Skip to main content

Facebook to start paying Bug finders




Facebook has decided it’s a good idea to offer up a $500 bounty for exploits reported to the Facebook security team. They are claiming they will pay out larger amounts for ‘truly significant’ bugs, but they aren’t qualifying that claim with any guidelines or amounts.

Facebook is going to pay hackers to find problems with its website — just so long as they report them to Facebook’s security team first.

The company is following Google and Mozilla in launching a Web “Bug Bounty” program. For security related bugs — cross site scripting flaws, for example — the company will pay a base rate of $500. If they’re truly significant flaws Facebook will pay more, though company executives won’t say how much.

“In the past we’ve focused on name recognition by putting their name up on our page, sending schwag out and using this an avenue for interviews and the recruiting process,” said Alex Rice, Facebook’s product security lead. “We’re extending that now to start paying out monetary rewards.”

On Friday, Facebook will launch a new Whitehat hacking portal where researchers can sign up for the program and report bugs.

Many hackers go public with the software and website flaws they find to gain prestige. Finding an important bug on a widely used website such as Facebook can help make a journeyman hacker’s career, and going to the press with the issue can make him — or her — famous.
But talking about the issue before Facebook has had a chance to patch it, can be risky for Facebook users. In recent years, other companies have started these bug bounty programs to encourage hackers to keep quiet about the problems they find until they are patched.


Google pays between $500 and $3,133.70, depending on the severity of the flaw.

Google started to pay for browser bugs in early 2010, and then in November it expanded the program to cover bugs in its Web properties too.The Web bug bounty program has helped Google uncover a lot of programming errors in the past eight months, most of which have been in Google’s lesser-known products, a company spokesman said this week.

Google sees its Web program as a big success. “We’re very happy with the success of our vulnerability reward program so far. We’ve already given out $300,000 and have seen a variety of interesting bugs,” the spokesman said in an e-mail message.

Facebook’s security team already engages in a lot of dialogue between security researchers and its own programmers. The company is contacted between 30 and 50 times each week by hackers. Their information leads to an average of about one to three “actionable bugs,” per week, Rice said. Most of these are cross-site scripting or cross-site request forgery issues. These are both very common Web programming errors that could be abused by scammers and cybercrooks to rip off Facebook users.
Labels:

Comments

Post a Comment

Leave ur Comment Please :)

Popular posts from this blog

Defenders of Internet Freedom

From Politicians and professors to computer scientists and the first programmer, take a look at the champions of open internet. Julian Assange    Editor-In-Cheif, Wikileaks Assange has directed the publication of secret documents on the afghan wars and Guantanamo Bay Prisoner files and US Cables and also disclosed many facts which were unknown to world. He defaced many big companies and reiceved many death threads and became a Bad person in the eyes of the world. Sir Tim Berners-Lee Inventor of the world wide web Tim is instrumental pushing open data at high level to governments around the world and is a campingner against two tier internet. He also strongly supported a group putting pressure on the US government over the proposed US PIPA Act, which aims to impose restrictions and censorship on the internet. Jimmy Wales Chairman, Wikipedia Jimmy Wales is the man behind wikipedia wales participated in an internet blackout, closing the site for a day, in protest against the pro
4 comments
Read More

What is Steganography

Steganography is the art and science of hiding messages. Steganography is often combined with cryptography so that even if the message is discovered it cannot be read. The word steganography is derived from the Greek words “steganos” and “graphein”, which mean “covered” and “writing.” Steganography, therefore, is covered writing. Historical stenganography involved techniques such as disappearing ink or microdots. Modern steganography involves hiding data in computer files. It is fairly easy to hide a secret message in a graphic file without obviously altering the visible appearance of that file. Steganography software OutGuess is a universal steganographic tool that allows the insertion of hidden information into the redundant bits of data sources. The nature of the data source is irrelevant to the core of OutGuess. The program relies on data specific handlers that will extract redundant bits and write them back after modification. In this version the PNM and JP
1 comment
Read More

Windows Basic Security tutorial

Hey guys, I just wanted to quickly write a tutorial about some basic computer security. First, you have Windows 7 installed freshly with no current infections. A fresh install is best. Second, you are a moderate user of the internet. Basic Security Applications You are going to want a few applications to help you out along the way. First off, you will need two (2) anti-malware programs. This is to ensure that if one misses something, you have a second one to make sure. I personally use Microsoft Security Essentials (MSE) and Malwarebytes Anti-Malware (MBAM). Update these as often as they need to be. Run both of these every single day. Once a week minimum, but daily is far more advantageous. If you torrent, you will want PeerBlock . PeerBlock basically blocks your peers, especially RIAA, the govt, and other unsavory sorts from tracking who you are and what you're downloading. If you don't use PeerBlock, you can almost guarantee getting cau
1 comment
Read More