Find a Critical Windows Flaw, Win $10k

By the Betanews Staff | Published February 17, 2006, 1:00 PM

VeriSign subsidiary iDefense has launched what it calls a "Quarterly Hacking Challenge" that offers monetary rewards for those discovering security vulnerabilities. For this quarter, iDefense is offering up $10,000 to anyone who finds a critical vulnerability that leads to the publication of a Microsoft Security Bulletin.

"In order to qualify, the submission must be sent during the current quarter and be received by midnight EST on March 31, 2006," the company said in a news posting. "The $10,000 prizes will be paid out following the publication of the Microsoft Security Bulletin and will be paid in addition to any amount paid for the vulnerability when it is initially accepted."

Comments

View comments by with a score of at least

Find an Openoffice.org Bugs and you can get a better office software for free.
download the office software at www.OpenOffice.org and submit the bugs at
http://qa.openoffice.org...ing/pre_submission.html

Thanks

Score: 0

|

The contest is over.

Some guy out in California named Gates reported about 263 critical flaws; the only problem is that he now is claiming they owe him the 10K for each individual flaw.

Imagine that...

Score: 0

|

and i thought Win $10k was like another updated windows version to Win 95..Win 98...Win 2000....

Score: 0

|

i guess all windoze users are winnerz then

Score: 0

|

All you smart people should provide documentation of an exploit that isn't patched instead of wasting everybodys time. I could say the same stupid things about Linux with no proof of concept.

Score: 0

|

http://secunia.com/advisories/16560/

although they say its non critical, to a guy like me it could be a real hassle. Have a workaround but still... geeze fix this! But eh, i guess the extra time it would take to find this would just make me work a little longer, extra money for me so whatever.

Score: 0

|

Yeah, so prove you're capable of doing it... *yawning*

BTW: nice of you to post a "not critical" security flaw :)

[[[ I'm a little Linux freak that can crack any Windows box but I don't have the time to earn 10.000 dollars ]]]

Score: 0

|

Try getting a sense of humor and get back to us on that.

Hope it all works out for ya,

Thanks.

Score: 0

|

i already did it on my own machine and it works, want me to come over and ill show you? Its really not that hard to do - my freakin' dog could do it... And non-critical, that's not fact thats an opinion. I think at times, it could be kind of critical for someone who doesn't know about these things.

Score: 0

|

Okay. Linux! Get it?

Score: 0

|

roflmao...

No?

Score: 0

|

The use of "Win $10k" in the headline is pretty idiotic. Does the Betanews staff think they win everytime they get a paycheck?

Score: 0

|

It's just an interesting announcement. Relax and stop with the name calling.

Score: 0

|

name calling? your reply is shows lack of comprehension? do you consider that name calling?

Score: 0

|

"The use of "Win $10k" in the headline is pretty idiotic."

Sounds like you're calling them idiots to me.

Maybe you meant something else....

Score: 0

|

a very smart person can do something idiotic. I meant this specific choice of words is idiotic, not the person themselves.

Score: 0

|

Depends on how you view it I guess (the headline).

From a marketing viewpoint (and since that is how most sites make their money, it's a pretty good viewepoint for them), it gets people's attention.

I understand the semantic argument you're making in regards to the choice of the word, "Win", but that's just it. Semantics. By nature, purely subjective.

Calling something idiotic because your POV doesn't justify it does not mean it is not justified under someone elses.

Score: 0

|

I think Apple is going to have to sue VeriSign for the use of the name "iDefense"... besides, Apple is going to need the name for their forthcoming Anti-Malware software........

Score: 0

|

I found one, it's called the power button.

J/K

Score: 0

|

Nah, the power button is there on just about any powered device. The power button isn't the problem, it's what's running on the device it powers.

Score: 0

|

I mean as soon as you turn it on.

Score: 0

|

But who makes them push the power button......could it beee....

SATAN!

Score: 0

|

No, despite their demonic urges, they popped butter-rum lifesavers and sucked away like there was no tomorrow!

Score: 0

|

ROFLOL!!

This wins for funniest post here!

Score: 0

|

I hope you didn't think he was serious :-/

Score: 0

|

Good or bad--this is one thing Open Source can never have--$hitloads of money.

Score: 0

|

This isn't MS paying cash, oddly enough. It's a private security company that wants advanced notice on holes so average folks PAY THEM (directly/indirectly) to secure their networks from that hole until MS releases the patch... To me it seems that an unknown critical flaw is worth about 100 times more on the black market than what iDefense wants to pay. So if cash is the motive, they're not gonna get jack. If recognition is the motive, they're not gonna get jack either because they wanna be "the protectors" instead of the real discoverer.

