phone 234-806-497-4896
email info@samtech.com.ng
   

Microsoft has announced, at the start of the Black Hat 2019 hacking and security event in Las Vegas, that it has paid $4.4 million (£3.6 million) to hackers over the past 12 months. What's more, it has issued a new challenge for confident and aggressive hackers to come and have a go if they think they're hard enough.

Why has Microsoft been paying hackers?

Most large organizations these days, whether they are service or software-driven, offer financial incentives to hackers for finding security vulnerabilities in their offerings. These bug bounties, as they are known, are a win-win scenario for both the organization and the hacker.

The organization gets a heads-up on security issues that can then be fixed and patches distributed before cyber-criminals can exploit those vulnerabilities. The security researchers get a financial incentive for doing the right thing, rather than selling vulnerabilities and their exploits on the dark market or maliciously and illegally using them themselves.


Security researcher, hacker or cyber-criminal?

It's essential to understand the difference between a hacker and a cyber-criminal; language is crucial here. A hacker is someone who, concerning this debate, investigates, probes and even breaks into computer systems or software code to expose vulnerabilities with security or privacy implications.

A cyber-criminal is someone who does all of this with malicious intent, whereas a hacker is simply a security researcher whose motivations are to prevent cyber-criminals from succeeding and protecting both organizations and the general public from their malicious activities.

In other words, both security researchers and cyber-criminals engage in hacking, but only security researchers are hackers. Criminals are just that and need to be called out as such.

What has prompted Microsoft to confirm the hacker payments?

Microsoft has announced the launch of a new sandboxed-environment, called the Azure Security Lab, and invited the most talented of hackers to "come and do their worst to emulate criminal hackers in a customer-safe cloud environment."

The Microsoft Security Response Center (MSRC) describes the Azure Security Lab as a set of dedicated cloud hosts for security researchers to test attack scenarios, all the while being safely isolated from Azure customers. "Accepted applicants will have access to quarterly campaigns for targeted scenarios with added incentives," the MSRC announcement stated, "as well as regular recognition and exclusive swag."

How much can Microsoft hackers expect to earn?

The new announcement includes details of the financial incentives on offer to those who can "confidently and aggressively test Azure," with the top bounty reward for Azure vulnerabilities now being $40,000 (£33,000) which is twice as much as it was previously.

But there's more, much more, on offer to those hackers who not only research vulnerabilities but successfully exploit them as well. Those accepted into the Azure Security Lab get access to the "scenario challenge" which encourages hackers to explore "high-value scenarios."

How much is up for grabs if a hacker can, for example, demonstrate a method of executing an Azure host denial of service (DoS) attack? How does $50,000 (£41,000) sound? Not enough? Microsoft has you covered: hackers who can "demonstrate a functional exploit enabling an escape from a guest VM (Virtual Machine) to the host or to another guest VM," can expect a $300,000 (£247,000) payday.

There are caveats, though. Microsoft expects a high-quality report for that kind of reward. Which means providing all the information necessary for a Microsoft engineer to be able to reproduce, understand and fix the issue. "This typically includes a concise write-up, or video, containing any required background information, a description of the bug and an attached proof of concept," according to Microsoft.

Can anyone join the new Microsoft bug bounty program?

Anyone can apply to join the Azure Security Lab and do so right now. To request a Windows or Linux VM you just need to complete the appropriate form which can be found here.

However, Microsoft has stated that there are only "a limited number of hosts available in the Azure Security Lab," and encouraged applicants to sign up for a 30-day trial period.

Comments

There are no comments

Post a comment

We would be glad to get your feedback. Take a moment to comment and tell us what you think.

* Required fields

Email will not be published.