My View Of Bug Bounty Programs

Bug bounty programs have become a trend among popular software/ services, such as Mozilla Firefox, Google Chrome, Facebook, and others. The programs actually pay researches to find vulnerabilities in the websites, and to disclose those vulnerabilities to the vendors according to their reasonable disclosure policies. Varying from vendor to vendor, and from vulnerability to vulnerability, the prizes can be a few hundred dollars to many thousands.

But do bug bounty programs make programs more secure? Or are they all for show, a waste of money?

The answer is more complicated than a simple ‘yes’ or ‘no’. Bug bounty programs don’t benefit the end user as directly as they may think. Just because one bug is patched, or even a thousand, does not mean the end user is significantly more secure.

Where bug bounty programs really help the end user is the trend of exploits. A program like Chrome takes security very seriously, and they improve it periodically. Bug bounty programs aren’t going to be so amazing for patching every hole, but they’ll be great for seeing where attackers are looking for holes, and where they’re finding the most of them. The bounty program essentially gives you a birds eye view of your systems weaknesses.

If you get a statistical increase in XSS bugs, you know that that’s where your security team needs to focus. If you start seeing a decrease in vulnerabilities found in your PDF viewer component, you know that your recent security implementation has paid off.

Where a bug bounty program wouldn’t be as helpful is something like Java. Java hasn’t changed its security much, and vulnerabilities are found so often it’s recommended to uninstall it by nearly everyone. A bug bounty program would only prove what we already know, that there are a ton of vulnerabilities left unaddressed in the JRE.

Now, if Oracle were to implement a bug bounty program and then a new security technique, or SDL audit/ process, the bounty program would be able to reflect those changes. I’d love to see something like this, as it would probably show incredibly drastic changes to results. But what needs to change is the SDL and approach to security, not monitoring of the security approach already in place.