swagbucks

The best value on the Web is a $5 Amazon gift card. Credit free Amazon you can buy something on your site that I know of, including the items offered for sale by third parties, not just the items in stock and Amazon sells. If you are willing to spend time on the swagbucks site instead of every day playing Facebook games, you can earn $25 per month without a ton of effort. This method works best if you are the type of person that is on the computer and access to the Internet throughout the day.

Buy Nostalrius Gold

Are you looking for the best spot to Buy Nostalrius Gold? Look to further than our friends at http://www.buynostalriusgold.com - They have the best customer service available, cheap prices, and round the clock service. Don't wait to get on the new World of Warcraft EMU server and buy or sell gold to Buy Nostalrius Gold!

Venüs faktör

Venus factor tarafından vızıltı bir sürü son John Barban program zamanlarda yaratıyor ve gerçeğini bir beğeni ve iyi çoğunlukla yağ kaybı ve fitness uzmanı bilinen ' with John Barban hemen hemen herkes bu, bu günlerde nedeniyle hakkında konuşuyor gibi program.

bigfoottutors

If you have a hard time passing the subject you and sometimes you'll be too distracted by everything else in school, what do you think is the best thing to do? I really know what it feels like when your grade is not really satisfactory or does not meet your expectations. I was once a student of my own and I know how the flow. You have so many everyday subjects and teachers will continue to remove information that your brain can't handle all at the same time. You know what really help me? The opinion of a teacher to help me understand my lessons carefully. It is a very ideal indeed and I'm glad we know have web sites that offer some of the services a great online tutorials as bigfoottutors though I don't need it right now because I no longer learn but I don't mind letting my children get the services for the benefit of their own. "Transforming students by way of Measurable", that's exactly what the tutor Bigfoot aims to provide their students. When checking their site, I find some of the services and offers that they currently offer and I am sure will grab this opportunity. To provide you with a brief Guide on their website, let me list the benefits you get through the online tutorial Service (Bigfoot tutor in particular).

Japanese to English Translator

Hey people, we need a stable Japanese to English Translator as soon as possible please, requirements are you must be a fan of conan and lived thus,.

Venus Factor

However, with so many fitness programs out on the market and on the internet today, what makes the Venus Factor program any different than all the rest? To answer this question and to find if theVenus factor program is really for you lets take a look at the pros and cons of this program.

paid reviews

CAPTCHAs that capture your heart

Posted by Vinay Shet, Product Manager, reCAPTCHA

Notice something different about reCAPTCHA today? You guessed it; those tricky puzzles are now warm and fuzzy just in time for Valentine’s Day. Today across the U.S., we're sharing CAPTCHAs that spread the message of love.

Some examples of Valentine's Day CAPTCHAs

But wait. These look really easy. Does this mean that those pesky bots are going to crack these easy CAPTCHAs and abuse our favorite websites? Not so fast.

A few months ago, we announced an improved version of reCAPTCHA that uses advanced risk analysis techniques to distinguish humans from machines. This enabled us to relax the text distortions and show our users CAPTCHAs that adapt to their risk profiles. In other words, with a high likelihood, our valid human users would see CAPTCHAs that they would find easy to solve. Abusive traffic, on the other hand, would get CAPTCHAs designed to stop them in their tracks. It is this same technology that enables us to show these Valentine’s Day CAPTCHAs today without reducing their anti-abuse effectiveness.

But that’s not all. Over the last few months, we’ve been working hard to improve the audio CAPTCHA experience. Our adaptive CAPTCHA technology has, in many cases, allowed us to relax audio distortions and serve significantly easier audio CAPTCHAs. We’ve served over 10 million easy audio CAPTCHAs to users worldwide over the last few weeks and have seen great success rates. We hope to continue enhancing our accessibility option in reCAPTCHA in the months to come. Take a listen to this sample of easy audio CAPTCHA:

  

We’re working hard to improve people’s experience with reCAPTCHA without compromising on the spam and abuse protection you’ve come to trust from us. For today, we hope you enjoy our Valentine’s Day gift to you.