In other words, they're not gonna get jack whichever way you cut it. Talk about $50K+ they may have a chance...

It also means that this company could still have made the same offer by asking for yet-unknown critical flaws in any popular open source software (OS/server/whatever).

Score: 0

|

ITA.

Score: 0

|

Wow...I still don't know all the IM lingo. What does ITA mean?

Score: 0

|

Lets try to use a brain cell here.

Open Source is not an entity.

Thanks.

Score: 0

|

I've never heard it before either, so it's either made up or from somewhere I don't go.

I play lots of games.

Score: 0

|

Got me too... a web search reveals there are multiple possibilities, few of which seem to fit this circumstance.

Score: 0

|

I think it's the International Trombone Association, something to do with people blowing a lot of hot air.

Score: 0

|

Good call! :)

Score: 0

|

Not to be confused with the International Toilet-paper Association (ITA), which also has something to do with people blowing a lot of hot air.

Score: 0

|

Country-code for Italy?

Score: 0

|

Critical Flaw: Win.com

Send the cash to my Home address.

Thank you.

:)

Critical Flaw #2: Written and distributed by Microsoft.

Does that mean I get $20,000?

Flame on, ya bastiches.

Score: 0

|

Don't forget critical flaw #3: IEXPLORE.EXE

Score: 0

|

I think 1 and 3 are covered by #2.

roflmao...#2....get it?

Sorry, I've been hanging out with my 5yr-old a bit too much apparently.

Score: 0

|

They didn't tell you it's paid $1000 a year?

Score: 0

|

IEXPLORE.EXE hasn't been changed in years. They must be going for that "untampered" approach on their product.

Score: 0

|

Hey! I'll take it. I could live with a new PC every year for the next 10-20 years.

Score: 0

|

Checks will NOT be honored!! :P

Score: 0

|

Oddly you chose the one file that has little if anything to do with Windows. Especially Windows NT, Windows 2000, and Windows XP, as the win.com is nothing more than leftovers. It is the EDLIN of Windows--it has no purpose anymore. Just found that odd you mentioned this file. With Windows 3.1 progman.exe was the big file, all newer Windows starting with Windows 95 Explorer.exe and user32.dll are the big ones. Why mention win.com? It is nothing more than an MS-DOS 5 16-bit command file.

Yes I know you were joking. I just enjoy being a smartass.

Score: 0

|

Indeed! :P lol

Score: 0

|

What about the rest of the Slavs

Score: 0

|

Useless?

Delete it then.

Enjoy your blue-screen.

(Yeah, I know what you meant, I just enjoy being a smart-ass)

Score: 0

|

Checks...slavs..

HA!

Now I get it.

Score: 0

|

EC's Kroes to US senators: Mind your own business on Oracle + Sun

If the AP is accurate, the EU's antitrust chief just told the United States Senate that any merger that takes place in the world is more her affair than theirs.

What does AT&T's 'Mark the Spot' app say about service quality?

That's a question for Betanews readers to answer in comments to this post.

Windows fix for TLS security bug still forthcoming, won't be Tuesday

Anyone looking for a fix for last month's discovery of a potentially serious security hole in TLS and SSL may have to wait until everyone is ready to act together.

Google rolls out real-time search, Near Me Now, extended personalization

Over time, searches from PCs and mobile phones will grow even "more personalized." But what about user privacy and search results that give you "the truth"?

Betanews Podcast: Rupert Murdoch and the buying stuff online problem

We'll have a more difficult time paying for online news if the underlying protocol for online payment has a big gaping hole in it.

Not the first, not the last, technology predictions for 2010

Carmi Levy | Wide Angle Zoom: The real truth is probably that what went around in 2009, will come around to haunt us next year.

Google Goggles: Hands on with the Shazam of the Real World

Google today unveiled Goggles, its visual search lab for Android devices that identifies objects by sight.

Microsoft: Windows 7 Family Pack wasn't 'pulled,' it just sold out

If you hurry, you may still be able to find the last Family Pack upgrade editions hanging around retail store shelves, but probably not so much online.

Clever iPhone game returns after being bumped over a name dispute

The game's simple concept and multitude of platforms and puzzles manage to pull off a retro, 8-bit style that's reminiscent of an old Atari game given a modern makeover.

Intel's marriage of CPU and GPU not ready for prime time

Although there will be an Intel component this month that can compute and plot in parallel, Betanews was told today, it won't be based on Project "Larrabee."

An alternative to Research in Motion's enterprise e-mail? There's an app for that

Good Technology today released an iPhone app compatible with its enterprise e-mail solution.