<http://schema.org/articleBody>
"If you're a hacker or a security researcher, this is a reminder that you don't have to take on Google's or Mozilla's software to get paid for finding a bug. In its first week, the Mega vulnerability reward program has already confirmed and fixed seven bugs, showing that Dotcom really does put his money where his mouth is.\r\n\r\nAlthough Mega hasn't shared how much money it paid out in the first week, how many bug submissions were made, or even who found which bugs, the company did briefly detail the discovered security holes. It also confirmed that the program is here to stay and urged those participating to find more severe bugs.\r\n\r\nMega also revealed the program classifies vulnerabilities based on their impact. Here are the six classes in order of most severe to least severe:\r\n\r\nSeverity class VI: Fundamental and generally exploitable cryptographic design flaws.\r\nSeverity class V: Remote code execution on core MEGA servers (API/DB/root clusters) or major access control breaches.\r\nSeverity class IV: Cryptographic design flaws that can be exploited only after compromising server infrastructure (live or post-mortem).\r\nSeverity class III: Generally exploitable remote code execution on client browsers (cross-site scripting).\r\nSeverity class II: Cross-site scripting that can be exploited only after compromising the API server cluster or successfully mounting a man-in-the-middle attack (e.g. by issuing a fake SSL certificate + DNS/BGP manipulation).\r\nSeverity class I: All lower-impact or purely theoretical scenarios.\r\n\r\n\r\nIn the first week, no Class V and VI vulnerabilities were reported. Here's the breakdown for the seven bug bounties:\r\n\r\n\r\nOne Class IV vulnerability: Invalid application of CBC-MAC as a secure hash to integrity-check active content loaded from the distributed static content cluster. Mitigating factors: No static content servers had been operating in untrusted data centres at that time, thus no elevated exploitability relative to the root servers, apart from a man-in-the-middle risk due to the use of a 1024 bit SSL key on the static content servers. Fixed within hours.\r\nThree Class III vulnerabilities: i) XSS through file and folder names. Mitigating factors: None. Fixed within hours. Ii) XSS on the file download page. Mitigating factors: Chrome not vulnerable. Fixed within hours. iii) XSS in a third-party component (ZeroClipboard.swf). Mitigating factors: None. Fixed within hours.\r\nOne Class II vulnerability: XSS through strings passed from the API server to the download page (through three different vectors), the account page and the link export functionality. Mitigating factors \u2013 apart from the need to control an API server or successfully mounting a man-in-the-middle attack \u2013: None. Fixed within hours.\r\nTwo Class I vulnerabilities: i) HTTP Strict Transport Security header was missing. Fixed. Also, mega.co.nz and *.api.mega.co.nz will be HSTS-preloaded in Chrome. Ii) X-Frame-Options header was missing, causing a clickjacking/UI redressing risk. Fixed.\r\n\r\n\r\nAgain, it's not clear how much each of these bugs are worth. Kim Dotcom first offered up to a \u20AC10,000 (about $13,500) bounty for anyone who broke the company's security systems and then made it official with the security program's launch on February 2.\r\n\r\nSince there were no high-class severity flaws reported in the first week, we can't use that number. Kim Dotcom did, however, reveal information about one of the payouts in one of his retweets:\r\n\r\nCongratulations @fransrosen for XSS in #MEGA. Handsome EUR 1000 in Bug Bounty Program twitter.com/fransrosen/sta\u2026&amp;amp;mdash; The Hacker News\u2122 (@TheHackersNews) February 10, 2013\r\n\r\n\r\nThis appears to be one of the class III severity bug discovered. It's thus safe to say Mega has already paid out thousands of dollars in bug bounties during the first week of its security program.\r\n\r\nUpdate at 11:45PM EST: Dotcom has confirmed to TNW that the above bounty was one of three Mega has paid out so far. All of them were fixed.\r\n\r\nImage credit: Miguel Saavedra"^^<http://www.w3.org/2001/XMLSchema#string>
<http://thenextweb.com/insider/2013/02/10/as-promised-kim-dotcom-starts-payouts-for-mega-vulnerability-reward-program-seven-bugs-fixed-in-first-week/?awesm=tnw.to_d0VFj>