PayPal opens up bug bounty program to minors

PayPal is opening up its bug bounty program to individuals aged 14 and older, a move intended to reward younger researchers who are technically ineligible to hold full-fledged PayPal accounts.

PayPal's program, which is a year old this month, only applied to those 18 years and older. Under the old rule, participants in the program were required to hold valid accounts, which excluded minors, said Gus Anagnos, PayPal's director of information security.

In May, 17-year-old Robert Kugler, a student in Germany, said he'd been denied a reward for finding a vulnerability. PayPal said the bug had already been found by two other researchers, which would have made Kugler ineligible for bounty.

In an apparent miscommunication, Kugler said he was initially told he was too young rather than the bug had already been discovered. Nonetheless, PayPal said it would look to bring younger people into its program, which pays upwards of US$10,000 for remote code execution bugs on its websites.

Those who are under 18 years old can receive a bug bounty payment through a PayPal student account, an arrangement where a minor can receive payments via their parent's account, Anagnos said.

Anagnos said other terms and conditions have been modified to make its program more transparent, such as clarifying which PayPal subsidiaries and partner sites qualify for the program.

PayPal pays much less for vulnerabilities on partner websites, which have a URL form of "www.paypal-__.com." A remote execution bug found on that kind of site garners only $1,500 rather than up to $10,000 on the company's main sites.

Like other bug bounty programs run by companies such as Microsoft and Google, PayPal will publicly recognize researchers on its website with a "Wall of Fame" for the top 10 researchers in a quarter. Another "honorable mention" page lists anyone who submitted a valid bug for the quarter.

Eusebiu Blindu, a testing consultant from Romania, was one of the researchers listed on the Wall of Fame for the first quarter of this year.

"I think Paypal is the best bug bounty program, and I am glad I participated in it from the first days of its launching," he wrote on his blog.

Microsoft to pay first IE 11 Preview bug bounty to BlueHat security contest finalist

Microsoft has already received several vulnerability reports that qualify for monetary rewards as part of the company’s bug bounty program launched in June for the preview version of Internet Explorer 11.

The recipient of the first IE 11 bounty will be Ivan Fratric, a security researcher who earned second place and $50,000 last year in Microsoft’s BlueHat Prize contest for the development of defensive technologies. Fratric’s entry into the contest was a system called ROPGuard, which can detect and prevent return-oriented programming (ROP) attacks.

According to his LinkedIn profile, Fratric worked as a researcher at the University of Zagreb’s Faculty of Electrical Engineering and Computing until October 2012, when he joined Google as an information security engineer.

“The security community has responded enthusiastically to our new bounty programs, submitting over a dozen issues for us to investigate in just the first two weeks since the programs opened,” said Katie Moussouris, a senior security strategist with Microsoft’s Security Response Center, Wednesday in a blog post. “I personally notified the very first bounty recipient via email today that his submission for the Internet Explorer 11 Preview Bug Bounty is confirmed and validated,” she said, adding that this means “he’s getting paid.”

Moussouris did not disclose the identity of the first bounty recipient in the blog post, but she confirmed Thursday that it’s Fratric in a Twitter message congratulating him.

Other researchers qualified for IE 11 bounties as well and they will be notified soon, Moussouris said in the blog post. Microsoft will create an acknowledgement page to list the researchers who wish to be publicly recognized, she said.

Microsoft announced the IE 11 Preview bug bounty program on June 19, after years of being reluctant to the idea of paying security researchers for reporting vulnerabilities in its products. In the past, the company preferred to encourage the development of active defenses like anti-exploitation techniques that can block entire classes of exploits. The BlueHat Prize contest in 2012, with a prize pool of over $250,000, was intended to promote the development of such defensive technology.

The IE 11 Preview bug bounty program, meanwhile, kicked off on June 26 and will run for 30 days, until July 26. The reported vulnerabilities can qualify for bounties between $500 and $11,000, or even more in particular cases, depending on the gravity of the vulnerability and the quality of the report.

“It’s not about offering the most money, but rather about putting attractive bounties out at times where there are few buyers (if any),” Moussouris said. “For our products, that tends to be during the preview (or beta) period.”

At the end of June, Fratric said on Twitter that he reported a potential memory corruption issue in IE 11 Preview to Microsoft, but it’s not clear if that’s the bug that won him the program’s first bounty.

In addition to the IE 11 Preview bounty program, Microsoft also launched two other programs, one that will reward researchers for finding novel exploitation techniques to circumvent Windows 8.1’s exploit mitigation defenses and the other for developing new ways to block known exploitation techniques.

Ultimate Food Summer Weekend: From Seafood Craze to Farmer's Market Bounty

Kick off your culinary tour with dinner at the lively Connie and Ted’s (8171 Santa Monica Blvd.) in West Hollywood. It’s the latest in L.A.’s big new embrace of classic East Coast seafood shacks, as reconceived by top local chefs. (Think Jon Shook and Vinny Dotolo at Son of a Gun, Jason Travi at Littlefork and David LeFevre at Fishing With Dynamite.) This one is all about the steamers and chowda, creations of Michael Cimarusti, known for the fish-focused Providence (which earned two Michelin stars when the guide was still covering the city), all served up in a postmodern swoop of a building that recalls Googie architecture.

