PayPal opens up bug bounty program to minors

PayPal is opening up its bug bounty program to individuals aged 14 and older, a move intended to reward younger researchers who are technically ineligible to hold full-fledged PayPal accounts.

PayPal's program, which is a year old this month, only applied to those 18 years and older. Under the old rule, participants in the program were required to hold valid accounts, which excluded minors, said Gus Anagnos, PayPal's director of information security.

[ Also on InfoWorld: Where are the kid coders? Not in U.S. schools. | Security expert Roger A. Grimes offers a guided tour of the latest threats and explains what you can do to stop them in "Fight Today's Malware," InfoWorld's Shop Talk video. | Keep up with key security issues with InfoWorld's Security Adviser blog and Security Central newsletter. ]

In May, 17-year-old Robert Kugler, a student in Germany, said he'd been denied a reward for finding a vulnerability. PayPal said the bug had already been found by two other researchers, which would have made Kugler ineligible for bounty.

In an apparent miscommunication, Kugler said he was initially told he was too young rather than the bug had already been discovered. Nonetheless, PayPal said it would look to bring younger people into its program, which pays upwards of $10,000 for remote code execution bugs on its websites.

Those who are under 18 years old can receive a bug bounty payment through a PayPal student account, an arrangement where a minor can receive payments via their parent's account, Anagnos said.

Anagnos said other terms and conditions have been modified to make its program more transparent, such as clarifying which PayPal subsidiaries and partner sites qualify for the program.

PayPal pays much less for vulnerabilities on partner websites, which have a URL form of "www.paypal-__.com." A remote execution bug found on that kind of site garners only $1,500 rather than up to $10,000 on the company's main sites.

Like other bug bounty programs run by companies such as Microsoft and Google, PayPal will publicly recognize researchers on its website with a "Wall of Fame" for the top 10 researchers in a quarter. Another "honorable mention" page lists anyone who submitted a valid bug for the quarter.

Eusebiu Blindu, a testing consultant from Romania, was one of the researchers listed on the Wall of Fame for the first quarter of this year.

"I think Paypal is the best bug bounty program, and I am glad I participated in it from the first days of its launching," he wrote on his blog.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk.

View the original article here

U.S. cloud companies suffer from NSA PRISM program

For U.S. cloud providers, already working to beat back a wave of overseas policies they say tilt the playing field in favor of home-grown competitors, the revelations of the National Security Agency's PRISM electronic surveillance program have only made conditions in foreign markets tougher.

The media accounts of the program based on leaks by former contractor Edward Snowden have created a perception that the U.S. government has unlimited and direct access to data stored on the servers of companies like Google and Microsoft, experts said on Wednesday at a policy talk here at the Information Technology and Innovation Foundation, a D.C. think tank.

[ Also on InfoWorld: NSA upshot: We're finally taking Internet privacy seriously. | Stay on top of the cloud with InfoWorld's "Cloud Computing Deep Dive" special report. Download it today! | From Amazon to Windows Azure, see how the elite 8 public clouds compare in InfoWorld Test Center's review. | For the latest news and happenings, subscribe to the Cloud Computing Report newsletter. ]

[ Related: The NSA Security Quagmire ]

"The PRISM disclosures are damaging, and I think I'm prepared to speculate extremely damaging to commercial firms that have offered cloud and related kinds of services, and that do or would benefit from efficient cross-border data flows," says Philip Verveer, the former U.S. coordinator for international communications and information policy at the State Department.

Already, domestic cloud providers have been hampered in their overseas expansion, particularly in Europe, by a deficit of trust among businesses and consumers who worry about how their data will be handled when it resides in the cloud. The long-held suspicion that the U.S. government will be able to freely access foreign users' data under the PATRIOT Act has been fueled by foreign cloud companies and some state officials, who have pressed for cloud protectionist policies that would limit the flow of data outside the country, effectively requiring foreign providers to operate data centers locally.

Now, U.S. trade advocates see the PRISM disclosures giving fresh momentum to those protectionist policies.

"What you see is a lot of foreign officials and foreign companies sort of making hay while the sun still shines," says Jake Colvin, vice president of global trade issues at the National Foreign Trade Council. "Foreign companies are happily using PRISM as the latest series of clubs to beat U.S. companies over the head."

The effects of the PRISM disclosures have already begun to come into view. In a recent survey by the Cloud Security Alliance, a non-profit group with more than 48,000 individual members, 10 percent of officials at foreign companies said that they have cut ties with U.S. providers following the leaks, and 56 percent of foreign respondents say they are now hesitant to do business with U.S. firms.

View the original article here