Uber to pay $10k to “friendly hackers”
Uber has announced its intention to pay “bounties” of up to $10k to security researchers (read: hackers) who are able to break into its platform and discover other security flaws, and then report back to the company with the details of what they did, and more importantly, how they did it. "Even with a team of highly-qualified and well-trained security experts, you need to be constantly on the look-out for ways to improve." said Uber’s chief security officer Joe Sullivan. "This bug bounty program will help ensure that our code is as secure as possible. And our unique loyalty scheme will encourage the security community to become experts when it comes to Uber."

Uber's business model is based on a simple notion: Why employ drivers full time when you can hire them more efficiently as freelancers? It's no surprise, then, that the company's come to the same conclusion on cybersecurity, recruiting an army of gig-economy hackers who are paid by the exploit instead of by the hour.

On Tuesday, Uber announced that it's officially launching a "bug bounty" program that will pay independent security researchers thousands of dollars in rewards for finding hackable bugs in its apps and websites. That makes the ride-sharing firm the latest tech giant to adopt the strategy of crowdsourcing the auditing of its code to shore it up against less benevolent hackers. Finding a bug that could deface Uber's homepage or expose users' email addresses earns $5,000, for instance, while one that could fully take over Uber accounts or run malicious code on an Uber production server can earn as much as $10,000.

But Uber, which is launching its program with the help of the bug-bounty-focused firm HackerOne, has gone a step further than older programs run by Google, Facebook and Microsoft: It's trying out a bug bounty "loyalty system" that gives hackers bonuses for repeated bug discoveries in Uber's platform. It's also promised to release a "treasure map" for bug bounty hunters designed to guide them toward potential vulnerabilities in the site---mapping out the company's code to make bug hunting as efficient as possible.

The idea, says Uber head of product security Collin Greene, is to incentivize security researchers to "go deep" in Uber's code, instead of flitting between different companies' bug bounty programs searching for low-hanging fruit. And the "treasure map" is designed to share with external hackers the same systems architecture information that internal staff have access to, a move that can save bug hunters weeks of recon time and help them start uncovering serious vulnerabilities in the company's code. "We're saying 'here are the different portions of the website, the mobile apps and how they work, and the technologies underneath them. If I were a security researcher, here’s where I'd look,'" says Greene. "By giving them a treasure map of the structure of our system, they can spend their time instead looking for really subtle bugs."

All of that might sound like a particularly aggressive invitation for hackers, and one that could backfire. But Uber argues that it's not revealing anything in its treasure map that isn't already public. And given that information is already discoverable by serious hackers incentivized by criminal profits, better to offer it to those seeking to inform the company of its vulnerabilities, too. "It's in our best interest to make sure that the right people with the right intentions---security researchers who are going to look at our code and report bugs directly to Uber---have the information in an easy to understand way," Greene says. "We believe a more transparent program will be a more successful [one]."

Uber's bug bounty program isn't as new as it sounds. It's already paid hackers more than a hundred bug bounties in a private beta version of the program that it's quietly run for a year. And it's been on a security hiring spree that includes experienced bug bounty managers: Both Greene and Uber chief security officer Joe Sullivan were hired from Facebook, where Greene formerly oversaw a bug bounty program that's paid out millions of dollars. In fact, Uber's new features show just how far the culture of bug bounties has evolved: Major tech firms are now competing for independent hackers' attention---and not just with money, but in Uber's case, by making the process of bug discovery more efficient. "We want to make this a bug bounty program that researchers adore," says Greene.