Netflix has paid out more than $1 million for vulnerabilities found in its systems and products since the launch of its bug bounty program in 2016.
The streaming giant announced Tuesday that more than 5,600 researchers have contributed to its program, submitting nearly 8,000 unique reports . Bounties have been paid for 845 vulnerabilities, more than a quarter of which were rated “critical” or “high severity.”
Read also: Netflix: The 5 new games coming in May!
When Netflix launched its public bug bounty program in 2018, it partnered with Bugcrowd to host and manage the initiative. The company has now announced that its program has been moved to the HackerOne platform.
With this move, Netflix promises improved categorization, increased bounty levels, expanded scope ,exclusive private programs, and efficient feedback loops for researchers.
Content authorization issues , such as authorization reversal and private key acquisition, can net researchers anywhere from $300 to $5,000.
Critical vulnerabilities affecting Netflix can earn bug bounty hunters up to $20,000. Flaws affecting corporate assets can earn researchers up to $10,000. The bug bounty program also covers mobile apps.
Recently, a researcher revealed that vulnerabilities in Microsoft's PlayReady content access and protection technology can be exploited to illegally download movies from popular streaming services , such as Netflix .
The streaming service did not respond to SecurityWeek's request for comment when the investigation came to light.
See more: The Apple TV+, Netflix and Peacock bundle at a discounted price
It's unclear whether the PlayReady attack would qualify for Netflix's bug bounty program. However, the researcher who discovered the PlayReady vulnerabilities, Adam Gowdiak of Poland-based AG Security Research, argued that — given the widespread impact and effort involved — his research is worth far more than what Microsoft and other affected companies are willing to offer through bug bounty programs.
Source: securityweek
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
