VeriSign offering $8,000 for Vista and IE7 exploits

By Justin Mann on January 10, 2007, 8:28 PM
Bug hunters could turn in to bounty hunters with the release of Vista coming up, as VeriSign extends their pay-for-flaws program that promises $8,000 for exploits. For certain types of exploits, found in either Vista or Internet Explorer 7, the company is offering cash for disclosure. Likely this is a stepped up response to the increasing reports of underground sites selling zero-day exploits. With the release of a new OS and its impending rollout onto many machines, it's likely that many vulnerabilities could be dormant and this gives some who might choose to exploit a chance to benefit themselves and the community instead. For those enterprising researchers and hackers, it also gives them a chance to get a return on their skills:

The rules are straightforward: iDefense will pay $8,000 for each submitted vulnerability that allows an attacker to remotely exploit and execute arbitrary code on either of the two Microsoft products.
Only the first submission for a given vulnerability will qualify for the payout, and iDefense will award no more than six payments of $8,000.

The rules only apply to official versions, not release candidates or betas. Microsoft frowns upon this activity, but given their history of long delays between patch cycles and slow responses to critical flaws, one can hardly blame a third party looking for aggressive ways to fight those who would seek to damage their systems.




Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.