Mozilla ups bug bounty rewards to $15,000 on critical sites

Now's your chance to help the Firefox-maker plug any holes that may have slipped passed the security team.

Bug bounty researchers probing for vulnerabilities in Mozilla software now will be tempted with more cash after the browser-maker doubled most of its rewards and expanded the list of targets.

In a blog post Tuesday, Mozilla said it’s marking the 15-year anniversary of its Firefox browser by dedicating a higher budget to its bounty program. Rewards for critical, core and other Mozilla sites are doubled, while remote code-execution vulnerabilities now are worth up to $15,000 on critical sites. Meanwhile, Mozilla also is asking researchers to try hacking its Autograph cryptography service, its Lando code repository tool, the Phabricator, which reviews code changes in Firefox, and Taskcluster, the framework for continuous integration, among others.

“We hope the new sites and increased payments will encourage [researchers] to have another look at our sites and help us keep them safe for everyone who uses the web,” Simon Bennetts, a security automation engineer, said in the announcement.

The increase comes amid ongoing interest in bug bounty programs as a failsafe that corporate security teams, particularly in the technology sector, utilize to identify any flaws internal staffers may have missed. By offering rewards through vetted brokers, firms like Apple, Intel and GM hope to plug any holes that could provide malicious outsiders with a way into their networks.

Political gamesmanship also seems to be more of a factor in rewards decisions, at least for Huawei. The Chinese telecommunication firm that U.S. national security officials warn could operate under Beijing’s sway said last week it would offer up to $220,000 to researchers who uncover “critical” vulnerabilities in one of its Android devices. The big prize will go to hackers who show they can remotely access a device without clicking anything, while easier-to-score goals can fetch up to $110,000, according to Forbes.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure