Microsoft last week announced the launch of a new bug bounty program covering the ElectionGuard open source software development kit (SDK).
The ElectionGuard SDK, which Microsoft released in May 2019, is designed to make voting more secure, transparent and accessible. The system ensures that votes are encrypted and kept secure, while allowing third-party organizations to validate results and enabling voters to confirm their votes were counted correctly.
As part of the new ElectionGuard Bounty program, Microsoft is offering between $500 and $15,000 for vulnerabilities in the ElectionGuard specification and documentation, the verifier reference implementation, and the ElectionGuard API SDK.
Microsoft is specifically looking for security flaws that can be used to discover votes or secret keys, make invalid proofs look valid, and trick the reference verifier.
The highest rewards, up to $15,000, are offered for privilege escalation and information disclosure vulnerabilities, followed by security design flaws ($8,000), spoofing or tampering issues ($3,000), and remote denial-of-service attack methods ($3,000).
“Microsoft strongly believes close partnerships with researchers make customers more secure,” Jarek Stanley, senior program manager at MSRC, said in a blog post. “Security researchers play an integral role in the ecosystem by discovering and reporting vulnerabilities to Microsoft through coordinated vulnerability disclosure. Security researchers have repeatedly demonstrated that working together helps protect customers and each year we partner together to better protect billions of customers worldwide.”
Microsoft said it paid out $4.4 million through 11 bug bounty programs between July 1, 2018 and June 30, 2019. The highest reward was $200,000.
Related: Microsoft Launches Bug Bounty Program for Dynamics 365
Related: Microsoft Offers Up to $300,000 in New Azure Security Lab
Related: Microsoft Paid $2,000,000 in Bounty Rewards in 2018
Related: Microsoft Offers Up to $30,000 for Flaws in Chromium-Based Edge
