Feeds

Secunia jumps on vuln reward bandwagon

First, catch your rabbit

The Power of One eBook: Top reasons to choose HP BladeSystem

Secunia has launched yet another vulnerability rewards program, the Secunia Vulnerability Coordination Reward Program, which it says is designed to operate independently of particular software vendors.

The company says the idea is to make life easier for researchers, by concentrating vulnerability reporting to a single entity, rather than leaving them to deal with multiple vendors’ reporting procedures and rewards programs.

Vendor programs, the company says, have a “business model wrapped around them,” and therefore can be selective in which bugs win a bounty. The Secunia program will accept any vulnerability in off-the-shelf software.

In its blog post, Secunia’s Carsten Eiram says the “fun part” of research is in discovering a vulnerability or exploit, rather than in the “sometimes extensive coordination and liaison” with vendors.

Under this program, he says, Secunia will “both confirm vulnerability discoveries and handle the coordination process”.

The service could also fill a gap, the company says, for researchers who don’t wish to sell their vulnerabilities, or don’t want to constrain their research to those bugs that happen to fit “the requirements of existing initiatives”.

Rather than cash, Secunia’s rewards will include merchandise and two “major annual rewards” for hotel accommodation and entry to major security conferences.

The program’s criteria are that the vulnerability affects a stable product; it affects the latest version of the product; the product has active vendor support; the vulnerability is not already public; and Secunia can replicate the vulnerability. ®

Designing a Defense for Mobile Applications

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.