Meta’s Bug Bounty Program Shows $2m Awarded in 2022

Social media giant Meta has awarded a total of $2m as portion of its bug bounty application. The complete total since the program’s institution in 2011 is reportedly $16m.

The figures appear from a website article Meta revealed on Thursday seeking back at the highlights from the company’s bug bounty plan over the very last decade.

“We been given hundreds of impactful bug experiences in 2022 from scientists all above the environment that have served to make our neighborhood far more safe,” Meta wrote.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Given that 2011, the company reported it experienced gained additional than 170,000 reports, of which about 8500 were awarded a bounty. The numbers for 2022 alone were 10,000 studies, with issued benefits on extra than 750.

Meta also recently introduced new payout tips for cell distant code execution (RCE) bugs and account takeover (ATO) and two-factor authentication (2FA) bypass vulnerabilities.

They range as higher as $130,000 for ATO studies and $300,000 for cellular RCE bugs.

“These rules are supposed to established an regular highest payout for a individual bug classification and describe what mitigating things we look at in pinpointing the bounty to assistance researchers prioritize their searching,” Meta wrote.

“Eventually, just about every report is evaluated on a circumstance-by-case foundation and could, in some conditions, be awarded bigger than the cap relying on the internally assessed impact.”

Beneath the new suggestions, Meta explained it has awarded security researcher Yaala Abdellah $163,000 for pinpointing a bug in Facebook’s account recovery movement most likely enabling an attacker to reset passwords and get around an account if it was not protected by 2FA.

“We also preset a bug described by Gtm Mänôz of Nepal, which could have authorized an attacker to bypass SMS-dependent 2FA by exploiting a level-restricting issue to brute pressure the verification pin demanded to verify someone’s phone selection,” Meta additional. “We awarded a $27,200 bounty for this report.”

The new rules come weeks right after Meta was fined €265m ($275m) in Ireland about a massive-scale information leak that transpired before in the yr.