News
As Devs Code .NET Core, Microsoft Offers Bug Bounty
As developers churn through coding the next versions of .NET Core and other key Microsoft technologies, the company offers new bounties on bugs. Program runs to September.
- By Michael Domingo
- 06/09/2016
As the community of developers churning through open sourced versions of the upcoming .NET Core 1.0, ASP.NET Core 1.0 and other key Microsoft technologies, there's bound to be some bugginess to the code. With that, Microsoft is offering a window of opportunity for developers to cash in on discovering bugs with a three-month bug bounty program.
There's actually a number of bug bounty programs being offered by Microsoft, including ones for those discovering bugs with Office 365 and Azure that are ongoing, but most relevant to developers are the ones for .NET Core and ASP.NET Core.
According to a new post on Microsoft's Security TechCenter, the bounty program runs from June 7 to September 7, and is worth $500 to $15,000 if developers submit a discovered vulnerability within .NET Core and ASP.NET Core R2 and other releases that are made available within the next three months.
Developers who want to get a payout for bugs must submit the bug using the Coordinated Vulnerability Disclosure guidelines, and the bug must be original, so timing is key in submissions (as other developers might be discovering the same or similar bugs).
Much of the information on submission and criteria and qualification of bug submissions is on the Program Terms page here. In a nutshell, any submitted vulnerability has to be original and a flaw that hasn't shown up in any vulnerability reports, and the flaw has to be well documented so that Microsoft's security researchers can reproduce the flaw as a proof of concept. Examples of qualified submissions are "bypasses of CSRF protection, Encoding, Data Protection failures, Information disclosures to a client, Authentication bypasses and Remote Code Execution," notes the Program Terms, and must come with exacting steps for reproducing the flaw.
Specific payouts and steps for submitting bugs to the bounty program are available on the Program Terms page in the TechNet Security Center site.
About the Author
Michael Domingo is a long-time software publishing veteran, having started up and managed several developer publications for the Clipper compiler, Microsoft Access, and Visual Basic. He's also managed IT pubs for 1105 Media, including Microsoft Certified Professional Magazine and Virtualization Review before landing his current gig as Visual Studio Magazine Editor in Chief. Besides his publishing life, he's a professional photographer, whose work can be found by Googling domingophoto.