Google Expands Reward Programs

Tuesday, February 14, 2012 @ 01:02 PM gHale

Google continues to see improvements in products as it continues its rewards program, so with that understood, the company is expanding the scope in order to cover security issues in the Chromium OS.

“By all available measures, the program has been a big success,” said Google Security Team technical program manager Adam Mein about the company’s Web vulnerability reward program.

Google Wallet Hacked Again
Rewards Mean Users Secure
Flaw in Google Wallet PIN Security
Breach Aftermath: Hijacked Sites

Since its launch in November 2010, the program has generated reports about 1,100 legitimate security issues that affected hundreds of Google’s Web applications and services.

Google paid $410,000 to more than 200 researchers for reporting 730 vulnerabilities that qualified for rewards. However, the company knows the sum is a mere fraction of what it would have needed to pay to find the vulnerabilities via professional security audits.

“Google has gotten better and stronger as a result of this work,” Mein said. “We get more bug reports, which means we get more bug fixes, which means a safer experience for our users.”

The company’s other security reward program, which pays researchers for finding vulnerabilities in the Chromium open source browser — the basis for Google Chrome — has also been a big success, said Google security engineer Chris Evans.

The Chromium Security Rewards Program has been running for over two years and Google has paid security researchers more than $300,000 through it.

“We’ve been fascinated by the variety and ingenuity of bugs submitted by dozens of researchers,” Evans said. “We’ve received bugs in roughly every component, ranging from system software (Windows kernel / Mac OS X graphics libraries / GNU libc) to Chromium / WebKit code and to popular open source libraries (libxml, ffmpeg).”

The efforts of the wider security community have increased Chromium’s stability and robustness, Evans said.

Google decided to expand the scope of its Chromium security rewards program in order to also reward researchers who discover high-severity vulnerabilities in Chromium OS, a Linux-based OS built around the browser.

Chromium OS has a large code base with much of it borrowed from Linux and other open source projects. This means the likelihood of discovering vulnerabilities in the entire OS is significantly higher for the Chromium browser.

Leave a Reply

You must be logged in to post a comment.