Security Reward Programs Update

Posted by Eduardo Vela Nava and Michal Zalewski, Google Security Team

From investing our time in doing security research to paying for security bugs and patches, we've really enjoyed and benefited from our involvement with the security community over the past few years. To underscore our commitment, we want to announce yet another increase in payments since we started our reward programs.

Starting today, we will broaden the scope of our vulnerability reward program to also include all Chrome apps and extensions developed and branded as "by Google." We think developing Chrome extensions securely is relatively easy (given our security guidelines are followed), but given that extensions like Hangouts and GMail are widely used, we want to make sure efforts to keep them secure are rewarded accordingly.

The rewards for each vulnerability will range from the usual $500 up to $10,000 USD and will depend on the permissions and the data each extension handles. If you find a vulnerability in any Google-developed Chrome Extensions, please contact us at goo.gl/vulnz.

In addition, we decided to substantially increase the reward amounts offered by our Patch Reward Program. The program encourages and honors proactive security improvements made to a range of open-source projects that are critical to the health of the Internet in recognition of the painstaking work that's necessary to make a project resilient to attacks.

Our new reward structure is:

• $10,000 for complicated, high-impact improvements that almost certainly prevent major vulnerabilities in the affected code. 
• $5,000 for moderately complex patches that provide convincing security benefits.
• Between $500 and $1,337 for submissions that are very simple or that offer only fairly speculative gains. 

We look forward to ongoing collaboration with the broader security community, and we'll continue to invest in these programs to help make the Internet a safer place for everyone.

Keeping YouTube Views Authentic

Posted by Philipp Pfeiffenberger, Software Engineer 

YouTube isn’t just a place for videos, it’s a place for meaningful human interaction. Whether it’s views, likes, or comments, these interactions both represent and inform how creators connect with their audience. That’s why we take the accuracy of these interactions very seriously. When some bad actors try to game the system by artificially inflating view counts, they’re not just misleading fans about the popularity of a video, they’re undermining one of YouTube’s most important and unique qualities.

As part of our long-standing effort to keep YouTube authentic and full of meaningful interactions, we’ve begun periodically auditing the views a video has received. While in the past we would scan views for spam immediately after they occurred, starting today we will periodically validate the video’s view count, removing fraudulent views as new evidence comes to light. We don’t expect this approach to affect more than a minuscule fraction of videos on YouTube, but we believe it’s crucial to improving the accuracy of view counts and maintaining the trust of our fans and creators.

As YouTube creators, we ask you to be extra careful when working with third-party marketing firms; unfortunately some of them will sell you fake views. If you need help promoting your video, please review our posts about working with third party view service providers and increasing YouTube views.

FFmpeg and a thousand fixes

Posted by Mateusz Jurczyk and Gynvael Coldwind, Information Security Engineers

At Google, security is a top priority - not only for our own products, but across the entire Internet. That’s why members of the Google Security Team and other Googlers frequently perform audits of software and report the resulting findings to the respective vendors or maintainers, as shown in the official “Vulnerabilities - Application Security” list. We also try to employ the extensive computing power of our data centers in order to solve some of the security challenges by performing large-scale automated testing, commonly known as fuzzing.

One internal fuzzing effort we have been running continuously for the past two years is the testing process of FFmpeg, a large cross-platform solution to record, convert and stream audio and video written in C. It is used in multiple applications and software libraries such as Google Chrome, MPlayer, VLC or xine. We started relatively small by making use of trivial mutation algorithms, some 500 cores and input media samples gathered from readily available sources such as the samples.mplayerhq.hu sample base and FFmpeg FATE regression testing suite. Later on, we grew to more complex and effective mutation methods, 2000 cores and an input corpus supported by sample files improving the overall code coverage.

Following more than two years of work, we are happy to announce that the FFmpeg project has incorporated more than a thousand fixes to bugs (including some security issues) that we have discovered in the project so far:

$ git log | grep Jurczyk | grep -c Coldwind
1120

This event clearly marks an important milestone in our ongoing fuzzing effort.

