Throwing money at bug bounties won't beat zero-day dark markets
The first academic study into the market for zero-day flaws has shown some surprising results, not least that throwing money at ever-larger bug bounty payouts might well be counterproductive.
The research – which was carried out by MIT principal research scientist Michael Siegel and Katie Moussouris, chief policy officer of bug bounty organizer HackerOne – traced the dynamics of the market for zero-day flaws by monitoring the activities both of crooks who collect vulnerabilities for attacks and researchers who report them to increase software defences.
Moussouris, who set up Microsoft's first big bounty program when she was at Microsoft in 2013, found that offering researchers money was a highly effective tactic – up to a point. But while bounties were a useful tool, she discovered that the people reporting bugs were motivated not only by money but also by the favorable publicity they could get to support their own businesses.
