Skip to main content
  1. Home
  2. Computing
  3. News

Make some serious cash finding bugs with Microsoft's Office Insider Bug Bounty program

Mark Coppock
By

ubuntu
Image used with permission by copyright holder
There’s probably no better way to find security bugs than to offer money to the people who actually use software on a daily basis to do just that. That’s why companies like Microsoft and Google offer increasingly significant amounts of money through reward programs aimed at discovering and then fixing vulnerabilities.

Microsoft has its lucrative Bug Bounty program for Windows that just saw its reward double to $30,000 for anyone identifying a verified exploit. Now, the company has announced a new program that offers some serious cash to users of its Office productivity suite for Windows Desktop.

Recommended Videos

The new Office Insider Bug Bounty program will pay anyone using the Insider slow ring builds up to $15,000 for finding security bugs before they have a chance to make their way to the production version. The kinds of bugs for which Microsoft will pay out include:

  • Elevation of privilege via Office Protected View.
  • Macro execution by bypassing security policies to block macros.
  • Code execution by bypassing Outlook automatic attachment block policies.

Go here to dig into the details of how Microsoft will determine eligibility and how you need to submit your bugs. These particular bugs are viewed as likely to be the most prominent and most likely to affect Office users. Macros and email attachments are common vectors of attack on all Office platforms.

Related

Before you spend too much time looking for bugs, here’s a list of vulnerabilities that will not be covered:

  • Vulnerabilities in anything earlier than the current Office Insider slow build on Windows Desktop.
  • Vulnerabilities in user-generated content.
  • Vulnerabilities requiring extensive or unlikely user actions.
  • Vulnerabilities found by disabling existing security features.
  • Vulnerabilities in components not installed by Office.
  • Vulnerabilities in third-party components that might be installed on the system that enable the vulnerability.
  • Vulnerabilities about escaping Protected View where Protected View is explicitly not activated in Office code or enabled by default for the reported scenario.
  • Vulnerabilities in the Application container.
  • Any other category of vulnerability that Microsoft determines to be ineligible, in its sole discretion.

The Microsoft Office Bug Bounty program will last from March 15, 2017, through June 15, 2017. Payouts will range from $500 to $15,000, and of course, there are important terms and conditions to keep in mind. You also need to be a member of the Office Insider program utilizing an Insider slow ring build of Office for Windows Desktop.

You can sign up to be an Office Insider here. Go to File > Account and look under Office Updates to check which version you’re running. Click on Office Insider and select Change Level to move from one ring to another or remove yourself from the Office Insider program.

Editors' Recommendations

Topics
Mark Coppock
Mark Coppock
Computing Writer
Mark has been a geek since MS-DOS gave way to Windows and the PalmPilot was a thing. He’s translated his love for…
How to create a bibliography in Word on Windows and Mac
A family using the computer to browse Fios internet together.

A bibliography is an important part of any well-structured college essay, dissertation, article, or other researched writing sample. It lets your readers know what sources you used as building blocks for your work, and isn’t too difficult to make without a template tool. Still, if you’d like to skip a few steps, there’s a terrific bibliography generator built right into Microsoft Word.

Read more
The unsung hero behind the modernization of Windows laptops
New Surface Laptop Studio 2 with a Surface Pen.

The large, multitouch trackpad was once synonymous with the MacBook. And starting in 2015, that has also included a haptic feedback trackpad, which simulates a physical click via a motorized engine under the surface. It was quite the revelation, and despite some initial skepticism, it really took off.

As you would expect, Apple held a patent on the technology, enjoying a five-year start ahead of other laptops. The first attempts at haptic feedback trackpads on Windows laptops weren't promising either.

Read more
How to create a Memoji on a Mac
Memoji creation screen in Messages on Mac.

Using emojis is a great way to add flair and personality to what would just be a plain ole’ text message. But if you’re an Apple devotee, you’ll also be able to liven your chats up with Memojis. Introduced on iOS 12, Memojis are custom avatars that you make in your likeness. Choose from numerous clothing, facial hair, and other cosmetic filters to dial in your appearance. When finished, your Memojis can be used with a few iOS apps, including Messages and FaceTime.

Read more