Feeds

OpenSSL bug hunt: Find NEXT Heartbleed, earn $$$ – if enough people donate cash

Quarter of a million dollars could be up for grabs

Securing Web Applications Made Simple and Scalable

An effort to raise $250,000 for an OpenSSL bug-bounty program is underway – and its organisers hope it will help ensure the Heartbleed omnishambles is never repeated.

The campaign, spearheaded by computer security startup Bugcrowd, aims to raise the cash by 29 April: the money will be distributed as rewards to infosec bods who discover and report bugs in crucial crypto-library OpenSSL. A pitch on crowdtilt.com explains:

With many eyes and the right incentive all bugs are shallow. It's up to the Internet to come to the table and provide the incentive required to make sure wide-scale security exposures like Heartbleed don't happen again.

This Crowdtilt will fund a focussed crowdsourced security assessment (otherwise known as a bug bounty) on OpenSSL. 100 per cent of the proceeds will be offered to security researchers. Any leftover funds will be passed on to the OpenSSL Software Foundation.

Anyone can sponsor at any amount. Sponsors will be credited as Defenders of the Internet, and sponsors who commit over $5,000 will be specially mentioned and thanked.

Together let’s make the Internet a safer place.

Donations thus far stand at a modest $5,400, but the fund has only just opened. Even so, the fundraiser is working on what looks like a tight deadline.

Casey Ellis, chief exec of Bugcrowd, explained that the initiative was independent from OpenSSL.

"The [OpenSSL] developers are aware of our efforts but are also obviously quite busy at the moment, so it's fair to say that we are doing this independently," Ellis said.

Bug-bounty programmes have become commonplace across the IT industry: the schemes reward researchers for reporting flaws to vendors, rather than hawking them through exploit brokers or vulnerability marketplaces.

Heartbleed is a serious flaw in the widely used OpenSSL: a programming blunder allows miscreants to silently read passwords, private crypto-keys and other sensitive data from the memory of vulnerable servers, PCs, phones, tablets and other devices.

That's bad, but it's no remote-code execution hole, admittedly; there have been worse flaws in other internet-facing software that allowed attackers to plant all sorts of nasties on systems.

What happens when a mega-fail is discovered?

What sticks out about Heartbleed is the messy disclosure process: Google engineers discovered the hole sometime before 22 March, and fixed it in their own servers – but then CloudFlare somehow learned of the bug and started patching, too. The OpenSSL development team was alerted by Google on 1 April, and separately a Finnish infosec biz discovered the same bug, but would not say if they tipped anyone off about the coding error.

As information about Heartbleed eventually emerged in public on 7 April, network defenders scrambled to get gear patched, and it left ordinary users confused about when they needed to change their passwords. Ellis acknowledged this was an issue – but said any bugs discovered in OpenSSL during this latest bounty will be shared exclusively with the library's team before being responsibly revealed.

"Bugcrowd is autonomous and independent of any third parties – any conversations around vulnerabilities would be strictly between Bugcrowd and the OpenSSL Software Foundation until the issues are resolved, at which point they'd follow the normal disclosure process," he told El Reg. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.