FFmpeg robustness and security has clearly improved over time. When we started the fuzzing process and had initial results, we contacted the project maintainer - Michael Niedermayer - who submitted the first fix on the 24th of January, 2012 (see commit c77be3a35a0160d6af88056b0899f120f2eef38e). Since then, we have carried out several dozen fuzzing iterations (each typically resulting in less crashes than the previous ones) over the last two years, identifying bugs of a number of different classes:

• NULL pointer dereferences, 
• Invalid pointer arithmetic leading to SIGSEGV due to unmapped memory access, 
• Out-of-bounds reads and writes to stack, heap and static-based arrays, 
• Invalid free() calls, 
• Double free() calls over the same pointer, 
• Division errors, 
• Assertion failures, 
• Use of uninitialized memory. 

We have simultaneously worked with the developers of Libav, an independent fork of FFmpeg, in order to have both projects represent an equal, high level of robustness and security posture. Today, Libav is at 413 fixes and the library is slowly but surely catching up with FFmpeg.

We are continuously improving our corpus and fuzzing methods and will continue to work with both FFmpeg and Libav to ensure the highest quality of the software as used by millions of users behind multiple media players. Until we can declare both projects "fuzz clean" we recommend that people refrain from using either of the two projects to process untrusted media files. You can also use privilege separation on your PC or production environment when absolutely required.

Of course, we would not be able to do this without the hard work of all the developers involved in the fixing process. If you are interested in the effort, please keep an eye on the master branches for commits marked as "Found by Mateusz "j00ru" Jurczyk and Gynvael Coldwind" and watch out for new stable versions of the software packages.

For more details, see the “FFmpeg and a thousand fixes” posts at the authors’ personal blogs here or here.

Further improving digital certificate security

Posted by Adam Langley, Security Engineer

Late on December 3rd, we became aware of unauthorized digital certificates for several Google domains. We investigated immediately and found the certificate was issued by an intermediate certificate authority (CA) linking back to ANSSI, a French certificate authority. Intermediate CA certificates carry the full authority of the CA, so anyone who has one can use it to create a certificate for any website they wish to impersonate.

In response, we updated Chrome’s certificate revocation metadata immediately to block that intermediate CA, and then alerted ANSSI and other browser vendors. Our actions addressed the immediate problem for our users.

ANSSI has found that the intermediate CA certificate was used in a commercial device, on a private network, to inspect encrypted traffic with the knowledge of the users on that network. This was a violation of their procedures and they have asked for the certificate in question to be revoked by browsers. We updated Chrome’s revocation metadata again to implement this.

This incident represents a serious breach and demonstrates why Certificate Transparency, which we developed in 2011 and have been advocating for since, is so critical.

Since our priority is the security and privacy of our users, we are carefully considering what additional actions may be necessary.

[Update December 12: We have decided that the ANSSI certificate authority will be limited to the following top-level domains in a future version of Chrome: 
.fr 
.gp (Guadeloupe) 
.gf (Guyane) 
.mq (Martinique) 
.re (Réunion) 
.yt (Mayotte) 
.pm (Saint-Pierre et Miquelon) 
.bl (Saint Barthélemy) 
.mf (Saint Martin) 
.wf (Wallis et Futuna) 
.pf (Polynésie française) 
.nc (Nouvelle Calédonie) 
.tf (Terres australes et antarctiques françaises)]

Internet-wide efforts to fight email phishing are working

Posted by Elie Bursztein, anti-abuse research lead and Vijay Eranti, Gmail anti-abuse technical lead

Since 2004, industry groups and standards bodies have been working on developing and deploying email authentication standards to prevent email impersonation. At its core, email authentication standardizes how an email’s sending and receiving domains can exchange information to authenticate that the email came from the rightful sender.

Now, nearly a decade later, adoption of these standards is widespread across the industry, dramatically reducing spammers’ ability to impersonate domains that users trust, and making email phishing less effective. 91.4% of non-spam emails sent to Gmail users come from authenticated senders, which helps Gmail filter billions of impersonating email messages a year from entering our users’ inboxes.

