Google Increases Android Bug Rewards
Written by Kay Ewbank   
Thursday, 23 June 2016

Google is increasing the amount it pays as rewards for finding bugs and security vulnerabilities in Android with a new upper limit of $50,000

Android Security Rewards were introduced a year ago, joining the Google Vulnerability Rewards Program. The initial offer was of up to $38,000 per report that Google could use to fix vulnerabilities and protect Android users.

androidlogo

According to a post on the Android Developers blog, during the year Google has received 250 qualifying vulnerability reports. More than a third of the problems were reported in Media Server, and this has now been hardened in Android N to make it more resistant to vulnerabilities.

bug200
The blog post says that while the program is mainly aimed at Nexus devices and designed to improve Android security, a substantial group - more than a quarter - of the problems were reported in code developed and used outside of the Android Open Source Project, such as device driver and kernel bugs.

The average reward paid out over the year was $2,200 per reward. 82 people received rewards, with each receiving an average of $6,700. 

The highest amount paid to a single person was $75,750 for 26 vulnerability reports, and 15 researchers were paid $10,000 or more. There were no payouts for the top reward for a complete remote exploit chain leading to TrustZone or Verified Boot compromise.

The changes to the program mean high quality vulnerability reports with proof of concept will receive 33% more, so that the reward for a Critical vulnerability report with a proof of concept has increased from $3000 to $4000.

A high quality vulnerability report with a proof of concept, a CTS Test, or a patch will receive an additional 50%. The reward for a remote or proximal kernel exploit has gone up from $20,000 to $30,000, and the reward for a remote exploit chain or exploits leading to TrustZone or Verified Boot compromise has increased from $30,000 to $50,000.

bug200

More Information

Android Developers Blog

Bug Report Program Rules

Bug Hunter University

Related Articles

New Android Bug Bounty Scheme

Android Security Hole More Stupid Error Than Defect

Android N Developer Preview

 

To be informed about new articles on I Programmer, sign up for our weekly newsletter,subscribe to the RSS feed and follow us on, Twitter, FacebookGoogle+ or Linkedin

 

Banner


TornadoInsight Brings The Power Of TornadoVM Inside Intellij
22/02/2024

TornadoInsight is plugin for Jetbrain's popular Intellij IDE for Java developers, that makes working with TornadoVM a much smoother experience.



Generative AI Training For All On Coursera
04/03/2024

Generative AI is on the loose, getting into business and commerce as well as into art, poetry and coding. Already useful, it  will become ever more useful as long as we use it properly. Coursera  [ ... ]


More News

 

raspberry pi books

 

Comments




or email your comment to: comments@i-programmer.info

 

Last Updated ( Thursday, 23 June 2016 )