(adsbygoogle = window.adsbygoogle || []).push({});
Facebook is offering a $500 reward for reporting bugs on its site, far less than bug bounties offered by companies like Google or Microsoft.
"To show our appreciation for our security researchers, we offer a monetary bounty for certain qualifying security bugs," Facebook wrote on a page entitled "Security Bug Bounty."
To qualify for the bounty, you must be the first to report the security glitch, and the bug must be native to Facebook (not in, say, Farmville). Furthermore, disclosures must be "responsible" and you need to give Facebook a reasonable amount of time before reporting the bug publicly, as security researchers often do through blog posts to warn its users.
Although $500 is just the base, it pales in comparison to what other companies offer, like Google's $3000+, Mozilla's $3,000, and Microsoft's $250,000 . If you're looking for a real early retirement plan, the Business Software Alliance says tipsters who report their company's illegal use of unlicensed software could reap payouts of up to $1 million.
But a security researcher cited in ComputerWorld says reporting Facebook bugs can help budding security researchers make a name for themselves in the tight-knit security community.
"The dollar amounts may be smaller than other markets for security research, but bounty programs lead to a better relationship with the security community and improve the security of the service much faster than a similar resource spend in a traditional security audit," said HD Moore, chief security officer of Rapid7.
Facebook, like Microsoft and Google, has been known to hire grey hat hackers in the past; most recently it scooped up famed Playstation 3 hacker George "Geohot" Hotz.
-- Other Source
Facebook is going to pay hackers to find problems with its website — just so long as they report them to Facebook’s security team first.
The company is following Google and Mozilla in launching a Web “Bug Bounty” program. For security related bugs — cross site scripting flaws, for example — the company will pay a base rate of $500. If they’re truly significant flaws Facebook will pay more, though company executives won’t say how much.
“In the past we’ve focused on name recognition by putting their name up on our page, sending schwag out and using this an avenue for interviews and the recruiting process,” said Alex Rice, Facebook’s product security lead. “We’re extending that now to start paying out monetary rewards.”
On Friday, Facebook will launch a new Whitehat hacking portal where researchers can sign up for the program and report bugs.
Many hackers go public with the software and website flaws they find to gain prestige. Finding an important bug on a widely used website such as Facebook can help make a journeyman hacker’s career, and going to the press with the issue can make him — or her — famous.
-PCMAG - DarkNet