More specifically, the 91.4% of the authenticated non-spam emails sent to Gmail users come from senders that have adopted one or more of the following email authentication standards: DKIM (DomainKey Identified Email) or SPF (Sender Policy Framework).

Here are some statistics that illustrate the scale of what we’re seeing:

• 76.9% of the emails we received are signed according to the (DKIM) standard. Over half a million domains (weekly active) have adopted this standard. 
• 89.1% of incoming email we receive comes from SMTP servers that are authenticated using the SPF standard. Over 3.5 million domains (weekly active) have adopted the SPF standard. 
• 74.7% of incoming email we receive is protected by both the DKIM and SPF standards. 
• Over 80,000 domains have deployed domain-wide policies that allow us to reject hundreds of millions of unauthenticated emails every week via the DMARC standard. 

Join the fight against email spam 

As more domains implement authentication, phishers are forced to target domains that are not yet protected. If you own a domain that sends email, the most effective action you can take to help us and prevent spammers from impersonating your domain is to set up DKIM, SPF and DMARC. Check our help pages on DKIM, SPF, DMARC to get started.

When using DKIM, please make sure that your public key is at least 1024 bits, so that attackers can’t crack it and impersonate your domain. The use of weak cryptographic keys -- ones that are 512 bits or less -- is one of the major sources of DKIM configuration errors (21%).

If you own domains that are never used to send email, you can still help prevent abuse. All you need to do is create a DMARC policy that describes your domain as a non-sender. Adding a “reject” policy for these domains ensures that no emails impersonating you will ever reach Gmail users’ inboxes.

While the fight against spammers is far from over, it’s nevertheless encouraging to see that community efforts are paying off. Gmail has been an early adopter of these standards and we remain a strong advocate of email authentication. We hope that publishing these results will inspire more domain owners to adopt the standards that protect them from impersonation and help keep email inboxes safe and clean.

Even more patch rewards!

Posted by Michal Zalewski, Google Security Team

About a month ago, we kicked off our Patch Reward Program. The goal is very simple: to recognize and reward proactive security improvements to third-party open-source projects that are vital to the health of the entire Internet.

We started with a fairly conservative scope, but said we would expand the program soon. Today, we are adding the following to the list of projects that are eligible for rewards:

• All the open-source components of Android: Android Open Source Project
• Widely used web servers: Apache httpd, lighttpd, nginx
• Popular mail delivery services: Sendmail, Postfix, Exim, Dovecot
• Virtual private networking: OpenVPN
• Network time: University of Delaware NTPD
• Additional core libraries: Mozilla NSS, libxml2
• Toolchain security improvements for GCC, binutils, and llvm

For more information about eligibility, reward amounts, and the submission process, please visit this page. Happy patching!

Out with the old: Stronger certificates with Google Internet Authority G2

Posted by Dan Dulay, Security Engineer

We take the security and privacy of our users very seriously and, as we noted in May, Google has been working to upgrade all its SSL certificates to 2048-bit RSA or better by the end of 2013. Coming in ahead of schedule, we have completed this process, which will allow the industry to start removing trust from weaker, 1024-bit keys next year.

Thanks to our use of forward secrecy, the confidentiality of SSL connections to Google services from modern browsers was never dependent on our 1024-bit RSA keys. But the deprecation of 1024-bit RSA is an industry-wide effort that we’re happy to support, particularly light of concerns about overbroad government surveillance and other forms of unwanted intrusion.

The hardware security module (HSM) that contained our old, 1024-bit, intermediate certificate has served us well. Its final duty after all outstanding certificates were revoked, was to be carefully destroyed.

With the demolition of the HSM and revocation of the old certificates, Google Internet Authority G2 will issue 2048-bit certificates for Google web sites and properties going forward.

A roster of TLS cipher suites weaknesses

Posted by Adam Langley, Software Engineer

SSL/TLS combines a number of choices about cryptographic primitives, including the choice of cipher, into a collection that it calls a “cipher suite.” A list of cipher suites is maintained by the Internet Assigned Names and Numbers Authority.

