Bug Bounty
Bug bounty programs are nothing new. We have seen various initiatives started in the community and have had a lot of discussion internally regarding whether or not such a program causes a positive impact. After a long brainstorming session, we believe that a common ground for a positive outcome can be achieved. Other companies that buy exploits for their penetration testing war chest rarely share them with the public and once bought, require that the author does not share them. We are going the other direction on this idea. If the author of the exploit permits it, we will release them publicly after 60 days for everyone to download. Win
What the influencers are saying
-
HD Moore
Woah. Packet Storm now has an exploit bounty that makes exploits public 60 days after acceptance: http://t.co/5AEIP0lS ( via @taviso)
-
Kyle Maxwell
Hrm. What's a "0.5-day" exploit? http://t.co/5nvCAlfrH0
-
Chae Jong Bin
RT @w3bd3vil: I like this, you are being paid for non-0day exploits and these will be released publicly :-) http://t.co/kZTmg0w7
-
Sam Bowne
RT @spacerog: $7K for Reader, Flash, or IE RCE from Packet Storm? Yup. http://t.co/8oE9ov1A Game changer? maybe.
-
Rob Fuller
RT @hdmoore: Woah. Packet Storm now has an exploit bounty that makes exploits public 60 days after acceptance: http://t.co/5AEIP0lS ( v ...
-
grecs
RT @hdmoore: Packet Storm now has an exploit bounty that makes exploits public 60 days after acceptance: http://t.co/cjmkGwN8
