Microsoft is to offer rewards to anyone who discovers bugs within many of its online services.
Dubbed the 'Microsoft Online Services Bug Bounty Program', the company kicked off the scheme earlier this week, saying anyone submitting a bug is eligible for a minimum payment of $500 (340).
According to the post on Technet, bugs can include any vulnerabilities discovered in its Office, Outlook 365 and Office 365 for business email services applications, Sharepoint, Lync, Yammer and other services that belong to Microsoft.
Bounties will be paid out to anyone discovering cross site scripting (XSS), cross site request forgery (CSRF), unauthorised cross-tenant data tampering or access (for multi-tenant services), insecure direct object references, injection and authentication flaws, server-side code execution, privilege escalation and significant security misconfiguration vulnerabilities.
A number of vulnerabilities have, however, been blacklisted including bugs that only affect unsupported browsers and plugins and those that would not necessarily pose a risk to people using its services in a regular way. Microsoft will also not pay out if a Denial of Service (DoS) attack is discovered.
Microsoft encourages those who wish to mine for bugs to set up test accounts for security testing rather than use live ones.
Depending on the severity of the bug, Microsoft will vary its payments, but the company says the minimum paid out will be $500 (340). However, the "detail, quality, and complexity of the vulnerability" will also be considered in determining the level of payment.
Some of the biggest tech companies around the world already offer rewards to researchers or regular users who uncover bugs or vulnerabilities. Twitter recently announced it would pay around $140 (85) for every security flaw its users find, while Yahoo came under fire for offering just $12.50 (7.65) in its scheme.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Is Outlook down? Microsoft confirms disruption in email client and TeamsNews There are reports of service disruptions from users all over Europe
-
Outlook rolls out 'Dark Mode' inverted colour scheme due to user demandsNews The much-requested feature is only available on one platform, though
-
Microsoft is killing off its Outlook Web App for Android and iOSNews Users will be encouraged to use the dedicated Outlook app for iOS and Android from April 2018
-
Microsoft brings Sunrise features to mobile OutlookNews Microsoft shut down Sunrise last month, but it lives on in Outlook for Android and iOS
-
Microsoft Office for Mac PreviewReviews A new Office for Mac, but is it worth upgrading to?
-
Microsoft Outlook for iOS reviewReviews iPhones and iPads finally receive a fully functioning Outlook app
-
Outlook for Mac release date news paves way for complete suite's arrival in 2015News Mac users could finally be getting updated to Office suite
-
Microsoft in the clear over anti-Gmail ad campaignNews ASA rules in software giant's favour over Outlook.com email scanning claims.