Because of recent research, this area of TLS is currently in flux as older, flawed, cipher suites are deprecated and newer replacements introduced into service. In this post we’ll be discussing known flaws in some of them.

Cipher suites are written like this: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, which breaks down into the following parts:

ECDHE: the key agreement mechanism. 

RSA: the authentication mechanism. 

AES_128_CBC: the cipher. 

SHA: the message authentication primitive. 

For this discussion, only the ‘cipher’ part of the cipher suite is pertinent.

RC4

RC4 is a very common stream cipher but is showing its 26-year age.

Biases in the RC4 keystream have been known for over a decade or more [1][2][3][4] and were used to attack WEP, the original security standard for Wi-Fi. HTTPS was believed to be substantially unaffected by these results until Paterson et al compiled and extended them [5] and demonstrated that belief to be incorrect.

The best, known attack against using RC4 with HTTPS involves causing a browser to transmit many HTTP requests -- each with the same cookie -- and exploiting known biases in RC4 to build an increasingly precise probability distribution for each byte in a cookie. However, the attack needs to see on the order of 10 billion copies of the cookie in order to make a good guess. This involves the browser sending ~7TB of data. In ideal situations, this requires nearly three months to complete.

This attack cannot be mitigated without replacing RC4.

AES-CBC 

AES-CBC has a couple of problems, both of which are problems with the way that TLS uses CBC (Cipher Block Chaining) mode, and not problems with AES.

The first is called BEAST and was demonstrated by Duong and Rizzo 2011 (although the idea was originally described by Rogaway in 1995). It exploits a flaw in the way that TLS prior to version 1.1 generated CBC initialization vectors.

The attack requires precise control over the TLS connection which is not generally possible from a vanilla browser; the demo used a Java applet to obtain this control. The version of the WebSockets protocol used at the time may have allowed the necessary degree of control, but that had already been replaced by the time that the issue was demonstrated.

However, browsers are complex and evolving pieces of software, and the necessary degree of control is certainly not a comfortable barrier to exploitation. If possible, the exploit is very practical. It requires the attacker to have access to the network near the computer but otherwise completes quickly and deterministically.

The issue is fixed either by using TLS >= 1.1, or by a trick called 1/n-1 record splitting, which has been implemented by all major browsers now. However, many older installations may still exist with Java enabled and would thus be vulnerable to this attack.

The second issue is called Lucky13. This attack uses the fact that TLS servers take a slightly different amount of time to process different types of invalid TLS records. This attack is the first one that we have discussed that requires the use of timing side-channels and is thus probabilistic.

The attack needs nearly 10,000 TLS connections per byte of plaintext decoded and the attacker needs to be situated close to the TLS server in order to reduce the amount of timing noise added by the network. Under absolutely ideal situations, an attacker could extract a short (16 byte) cookie from a victim's browser in around 10 minutes. With optimistic but plausible parameters, the attack could work in an hour.

This attack can only be fixed at the server by making the decoding of all CBC records take a constant amount of time. It’s not plausible for a browser to detect whether a server has fixed this issue before using AES-CBC.

AES-GCM 

There are no known breaks of AES-GCM and it is one of the ciphers that TLS servers are urged to support. However it suffers from a couple of practical issues:

The first is that it’s very challenging to implement AES-GCM in software in a way which is both fast and secure. Some CPUs implement AES-GCM directly in hardware (this is called AES-NI by Intel, the most prominent example of this) and these CPUs allow for implementations that are secure and very fast, but hardware support is far from ubiquitous.

The second nit with AES-GCM is that, as integrated in TLS, implementations are free to use a random nonce value. However, the size of this nonce (8 bytes) is too small to safely support using this mode. Implementations that do so are at risk of a catastrophic nonce reuse after sending on the order of a terabyte of data on a single connection. This issue can be resolved by using a counter for the nonce but using random nonces is the most common practice at this time.

When both parties to a TLS connection support hardware AES-GCM and use counters, this cipher is essentially optimal.

ChaCha20-Poly1305 

This cipher (technically an AEAD, not a cipher, as is AES-GCM) also has no known breaks but is designed to facilitate fast and secure software implementations. For situations where hardware AES-GCM support is not available, it provides a fast alternative. Even when AES-GCM hardware is provided, ChaCha20-Poly1305 is currently within a factor of two in speed.

Summary 

While we recommend the world move to support TLS 1.2, AES-GCM and ChaCha20-Poly1305 (as Chrome and Google are doing) we have to deal with a large fraction of the Internet that moves more slowly than we would like. While RC4 is fundamentally flawed and must be replaced, the attacks against it are very costly. The attacks against CBC mode, however, are much more practical and only one can be conclusively addressed on the client side. It is not clear which is best when nothing better is available.

TLS 1.2 is needed in order to use AES-GCM and ChaCha20-Poly1305. TLS 1.2 deployment is hampered by older servers that fail to process valid TLS messages and thus break version negotiation. It also remains to be seen whether firewalls and other network intermediaries are erroneously processing TLS connections that pass through them, breaking TLS 1.2. Chrome 32 includes an experiment that tests for this issue. If TLS 1.2 is found to be viable on the modern Internet, remedial measures can be taken to repair the TLS version negotiation without breaking the previously mentioned, flawed TLS servers.

Don’t mess with my browser!

In some ways, it's safer than ever to be online — especially if you use Chrome. With continued security research and seamless automatic updates, your browsing experience is always getting better and more secure. But recently you may have noticed something seems amiss. Online criminals have been increasing their use of malicious software that can silently hijack your browser settings. This has become a top issue in the Chrome help forums; we're listening and are here to help.

Bad guys trick you into installing and running this kind of software by bundling it with something you might want, like a free screensaver, a video plugin or—ironically—a supposed security update. These malicious programs disguise themselves so you won’t know they’re there and they may change your homepage or inject ads into the sites you browse. Worse, they block your ability to change your settings back and make themselves hard to uninstall, keeping you trapped in an undesired state.

We're taking steps to help, including adding a "reset browser settings" button in the last Chrome update, which lets you easily return your Chrome to a factory-fresh state. You can find this in the “Advanced Settings” section of Chrome settings.

 

In the current Canary build of Chrome, we’ll automatically block downloads of malware that we detect. If you see this message in the download tray at the bottom of your screen, you can click “Dismiss” knowing Chrome is working to keep you safe.

 

This is in addition to the 10,000 new websites we flag per day with Safe Browsing, which also detects and blocks malicious downloads, to keep more than 1 billion web users safe across multiple browsers that use this technology. Keeping you secure is a top priority, which is why we’re working on additional means to stop malicious software installs as well.

Update: 11/1/13: Updated to mention that Safe Browsing already detects and blocks malware.

Linus Upson, Vice President

reCAPTCHA just got easier (but only if you’re human)

Posted by Vinay Shet, Product Manager, reCAPTCHA

For over a decade, CAPTCHAs have used visual puzzles to help webmasters keep automated software from engaging in abusive activities on their sites. However, over the last few years advances in artificial intelligence have reduced the gap between human and machine capabilities in deciphering distorted text. Today, a successful CAPTCHA solution needs to go beyond just relying on text distortions to separate man from machine.

The reCAPTCHA team has been performing extensive research and making steady improvements to learn how to better protect users from attackers. As a result, reCAPTCHA is now more adaptive and better-equipped to distinguish legitimate users from automated software.

The updated system uses advanced risk analysis techniques, actively considering the user’s entire engagement with the CAPTCHA—before, during and after they interact with it. That means that today the distorted letters serve less as a test of humanity and more as a medium of engagement to elicit a broad range of cues that characterize humans and bots.

As part of this, we’ve recently released an update that creates different classes of CAPTCHAs for different kinds of users. This multi-faceted approach allows us to determine whether a potential user is actually a human or not, and serve our legitimate users CAPTCHAs that most of them will find easy to solve. Bots, on the other hand, will see CAPTCHAs that are considerably more difficult and designed to stop them from getting through.

