Researchers who discovered and responsibly disclosed vulnerabilities in Facebook last year were awarded a total of $1.3 million, the social media giant said on Wednesday.
Since it launched its bug bounty program almost four years ago, Facebook paid out more than $3 million to experts who contributed to making the service more secure. In 2014, the number of submissions was 17.011, which represents a 16% increase compared to the previous year.
A total of 321 researchers from 65 countries were rewarded last year, with an average bug bounty of $1,788. Of the total of $1.3 million, more than $250,000 went to the top five earners. Security experts reported a total of 61 eligible high-severity bugs, 49% more than in 2013, Facebook said.
It’s worth noting that while the number of submissions increased, the total amount of money paid out in 2014 is lower compared to 2013, when Facebook handed out $1.5 million.
The largest number of valid submissions came from India (196), followed by Egypt (81), the United States (61), the United Kingdom (28), and the Philippines (27). Facebook has pointed out that the UK earned the highest amount per report with an average of $2,768.
The bug spotlight for 2014 includes vulnerabilities related to hidden input parameters, Amazon S3 buckets ($6,500 reward), and legacy REST API calls ($20,000 reward).
“We’re excited to see what 2015 holds for the bug bounty program. Report volume is at its highest levels, and researchers are finding better bugs than ever before. We’ve already received more than 100 valid reports since the start of the new year,” Facebook security engineer Collin Greene wrote in a blog post.
Laxman Muthiyah is one of the researchers who reported vulnerabilities this year. Earlier this month, the expert published the details of a Graph API bug that allowed attackers to delete users’ photos. Muthiyah was awarded a $12,500 bounty for his work.
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
Latest News
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Idaho Hospitals Working to Resume Full Operations After Cyberattack
- Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Google Temporarily Offering $180,000 for Full Chain Chrome Exploit
