You are here: Home » International » News » Companies
Business Standard

Google offers $1,000 to security experts for finding bugs in Android apps

Once the vulnerability has been resolved, the researcher requests a bonus bounty from the Google Play Security

IANS  |  San Francisco 

google
The programme will evaluate each submission based on the vulnerability criteria

has launched a new bug bounty programme for security experts where the company will pay $1,000 for finding security flaws in apps and then reporting it to researchers.

"The Play Security Reward Programme recognises the contributions of security researchers who invest their time and effort in helping us make apps on Play more secure," the tech giant said on its website late on Thursday.

All Google's apps are included and developers of popular apps are invited to opt-in to the programme being run in partnership with HackerOne.

"Through the programme, we will further improve app security which will benefit developers, users and the entire Play ecosystem," the company said.

For now, the scope is limited to RCE (remote-code-execution) vulnerabilities and corresponding POCs (Proof of concepts) that work on 4.4 devices and higher.

"This translates to any RCE vulnerability that allows an attacker to run code of their choosing on a user's device without user knowledge or permission," said.

This is how it works.

Researcher identifies vulnerability within an in-scope app and reports it directly to the app's developer via their current vulnerability disclosure or bug bounty process.

App developer then works with the researcher to resolve the vulnerability.

Once the vulnerability has been resolved, the researcher requests a bonus bounty from the Play Security.

"The programme will evaluate each submission based on the vulnerability criteria. A reward of $1,000 will be rewarded for issues that meet this criterion," said.

"We are unable to issue rewards to individuals who are on US sanctions lists or who are in countries (Crimea, Cuba, Iran, North Korea, Sudan and Syria)," it added.

First Published: Fri, October 20 2017. 14:03 IST
RECOMMENDED FOR YOU