Menu
Yahoo abandons T-shirt rewards for vulnerability information

Yahoo abandons T-shirt rewards for vulnerability information

Starting Oct. 31, Yahoo will pay between US$150 to $15,000 for flaws, in line with bounties paid by Facebook and Google

Yahoo will stop giving T-shirts as a reward for finding security vulnerabilities after a public shaming it's calling "t-shirt gate."The company received a drubbing from the Swiss security company High-Tech Bridge after it found four serious vulnerabilities in Yahoo's network, all of which have now been fixed. Three of those problems -- cross-site scripting flaws -- could have allowed an attacker to hijack a person's Yahoo email account.

Starting Oct. 31, Yahoo will pay rewards ranging from US$150 to $15,000 for vulnerabilities provided those flaws are new, unique or high risk. It plans to retroactively reward researchers who notified the company of issues going back to July 1, wrote Ramses Martinez, director of Yahoo's security team, in a blog post on Wednesday.

"This includes, of course, a check for the researchers at High-Tech Bridge who didn't like my t-shirt," Martinez wrote.

High-Tech Bridge issued a press release on Monday saying Yahoo offered $12.50 in credit per vulnerability, which could be used toward Yahoo-branded items such as T-shirts, cups and pens from its store.

As a result, High-Tech Bridge said it would hold off doing more research on Yahoo's network. The company wrote that Yahoo's reward was "a bad joke."

Many large companies such as Google and Facebook offer lucrative bounties for vulnerability information. Google will pay up to $20,000 for a qualifying vulnerability, and Facebook pays a minimum of $500.

It's cheaper for companies to pay for vulnerability information rather than hire full-time researchers. It also helps dissuade researchers from turning to hacking forums to monetize their information, where it might be used to do harm.

Yahoo never had a formal process for recognizing security researchers. Martinez wrote that he began started sending T-shirts to researchers to express thanks.

"I even bought the shirts with my own money," he wrote.

But Yahoo had recently decided to improve its vulnerability reporting program. While Yahoo acted fast on the vulnerability information it received, "my 'send a t-shirt' idea needed an upgrade," Martinez wrote.

"This month the security team was putting the finishing touches on the revised program," he wrote. "And then yesterday morning 't-shirt-gate' hit. My inbox was full of angry email from people inside and out of Yahoo. How dare I send just a t-shirt to people as a thanks?"

Yahoo also plans to improve its Web page where researchers can send in security issues. Researchers will be contacted within two weeks, Martinez wrote. Those who successfully submit valid flaws can also get an email or written letter than can be used as a reference for their work.

"For the best reported issues, we will directly call out from our site an individual's contribution in a 'hall of fame,'" he wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Or
Error: Please check your email address.

Tags securitymalwaredata protectionYahooExploits / vulnerabilities

Featured

Slideshows

Bumper channel crowd kicks off first After Hours of 2018

Bumper channel crowd kicks off first After Hours of 2018

After Hours made a welcome return to the channel social calendar with a bumper crowd of partners, distributors and vendors descending on The Jefferson in Auckland to kick-start 2018. Photos by Gino Demeer.

Bumper channel crowd kicks off first After Hours of 2018
Looking back at the top 15 M&A deals in NZ during 2017

Looking back at the top 15 M&A deals in NZ during 2017

In 2017, merger and acquisitions fever reached new heights in New Zealand, with a host of big name deals dominating the headlines. Reseller News recaps the most important transactions of the Kiwi channel during the past 12 months.

Looking back at the top 15 M&A deals in NZ during 2017
Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Show Comments