It has been six years now since Google has started its bug bounty program and they have paid over over $6 million (over $2 million last year alone) to the security researchers. The company has announced two changes in the Chrome Reward Program, first they increased the reward for Chromebooks and second they added a new Bug bounty.
The Bug bounty programs is seen as appreciations for the individuals and groups of hackers to find out the flaws and to disclose them to the company instead of selling them to someone else who can exploit the flaw.
According to the company’s security team they have not received any single successful submission in compromise of a Chromebook in guest mode which has reward of a $50,000.
Now, Google has doubled the bounty for the top Chrome reward, to $100,000. “That said, great research deserves great awards, so we’re putting up a standing six-figure sum, available all year round with no quotas and no maximum reward pool,” Google declared.
The qualifying reward rules are as follows:
• Safe Browsing must be enabled on Chrome and have an up-to-date database (this may take up to a few hours after a new Chrome install).
• Safe Browsing servers must be reachable on the network.
• Binary must land in a location a user is likely to execute it (e.g. Downloads folder).
• The user can’t be asked to change the file extension or recover it from the blocked download list.
• Any gestures required must be likely and reasonable for most users. As a guide, execution with more than three reasonable user gestures (eg: click to download, open .zip, launch .exe) is unlikely to qualify, but it’ll be judged on a case-by-case basis. The user can’t be expected to bypass warnings.
• The download should not send a Download Protection Ping back to Safe Browsing. Download Protection Pings can be measured by checking increments to counters at chrome://histograms/SBClientDownload.CheckDownloadStats. If a counter increments, a check was successfully sent (with exception to counter #7, which counts checks that were not sent).
• The binary’s hosting domain and any signature cannot be on a whitelist. You can measure this by checking chrome://histograms/SBClientDownload.SignedOrWhitelistedDownload does not increment.