Google expands the scope of its vulnerability reward programs to cover Chromium OS

Google says that both its Web and Chromium security reward programs were a big success

Encouraged by the success of its Web and Chromium vulnerability reward programs, Google has decided to expand their scope in order to cover security issues in Chromium OS as well.

"By all available measures, the program has been a big success," said Google Security Team technical program manager Adam Mein about the company's Web vulnerability reward program, in a [a href="http://googleonlinesecurity.blogspot.com/2012/02/celebrating-one-year-of-web.html">blog post</a>] on Thursday.

Since its launch in November 2010, the program has generated reports about 1,100 legitimate security issues that affected hundreds of Google's Web applications and services.

Google paid a total of US$410,000 to more than 200 researchers for reporting 730 vulnerabilities that qualified for rewards. However, this is most likely just a fraction of what the company would have needed to pay in order to find the same number of vulnerabilities via professional security audits.

"Google has gotten better and stronger as a result of this work," Mein said. "We get more bug reports, which means we get more bug fixes, which means a safer experience for our users."

The company's other security reward program, which pays researchers for finding vulnerabilities in the Chromium open source browser -- the basis for Google Chrome --- has also been a big success, according to Google security engineer Chris Evans.

The Chromium Security Rewards Program has been running for over two years and Google has paid security researchers more than $300,000 through it.

"We've been fascinated by the variety and ingenuity of bugs submitted by dozens of researchers," Evans said in a separate [a href="http://blog.chromium.org/2012/02/expanding-chromium-security-rewards.html">blog post</a>]. "We've received bugs in roughly every component, ranging from system software (Windows kernel / Mac OS X graphics libraries / GNU libc) to Chromium / WebKit code and to popular open source libraries (libxml, ffmpeg)."

According to the Google security engineer, the efforts of the wider security community have increased Chromium's stability and robustness.

Google has now decided to expand the scope of its Chromium security rewards program in order to also reward researchers who discover high-severity vulnerabilities in Chromium OS, a Linux-based OS built around the browser.

This is an important decision for the company, because Chromium OS has a large code base and much of it was borrowed from Linux and other open source projects. This means that the likelihood of vulnerabilities being discovered in the entire OS is significantly higher for the Chromium browser.

Google believes that software vendors would benefit from setting up similar security rewards programs. "Over time, these programs can help companies build better relationships with the security research community," Mein said.

"By setting up a rewards program, a vendor can identify vulnerabilities that their own developers might have missed," said Marius Gabriel Avram, a security engineer at U.K.-based vulnerability management firm RandomStorm. "This makes the Internet safer for all users."

During the last couple of years, Avram has reported vulnerabilities in Web services operated by companies like Google, Facebook, Twitter, Microsoft or Mozilla, some of which operate vulnerability reward programs. Without a doubt, such programs improve communication between vendors and security researchers, which in turn helps get security issues addressed quicker, he said.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?