Feeds

OpenSSL bug hunt: Find NEXT Heartbleed, earn $$$ – if enough people donate cash

Quarter of a million dollars could be up for grabs

Choosing a cloud hosting partner with confidence

An effort to raise $250,000 for an OpenSSL bug-bounty program is underway – and its organisers hope it will help ensure the Heartbleed omnishambles is never repeated.

The campaign, spearheaded by computer security startup Bugcrowd, aims to raise the cash by 29 April: the money will be distributed as rewards to infosec bods who discover and report bugs in crucial crypto-library OpenSSL. A pitch on crowdtilt.com explains:

With many eyes and the right incentive all bugs are shallow. It's up to the Internet to come to the table and provide the incentive required to make sure wide-scale security exposures like Heartbleed don't happen again.

This Crowdtilt will fund a focussed crowdsourced security assessment (otherwise known as a bug bounty) on OpenSSL. 100 per cent of the proceeds will be offered to security researchers. Any leftover funds will be passed on to the OpenSSL Software Foundation.

Anyone can sponsor at any amount. Sponsors will be credited as Defenders of the Internet, and sponsors who commit over $5,000 will be specially mentioned and thanked.

Together let’s make the Internet a safer place.

Donations thus far stand at a modest $5,400, but the fund has only just opened. Even so, the fundraiser is working on what looks like a tight deadline.

Casey Ellis, chief exec of Bugcrowd, explained that the initiative was independent from OpenSSL.

"The [OpenSSL] developers are aware of our efforts but are also obviously quite busy at the moment, so it's fair to say that we are doing this independently," Ellis said.

Bug-bounty programmes have become commonplace across the IT industry: the schemes reward researchers for reporting flaws to vendors, rather than hawking them through exploit brokers or vulnerability marketplaces.

Heartbleed is a serious flaw in the widely used OpenSSL: a programming blunder allows miscreants to silently read passwords, private crypto-keys and other sensitive data from the memory of vulnerable servers, PCs, phones, tablets and other devices.

That's bad, but it's no remote-code execution hole, admittedly; there have been worse flaws in other internet-facing software that allowed attackers to plant all sorts of nasties on systems.

What happens when a mega-fail is discovered?

What sticks out about Heartbleed is the messy disclosure process: Google engineers discovered the hole sometime before 22 March, and fixed it in their own servers – but then CloudFlare somehow learned of the bug and started patching, too. The OpenSSL development team was alerted by Google on 1 April, and separately a Finnish infosec biz discovered the same bug, but would not say if they tipped anyone off about the coding error.

As information about Heartbleed eventually emerged in public on 7 April, network defenders scrambled to get gear patched, and it left ordinary users confused about when they needed to change their passwords. Ellis acknowledged this was an issue – but said any bugs discovered in OpenSSL during this latest bounty will be shared exclusively with the library's team before being responsibly revealed.

"Bugcrowd is autonomous and independent of any third parties – any conversations around vulnerabilities would be strictly between Bugcrowd and the OpenSSL Software Foundation until the issues are resolved, at which point they'd follow the normal disclosure process," he told El Reg. ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.