Microsoft Paid $100,000 for Finding Bug in Windows 8.1

The software giant has paid $100,000 to the UK researcher James Forshaw, who found a critical security flaw in Microsoft’s upcoming Windows 8.1 OS.

Forshaw, a researcher for the security company, has found a “mitigation bypass”. This hack circumvented the built-in protection systems that could have allowed intruders access to the system.

Microsoft said it couldn’t provide any details of that mitigation bypass technique until it found a way to address it. However, the software giant promised to strengthen platform-wide mitigations, and make it harder to exploit vulnerabilities in all software that runs on Windows platform, not only their own apps.

The researcher admitted it had taken him 25 days to find the bug, responding to “a very specific brief” from the software giant. Forshaw originally came up with the winning idea sitting at home and pondering what he could do. $100,000 bounty is a lot of money, but James Forshaw said that he wasn’t talking retirement money there. Indeed, when it comes to security flaw bounties like Microsoft’s, most of it goes to the company. Actually, even if it didn’t, after paying taxes it is already not a life-changing amount.

The researcher admitted that using outside experts was just part of the process due to the scale of the task involved. The software giant has a huge security department which actively looks for software bugs in its products, but it might be just a problem of being too close to the product – you simply cannot see the wood for the trees. Forshaw recommends to step back and take a look at the entire product and its interactions in order to find the higher-level flaws.

It seems that outsourcing is also important from a monetary point of view. In fact, the company couldn’t dedicate enough resources to find everything, because it is cheaper to pay external researchers bounties like this one. Apparently, there is only a finite pool of talented people who are able to find vulnerabilities in software products.

One can argue that the bugs and vulnerabilities should not exist in the first place, but everyone knows that humans are fallible and nobody can write perfect code.

Silk Road Founder Will Face Charges in New York

A federal judge ordered a California man accused of operating an Internet drug marketplace dubbed Silk Road to go to New York to face charges. The order came during a brief court hearing in San Francisco. Federal authorities in New York have charged Ross Ulbricht, the site operator, with three felonies related to the operation of the service. Ulbricht's attorney has denied all charges.

Silk Road became known a couple years ago as a black market bazaar where users could trade drugs for BitCoins, a form of online cash. A “hidden” site used Tor network to mask the location of its servers. Thus far, the site operator agreed to remain in custody. The police have said he ran the service under various aliases, including “Dread Pirate Roberts”. However, his attorney denied this information.

Silk Road became so popular because other services were selling drugs more or less openly. In the meantime, Silk Road was technically sophisticated, had user-friendly system and promised near-total anonymity. The authorities closed down the website when they arrested Ulbricht at a small library in San Francisco while he chatted online with a “co-operating witness”.

In addition, Ulbricht is also charged in Baltimore federal court with soliciting the murder of a former employee, who was arrested on drug charges. It is suggested that Ulbricht feared the victim would turn on him. The police claimed that Ulbricht unwittingly hired an undercover agent for the murder, which the authorities staged but never took place.

In the meantime, prosecutors in New York have charged the site operator with trying unsuccessfully to solicit the murder of a Canadian citizen who allegedly hacked into Silk Road, obtained dealers names and started blackmailing Ulbricht.

It turned out that the FBI agents have penetrated the behind-the-scenes operations of the website and obtained a list of its users and sellers. In the following days, the police in Britain, Sweden and the US arrested 8 people charged with using the service for selling drugs. For example, in Washington state, a couple was arrested on charges of selling cocaine, heroin and methamphetamine via Silk Road. The UK authorities indicated more arrests were on the way. The FBI claimed that it had copy of the contents of the website’s server, which could provide international authorities with detailed data about the website’s dealers.

Apparently, months’ worth of sales history are currently in law enforcement hands. As a result, the traceable nature of BitCoin transfers can allow the FBI to easily follow the money.

British Mobile Services Providers Face Fee Hike

According to media reports, British mobile network operators may face a 4-fold increase in license fees to rent the radio spectrum. These plans were revealed by Ofcom.

The watchdog confirmed that the new fees were in line with what other states paid. Moreover, the group believed that the UK operators had been getting off lightly for a long time. The United Kingdom raised a less-than-expected £2.34 billion in a 4G spectrum auction for airwaves in order to carry high-speed mobile broadband traffic, so it seems that Ofcom is looking to make up the shortfall.

The largest broadband providers Vodafone, Telefonica’s O2, EE and H3G pay around £64.5 million pounds altogether for using the 900 megahertz and 1800 megahertz spectrum bands. It was estimated that any changes would result in a £309 million increase.

According to Ofcom, spectrum is a valuable and finite national resource, and that is why charging for it might incentivize the optimal use of frequencies. In the meantime, the telcos can blame the UK government for the rent hike. Apparently, the government asked the watchdog to recalculate the fees to reflect “full market value”, and the latter said the new rules were expected to take effect in 2014 after a consultation period which will end in December.

The mobile companies keep reviewing the new bill, but Vodafone has already expressed its discontent after Ofcom was proposing a 430% increase in its fees. Maybe it believes that the regulator should be encouraging such private sector investment in infrastructure and new services – for example, 4G.