There’s probably no better way to find security bugs than to offer money to the people who actually use software on a daily basis to do just that. That’s why companies like Microsoft and Google offer increasingly significant amounts of money through reward programs aimed at discovering and then fixing vulnerabilities.
Microsoft has its lucrative Bug Bounty program for Windows that just saw its reward double to $30,000 for anyone identifying a verified exploit. Now, the company has announced a new program that offers some serious cash to users of its Office productivity suite for Windows Desktop.
The new Office Insider Bug Bounty program will pay anyone using the Insider slow ring builds up to $15,000 for finding security bugs before they have a chance to make their way to the production version. The kinds of bugs for which Microsoft will pay out include:
- Elevation of privilege via Office Protected View.
- Macro execution by bypassing security policies to block macros.
- Code execution by bypassing Outlook automatic attachment block policies.
Go here to dig into the details of how Microsoft will determine eligibility and how you need to submit your bugs. These particular bugs are viewed as likely to be the most prominent and most likely to affect Office users. Macros and email attachments are common vectors of attack on all Office platforms.
Before you spend too much time looking for bugs, here’s a list of vulnerabilities that will not be covered:
- Vulnerabilities in anything earlier than the current Office Insider slow build on Windows Desktop.
- Vulnerabilities in user-generated content.
- Vulnerabilities requiring extensive or unlikely user actions.
- Vulnerabilities found by disabling existing security features.
- Vulnerabilities in components not installed by Office.
- Vulnerabilities in third-party components that might be installed on the system that enable the vulnerability.
- Vulnerabilities about escaping Protected View where Protected View is explicitly not activated in Office code or enabled by default for the reported scenario.
- Vulnerabilities in the Application container.
- Any other category of vulnerability that Microsoft determines to be ineligible, in its sole discretion.
The Microsoft Office Bug Bounty program will last from March 15, 2017, through June 15, 2017. Payouts will range from $500 to $15,000, and of course, there are important terms and conditions to keep in mind. You also need to be a member of the Office Insider program utilizing an Insider slow ring build of Office for Windows Desktop.
You can sign up to be an Office Insider here. Go to File > Account and look under Office Updates to check which version you’re running. Click on Office Insider and select Change Level to move from one ring to another or remove yourself from the Office Insider program.
