Yahoo abandons T-shirt rewards for vulnerability information

Yahoo will stop giving T-shirts as a reward for finding security vulnerabilities after a public shaming it’s calling “T-shirt gate.”

The company received a drubbing from the Swiss security company High-Tech Bridge after it found four serious vulnerabilities in Yahoo’s network, all of which have now been fixed. Three of those problems – cross-site scripting flaws – could have allowed an attacker to hijack a person’s Yahoo email account.

Starting October 31, Yahoo will pay rewards ranging from $150 to $15,000 for vulnerabilities, provided those flaws are new, unique or high risk. It plans to retroactively reward researchers who notified the company of issues going back to July 1, wrote Ramses Martinez, director of Yahoo’s security team, in a blog post on Wednesday.

“This includes, of course, a cheque for the researchers at High-Tech Bridge who didn’t like my T-shirt,” Martinez wrote.

High-Tech Bridge issued a press release on Monday saying Yahoo offered $12.50 in credit per vulnerability, which could be used toward Yahoo-branded items such as T-shirts, cups and pens from its store.

As a result, High-Tech Bridge said it would hold off doing more research on Yahoo’s network. The company wrote that Yahoo’s reward was “a bad joke.”

Many large companies such as Google and Facebook offer lucrative bounties for vulnerability information. Google will pay up to $20,000 for a qualifying vulnerability, and Facebook pays a minimum of $500.

It’s cheaper for companies to pay for vulnerability information rather than hire full-time researchers. It also helps dissuade researchers from turning to hacking forums to monetise their information, where it might be used to do harm.

Yahoo never had a formal process for recognising security researchers. Martinez wrote that he began started sending T-shirts to researchers to express thanks.

“I even bought the shirts with my own money,” he wrote.

But Yahoo had recently decided to improve its vulnerability reporting programme. While Yahoo acted fast on the vulnerability information it received, “my ‘send a T-shirt’ idea needed an upgrade,” Martinez wrote.

“This month the security team was putting the finishing touches on the revised programme,” he wrote. “And then yesterday morning ‘T-shirt-gate’ hit. My inbox was full of angry emails from people inside and out of Yahoo. How dare I send just a T-shirt to people as a thanks?”

Yahoo also plans to improve its Web page where researchers can send in security issues. Researchers will be contacted within two weeks, Martinez wrote. Those who successfully submit valid flaws can also get an email or written letter that can be used as a reference for their work.

“For the best reported issues, we will directly call out from our site an individual’s contribution in a ‘hall of fame,'” he wrote.