEP) from Germany. The software that is part of the project includes well-known programs like VLC Media Player and 7-zip, and the bounties offered for finding an exploit range from €25,000 (about $28,000) to €90,000 (just over $100,000).

Editors' Recommendations

Topics

Georgina Torbet

Space Writer

Georgina is the Digital Trends space writer, covering human space exploration, planetary science, and cosmology. She…

Computing

Intel opens bug hunt to all security researchers, offers possible $250K payout

Intel Meltdown

Want to make a quick $250,000? Who doesn't, right? If you have the know-how to hunt down vulnerabilities in hardware and software, then that high-dollar reward could be within your grasp. Intel is now offering an updated bug bounty program until December 31, 2018, setting that nice little chunk of change as the maximum payout for hunting down "side-channel vulnerabilities." These vulnerabilities are hidden flaws in typical software and hardware operations that could potentially lead hackers to sensitive data, like the recent Meltdown and Spectre exploits.
"In support of our recent security-first pledge, we’ve made several updates to our program," the company says. "We believe these changes will enable us to more broadly engage the security research community and provide better incentives for coordinated response and disclosure that help protect our customers and their data."
Intel originally launched its Bug Bounty Program in March 2017 as an invitation-only plan for select security researchers. Now the program is open to all in hopes of minimizing another Meltdown-type discovery by using a wider pool of researchers. The company is also raising the reward amounts for all other bounties, some of which offer up to $100,000.
Intel's list of requirements for reporting side-channel vulnerabilities is somewhat short, including the 18-year-old age requirement, a six-month gap between working with Intel and reporting an issue, among other requirements. All reports must be encrypted with the Intel PSIRT public PGP key, they must identify an original undisclosed problem, include CVSS v3 calculation results, and so on.
Intel wants security researchers to hunt down bugs in its processors, chipsets, solid state drives, stand-alone products like NUCs, networking and communication chipsets, and field-programmable gate array integrated circuits. Intel also lists five types of firmware, and three types of software that fall under its bug bounty umbrella: drivers, applications, and tools.
"Intel will award a Bounty for the first report of a vulnerability with sufficient details to enable reproduction by Intel," the company states. "Intel will award a Bounty from $500 to $250,000 USD depending on the nature of the vulnerability and quality & content of the report. The first external report received on an internally known vulnerability will receive a maximum of $1,500 USD Award."
In January, researchers went public with a vulnerability found in processors dating back to 2011 that allows hackers to access the system memory and grab sensitive data. The attack vector takes advantage of a method processors use to predict the outcome of a process string. Using this predictive technique, processors store sensitive data in the system memory in an unsecured state.
One method of gaining access to this data is called Meltdown, which requires special software to capture the data. With Spectre, hackers could trick legitimate apps and programs into coughing up the sensitive data. Both methods are theoretical, and currently not actively exploited in the wild, yet Intel seemed somewhat embarrassed over the potential issues.
"We will continue to evolve the program as needed to make it as effective as possible and to help us fulfill our security-first pledge," Intel promises.

Emerging Tech

DJI offers hackers up to $30,000 to help find bugs in its drones

DJI Spark best drones under $500

DJI, the popular Chinese drone manufacturer, is asking hackers to help make its devices more secure. The company announced the DJI Threat Identification Reward in a blog post on Monday and outlined the rewards, which range from $100 to $30,000 for uncovering vulnerabilities, depending on how big of a threat the hacker helps avert.

“Security researchers, academic scholars and independent experts often provide a valuable service by analyzing the code in DJI’s apps and other software products and bringing concerns to public attention,” Walter Stockwell, DJI's director of technical standards, said in a statement. “DJI wants to learn from their experiences as we constantly strive to improve our products, and we are willing to pay rewards for the discoveries they make.”

Computing

Meet the bug bounty hunters making cash by finding flaws before bad guys

Bug bounty using computer

Many security researchers make a living with security companies, but not everyone likes the rigidity of a corporate environment. Some work on a freelance basis. Like vigilante outlaws, they dig up bugs and exploits in some of the world's most popular platforms, hoping to gain a reward for their efforts.

Offering a bug bounty is one of the best ways for software companies to find problems with their applications and services before they can be exploited. Offering a reward means those who find a flaw may opt to cash in, instead of selling it to those who would use it for nefarious purposes.