Moussouris stressed that the bounty program expansion would now draw from a much larger pool of people. "We are going from accepting entries from only a handful of individuals capable of inventing new mitigation bypass techniques on their own, to potentially thousands of individuals or organizations who find attacks in the wild," she wrote.
The single award thus far points to the difficulty in meeting the original program's criteria, and the expansion signals that Microsoft wanted more grist for its mill.
But it's not opening up the program to just any Tom, Dick or Harriet hacker. Only pre-certified organizations will be allowed to submit reports eligible for the $100,000 awards, and then, as Storms pointed out, only after they sign an agreement that will, as in prior contests, require the reporters to not disclose details of the attack technique.
"I think they did that so that one black hat couldn't get paid for stealing from another black hat," said Wysopal, using the term for criminal coders, when asked why Microsoft wanted to pre-qualify those who submitted reports. "They're trying to make sure that only white hat, legitimate incident responders, get the money."
And he applauded the bounty expansion. "This is very smart. This raises the cost of offense because defenders will be on the lookout for mitigation bypass techniques in the zero-days they find, and [they're] incentivized to get that information to Microsoft, which can then close the hole," said Wysopal.
Sign up for CIO Asia eNewsletters.