also @ TechSpot: OCZ Vertex 450 SSD Review

Mozilla pays 12-year-old $3,000 for finding critical Firefox flaw

By Emil Protalinski

On October 23, 2010, 1:55 PM

Mozilla pays a bounty to security researchers who disclose vulnerabilities they find in an appropriate manner. The latest security researcher to get paid is none other than Alex Miller, a 12-year-old boy. Miller found and reported a critical buffer overflow and memory corruption flaw in Mozilla's Firefox browser and earned $3,000 for his discovery, according to Mercury News. Miller says he was motivated to search for Firefox security holes after Mozilla increased its bug bounty from $500 to $3,000.

The seventh grader, who described himself as a Firefox loyalist, has reported a Firefox vulnerability in the past, but that one did not qualify for the cash payout. Annoyed at not getting rewarded the first time, Miller says he spent about 90 minutes each day for about 10 days until he spotted a flaw in the memory of the running program. In other words, he examined code for about 15 hours, and was paid $200 per hour for it.

The flaw can be exploited to crash a victim's browser and potentially run arbitrary code on their computer. It was patched this week in Firefox 3.6.11 and Firefox 3.5.14, but also affects Mozilla's Thunderbird 3.1.5, Thunderbird 3.0.9, and SeaMonkey 2.0.9. It looks like in the world of open source bug hunting, age is not a factor.


,

User Comments: 47

Got something to say? Post a comment
  1. gratz to the kid, personally im impressed that a 12 year old kid noticed a flaw that most programmers missed

    as for increasing the reward to $3000, it certainly is a big incentive but i can imagine people examing every line of code mozilla has now just for an easy chance at some money

  2. Thanks Alex! I use FF. I think you should get more than that ( future job / help with school, college $) because if it had spread, crashed users browsers and potentially run arbitrary code on their computer, it would have cost more to fix, then again being great full is a good thing too and you definitely have a bright future ahead of you man, keep up the good work dude.

  3. I don't think is luck.

  4. Good for him. I wasn't doing anything nearly as productive at his age.

  5. Frenzoff said:

    gratz to the kid, personally im impressed that a 12 year old kid noticed a flaw that most programmers missed

    as for increasing the reward to $3000, it certainly is a big incentive but i can imagine people examing every line of code mozilla has now just for an easy chance at some money

    its not really ez money, if you've ever done any programming, its really hard to find errors in code, especially if u didn't write it.

  6. zecias said:

    Frenzoff said:

    gratz to the kid, personally im impressed that a 12 year old kid noticed a flaw that most programmers missed

    as for increasing the reward to $3000, it certainly is a big incentive but i can imagine people examing every line of code mozilla has now just for an easy chance at some money

    its not really ez money, if you've ever done any programming, its really hard to find errors in code, especially if u didn't write it.

    I have done a few programming. And i often spend hours to find a bug, in my own written code. This kid really amazed me. I guess there is still many things we need to learn in the programming world

  7. Good for him, i bet some day, if he keeps going he could be the next Bill Gates, or a Facebook, or Google, or Myspace, CEO... Billionare... Congrats man...

  8. He looks like malcolm in malcolm in the middle!

  9. That is an amazing story. Who says you need a degree to be a Computer Engineer? lol

    I would have been frustrated after a half hour of not finding anything. Well done, sir.

  10. Amazing! Makes me want to go bug hunting.

  11. Mozilla should have given the kid a bigger prize... I mean $3,000 for a security flaw. I'm sure the money they saved from finding the security flaw is worth more than a measly $3k.

  12. When I was 12 and now are 2 completely different things. I might understand if he was a blob of a kid sitting in front of his computer all day banging away at WOW or something. (everyone has see the youtube video of the fat kid getting his WoW taken away) From the looks of it tho, he is doing something more that most 12 Year-olds. Lets see go out and play... What is that for a 12year old now? going to the mall, being an annoyance to everyone? Spray painting walls. Doing drugs? Good Job Kid you got my 2 thumbs up.

  13. This is an awesome testament to the power of the internet and the open source community that a seventh grader is already contributing to the world. We do indeed live in an amazing world.

  14. Amazing individual, i wonder where he learned all of this.

  15. Too bad he can't spend it till he's 18..(because his mummy says so) lol

  16. blimp01 said:

    this kids gona create his own OS and rule the market in a few years

    Google will most likely get to him first!!

  17. so im not the only one who thought he would be perfect for playing a young bill gates if there is ever gonna be a movie on him.

  18. for one thing this kid has the brain and dedication, and he looked like bill gates' long lost child. i think that hair cut is what won me over.

  19. that kid will go far. hope he stays 'white hat'.

  20. I wish my brain was as enhanced as his at the age of 12, shoot I'm still learning about this world of technology! - Keep up the good work kid.

  21. I found and posted a couple - never got anything. Mozilla doesn't care about bugs or security - they care about bells and whistles. That's where they spend all their time.

  22. He's definitely going places.

Recently commented stories

Post a new comment

Social Login & Guest Posting TechSpot Members
Login here or sign up for free,
it takes about a minute.
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.
TechSpot on:

Subscribe to TechSpot

Get free exclusive content, learn about new features and breaking tech news.