Microsoft last week announced the launch of a new bug bounty program covering the ElectionGuard open source software development kit (SDK).
The ElectionGuard SDK, which Microsoft released in May 2019, is designed to make voting more secure, transparent and accessible. The system ensures that votes are encrypted and kept secure, while allowing third-party organizations to validate results and enabling voters to confirm their votes were counted correctly.
As part of the new ElectionGuard Bounty program, Microsoft is offering between $500 and $15,000 for vulnerabilities in the ElectionGuard specification and documentation, the verifier reference implementation, and the ElectionGuard API SDK.
Microsoft is specifically looking for security flaws that can be used to discover votes or secret keys, make invalid proofs look valid, and trick the reference verifier.
The highest rewards, up to $15,000, are offered for privilege escalation and information disclosure vulnerabilities, followed by security design flaws ($8,000), spoofing or tampering issues ($3,000), and remote denial-of-service attack methods ($3,000).
“Microsoft strongly believes close partnerships with researchers make customers more secure,” Jarek Stanley, senior program manager at MSRC, said in a blog post. “Security researchers play an integral role in the ecosystem by discovering and reporting vulnerabilities to Microsoft through coordinated vulnerability disclosure. Security researchers have repeatedly demonstrated that working together helps protect customers and each year we partner together to better protect billions of customers worldwide.”
Microsoft said it paid out $4.4 million through 11 bug bounty programs between July 1, 2018 and June 30, 2019. The highest reward was $200,000.
Related: Microsoft Launches Bug Bounty Program for Dynamics 365
Related: Microsoft Offers Up to $300,000 in New Azure Security Lab
Related: Microsoft Paid $2,000,000 in Bounty Rewards in 2018
Related: Microsoft Offers Up to $30,000 for Flaws in Chromium-Based Edge

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- OpenSSL 1.1.1 Nears End of Life: Security Updates Only Until September 2023
- Google Links More iOS, Android Zero-Day Exploits to Spyware Vendors
- ChatGPT Data Breach Confirmed as Security Firm Warns of Vulnerable Component Exploitation
- Thousands Access Fake DDoS-for-Hire Websites Set Up by UK Police
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
Latest News
- Malware Hunters Spot Supply Chain Attack Hitting 3CX Desktop App
- LeapXpert Banks $22M Funding to Secure Corporate Messaging With Consumer Apps
- Blockchain Security Firm True I/O Raises $9 Million
- Spera Banks $10 Million to Tackle Identity and Access Sprawl
- OpenAI Patches Account Takeover Vulnerabilities in ChatGPT
- OpenSSL 1.1.1 Nears End of Life: Security Updates Only Until September 2023
- New Wi-Fi Attack Allows Traffic Interception, Security Bypass
- Casino Giant Crown Resorts Investigating Ransomware Group’s Data Theft Claims
