After paying out more than half a million dollars, Google has decided to increase the rewards offered to researchers who report vulnerabilities through the company’s Android bug bounty program.
The Android Security Rewards program was launched exactly one year ago, with up to $38,000 offered per submission. Over the past year, 82 researchers reported more than 250 flaws for which they received a total of over $550,000 from Google.
The top researcher, Peter Pi (@heisecode) of Trend Micro, received over $75,000 for 26 vulnerability reports. While more than a dozen experts received $10,000 or more, no one managed to earn the top reward, which Google is offering for a complete remote exploit chain that leads to a compromise of TrustZone or Verified Boot.
Google announced on Thursday that it’s making some improvements to its Android Security Rewards program. The search giant says it has increased rewards by 33 percent for high quality vulnerability reports starting with June 1. For instance, researchers can now earn $4,000 instead of $3,000 for a critical vulnerability report that is accompanied by a proof-of-concept (PoC).
The payout has increased by 50 percent for high quality vulnerability reports that include not only a PoC, but also a CTS test or a patch. Rewards for remote or proximal kernel exploits have been increased from $20,000 to $30,000.
The top reward, the one offered for a remote exploit chain that leads to a TrustZone or Verified Boot compromise, has increased from $30,000 to $50,000.
“While the program is focused on Nexus devices and has a primary goal of improving Android security, more than a quarter of the issues were reported in code that is developed and used outside of the Android Open Source Project. Fixing these kernel and device driver bugs helps improve security of the broader mobile industry (and even some non-mobile platforms),” explained Quan To, security program manager at Google.
Since many of the reported Android vulnerabilities affected Mediaserver’s libstagefright library, Google says it has hardened the component in Android N, the next major version of the mobile operating system.
Related Reading: Google Pays $25,000 Reward for Critical Chrome Flaw
Related Reading: Google Offers $100,000 for Chromebook Hack
Related Reading: Google Patches Serious Account Recovery Vulnerabilities
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
Latest News
- CISA, NSA Issue Guidance for IAM Administrators
- Analysis: SEC Cybersecurity Proposals and Biden’s National Cybersecurity Strategy
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Cisco Patches High-Severity Vulnerabilities in IOS Software
- ‘Nexus’ Android Trojan Targets 450 Financial Applications
- Tackling the Challenge of Actionable Intelligence Through Context
- Dole Says Employee Information Compromised in Ransomware Attack
- Backslash Snags $8M Seed Financing for AppSec Tech
