Bounties Boosted for Busting Windows
    Microsoft, an industry foot-dragger to bug bounties, seems  satisfied with the results of the programs over the last few years.
The company has been offering financial rewards for the white  hats who find security flaws in its products since 2012, with sporadic  increases in bounty amounts and products covered, as well as occasional pop-up  opportunities to find problems in select software, such as technical previews,  before a specific deadline. 
This week, Microsoft again expanded the scope of the  products involved, and also bumped potential awards for bounties related to  Hyper-V.
"In the spirit of maintaining a high security bar in  Windows, we're launching the Windows Bounty Program on July 26, 2017," the  company stated Tuesday in a blog  post from the Microsoft Security Response Center team. "This will  include all features of the Windows Insider Preview in addition to focus areas  in Hyper-V, Mitigation bypass, Windows Defender Application Guard, and  Microsoft Edge. We're also bumping up the pay-out range for the Hyper-V Bounty  Program."
That payout range for bugs discovered in Hyper-V is now  fairly large. Microsoft will pay $5,000 to $250,000 for Hyper-V bugs that meet  certain criteria on the Windows 10, Windows Server 2012, Windows Server 2012 R2  and Windows Server Insider Preview platforms.
Outside of Hyper-V, a new base program for bugs found in the  Windows Insider Preview can pay between $500 and $15,000. Focus area programs  offer the same pay range for the Microsoft Edge browser, $500 to $30,000 for  Windows Defender Application Guard, and $500 to $200,000 for "Mitigation  Bypass Bounty and Bounty for Defense" in Windows 10. 
That last category  consists of two separate bounties, maxxing out at $100,000 each, for the same  issue. Essentially, Microsoft is asking individuals to submit a novel  mitigation bypass against the up-to-date Windows platform, as well as a  separate defense idea that would block the exploitation technique.
Beyond the bounty programs launched or updated this week,  Microsoft also offers ongoing bounties for bugs reported in Microsoft .NET  Core, ASP.NET Core and in Microsoft cloud services. Those programs currently  top out at $15,000.
The payouts are adding up. According to a bounty  hunters honor roll that Microsoft maintains, the company has paid out over  $1.5 million in bounties to date. The list includes three payouts of $100,000  bounties under the mitigation bypass category, and a $125,000 bounty for a  mitigation bypass that was shared among three researchers.
Details about Microsoft Bounty Programs are available here.
 
	Posted by Scott Bekker on July 27, 2017