PHOTOS: Best of Hollywood: 28 Ways to Create a Perfect Summer Weekend

SATURDAY

First thing, visit the most-talked-about breakfast spot in town, Silver Lake’s Sqirl (720 N. Virgil Ave.), which is at the forefront of the jamming movement. Exhibit A: burnt brioche toast with house ricotta and Blenheim apricot jam. Stay on the Eastside and nab a spot at a suitably summery Hipcooks (eastla. hipcooks.com) class like “The Thrill of the Grill,” held in a loft at the Brewery Arts Complex near downtown L.A. For lunch, go old school with a No. 19 on double-baked rye at Langer’s (704 S. Alvarado St.) in MacArthur Park. The late New York supremacist Nora Ephron once declared it “the finest hot pastrami sandwich in the world.” Afterward, download a neighborhood map from nonprofit Fallen Fruit (fallenfruit.org) and go on an urban produce-picking adventure among the trees and bushes of Pasadena. Then stop by Janet Jarvits’ singular shop Cook Books (1388 E. Washington Blvd.) in the same neighborhood to select a tome from her 30,000 titles, many of which are rare finds. For dinner, book a table — far in advance — at the toughest new reservation in town: the Italian sensation Bestia in downtown’s Arts District (2121 E. Seventh Place). (Warning: Seating for two at 7:30 on a Saturday night is booked two months out, so your assistant better know how to pull strings.) If that sort of planning ruins your appetite, then head west to Brentwood’s Vincenti (11930 San Vicente Blvd.), which has just begun sourcing an Australian truffle variant of the traditional French black Perigord fungus — joining the likes of Santa Monica’s Melisse and downtown L.A.’s Patina. Vincenti’s top toque, Nicola Mastronardi, doesn’t just employ truffles over pasta but with everything from hamachi carpaccio and white asparagus to vanilla gelato. The Down Under market is beginning to boom as U.S. chefs realize they no longer need to fall back on frozen truffles outside of autumn.

PHOTOS: 26 of Summer's Most Anticipated Movies: 'Man of Steel,' 'Wolverine,' 'The Lone Ranger'

SUNDAY

Bring a basket to the bountiful Sunday farmers market in Hollywood, which draws top chefs — like the kitchen team behind Cooks County — and Jake Gyllenhaal alike to scout out A-list Southern California vendors like Gardens Of..., known for its lettuce and potatoes. When you’re finished, tuck into a barbecue brunch at the stylish new Bludso’s Bar-&-Que (609 N. La Brea Ave.) in Mid-City. Kanye West is a stalwart of the storied original outpost in Compton. Once you’re sated, hit the Eastside to stock up on libation rations. Silver Lake Wine (2395 Glendale Blvd.) boasts a Wally’s-esque array of vintages and $20 four-pour tastings — typically regionally themed — at 3 p.m. on Sundays. Close by, Bar Keeper (3910 W. Sunset Blvd.) has all of the nouveau-mixology accoutrements for at-home sipping, such as vintage glassware and small-batch bitters including the sought-after Miracle Mile brand, produced by former Miramax executive Louis Anderman. Then, over in Highland Park, stop by the unparalleled Galco’s Soda Pop Stop (5702 York Blvd.) to select among hundreds of carbonated rarities, from colas (Fukola, Double) and sarsaparillas (AJ Stephans, Baron’s Boothill) to such experimental flavors as juniper berry and lemongrass that make Dr. Brown’s Cel-Ray really seem old-fashioned. Finish your 48-hour tour with this summer’s periodic weekend 626 Night Market (626nightmarket.com), situated along the ornate Paddock Gardens in front of the Santa Anita Park horse-racing track in Arcadia. Mimicking the jam-packed night markets of Asia, vendors — many from nearby San Gabriel Valley communities — offer a dizzying array of street eats such as stinky tofu, pig intestine skewers and mango ice drinks. Or, at the other end of the Asian dining spectrum, there’s the glitzy Chi Lin (9201 Sunset Blvd.), across from Soho House. It’s a favorite of Courteney Cox. “I love having a great Chinese restaurant in my neighborhood, especially one that has such a good atmosphere,” she says of the weeks-old newcomer, which specializes in Hong Kong haute cooking with a vaguely Trader Vic’s flair (expect the shrimp-and-chicken fried rice to be served in a hollowed-out pineapple and retro cocktails to be adorned with plastic monkeys).

See more perfect summer weekends below:

Shopping With Jewelry Designer Jennifer Meyer

Music With Breakout Star Skylar Grey

Art With Director Phil Lord

Outdoors: Fun in the SoCal Sun

Pampering: Spa, Aaah

Romance: Date Nights (and Days)

Classic L.A.: Historic Hot Spots

The 1 Percent: Live in Luxury

Kids: Modern Family Adventures

Follow me on Twitter @sajilpl