Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Management & Strategy

Microsoft Launches ElectionGuard Bug Bounty Program

Microsoft launches ElectionGuard Bounty program

Microsoft last week announced the launch of a new bug bounty program covering the ElectionGuard open source software development kit (SDK).

Microsoft launches ElectionGuard Bounty program

Microsoft last week announced the launch of a new bug bounty program covering the ElectionGuard open source software development kit (SDK).

The ElectionGuard SDK, which Microsoft released in May 2019, is designed to make voting more secure, transparent and accessible. The system ensures that votes are encrypted and kept secure, while allowing third-party organizations to validate results and enabling voters to confirm their votes were counted correctly.

As part of the new ElectionGuard Bounty program, Microsoft is offering between $500 and $15,000 for vulnerabilities in the ElectionGuard specification and documentation, the verifier reference implementation, and the ElectionGuard API SDK.

Microsoft is specifically looking for security flaws that can be used to discover votes or secret keys, make invalid proofs look valid, and trick the reference verifier.

The highest rewards, up to $15,000, are offered for privilege escalation and information disclosure vulnerabilities, followed by security design flaws ($8,000), spoofing or tampering issues ($3,000), and remote denial-of-service attack methods ($3,000).

“Microsoft strongly believes close partnerships with researchers make customers more secure,” Jarek Stanley, senior program manager at MSRC,  said in a blog post. “Security researchers play an integral role in the ecosystem by discovering and reporting vulnerabilities to Microsoft through coordinated vulnerability disclosure. Security researchers have repeatedly demonstrated that working together helps protect customers and each year we partner together to better protect billions of customers worldwide.”

Microsoft said it paid out $4.4 million through 11 bug bounty programs between July 1, 2018 and June 30, 2019. The highest reward was $200,000.

Related: Microsoft Launches Bug Bounty Program for Dynamics 365

Related: Microsoft Offers Up to $300,000 in New Azure Security Lab

Related: Microsoft Paid $2,000,000 in Bounty Rewards in 2018

Related: Microsoft Offers Up to $30,000 for Flaws in Chromium-Based Edge

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Vulnerabilities

Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.