Microsoft pays out $100,000 for bug bounty

A researcher who has discovered a new attack technique that bypasses all of the exploit mitigations on the newest version of Windows was awarded with a check for $100,000 just days after Microsoft announced that it had paid out $28,000 to a few researchers who found flaws in IE11.

James Forshaw submitted the technique to Microsoft, which validated it. Forshaw’s technique is the first one to qualify for the $100,000 payout. The bounty program was announced in June.

A senior security strategist at Microsoft, Katie Moussouris, said that Microsoft won't disclose the details until their engineers have had a chance to analyze it and implement defenses in Windows.

“While we can’t go into the details of this new mitigation bypass technique until we address it, we are excited that we will be better able to protect customers by creating new defenses for future versions of our products because we learned about this technique and its variants.”