A new and easier numeric CAPTCHA

Humans find numeric CAPTCHAs significantly easier to solve than those containing arbitrary text and achieve nearly perfect pass rates on them. So with our new system, you’ll encounter CAPTCHAs that are a breeze to solve. Bots, however, won’t even see them. While we’ve already made significant advancements to reCAPTCHA technology, we’ll have even more to report on in the next few months, so stay tuned.

Going beyond vulnerability rewards

Posted by Michal Zalewski, Google Security Team

We all benefit from the amazing volunteer work done by the open source community. That’s why we keep asking ourselves how to take the model pioneered with our Vulnerability Reward Program - and employ it to improve the security of key third-party software critical to the health of the entire Internet.

We thought about simply kicking off an OSS bug-hunting program, but this approach can easily backfire. In addition to valid reports, bug bounties invite a significant volume of spurious traffic - enough to completely overwhelm a small community of volunteers. On top of this, fixing a problem often requires more effort than finding it.

So we decided to try something new: provide financial incentives for down-to-earth, proactive improvements that go beyond merely fixing a known security bug. Whether you want to switch to a more secure allocator, to add privilege separation, to clean up a bunch of sketchy calls to strcat(), or even just to enable ASLR - we want to help!

We intend to roll out the program gradually, based on the quality of the received submissions and the feedback from the developer community. For the initial run, we decided to limit the scope to the following projects:

• Core infrastructure network services: OpenSSH, BIND, ISC DHCP
• Core infrastructure image parsers: libjpeg, libjpeg-turbo, libpng, giflib
• Open-source foundations of Google Chrome: Chromium, Blink
• Other high-impact libraries: OpenSSL, zlib
• Security-critical, commonly used components of the Linux kernel (including KVM)

We intend to soon extend the program to:

• Widely used web servers: Apache httpd, lighttpd, nginx
• Popular SMTP services: Sendmail, Postfix, Exim
• Toolchain security improvements for GCC, binutils, and llvm
• Virtual private networking: OpenVPN

How to participate?

Please submit your patches directly to the maintainers of the individual projects. Once your patch is accepted and merged into the repository, please send all the relevant details to security-patches@google.com. If we think that the submission has a demonstrable, positive impact on the security of the project, you will qualify for a reward ranging from $500 to $3,133.7.

Before participating, please read the official rules posted on this page; the document provides additional information about eligibility, rewards, and other important stuff.

Happy patching!

Security rewards at Google: Two MEEELLION Dollars Later

Posted by Chris Evans and Adam Mein, Masters of Coin

One of Google’s core security principles is to engage the community, to better protect our users and build relationships with security researchers. We had this principle in mind as we launched our Chromium and Google Web Vulnerability Reward Programs. We didn’t know what to expect, but in the three years since launch, we’ve rewarded (and fixed!) more than 2,000 security bug reports and also received recognition for setting leading standards for response time.

The collective creativity of the wider security community has surpassed all expectations, and their expertise has helped make Chrome even safer for hundreds of millions of users around the world. Today we’re delighted to announce we’ve now paid out in excess of $2,000,000 (USD) across Google’s security reward initiatives. Broken down, this total includes more than $1,000,000 (USD) for the Chromium VRP / Pwnium rewards, and in excess of $1,000,000 (USD) for the Google Web VRP rewards.

Today, the Chromium program is raising reward levels significantly. In a nutshell, bugs previously rewarded at the $1,000 level will now be considered for reward at up to $5,000. In many cases, this will be a 5x increase in reward level! We’ll issue higher rewards for bugs we believe present a more significant threat to user safety, and when the researcher provides an accurate analysis of exploitability and severity. We will continue to pay previously announced bonuses on top, such as those for providing a patch or finding an issue in a critical piece of open source software.

Interested Chromium researchers should familiarize themselves with our documentation on how to report a security bug well and how we determine higher reward eligibility.

These Chromium reward level increases follow on from similar increases under the Google Web program. With all these new levels, we’re excited to march towards new milestones and a more secure web.