Google Online Security Blog: One Year of Android Security Rewards

Security Blog

The latest news and insights from Google on security and safety on the Internet

One Year of Android Security Rewards

16 de junio de 2016

Posted by Quan To, Program Manager, Android SecurityA year agoAndroid Security RewardsGoogle Vulnerability Rewards Programhardened in Android NBy the Numbers

We paid over $550,000 to 82 individuals. That’s an average of $2,200 per reward and $6,700 per researcher.

We paid our top researcher, @heisecode, $75,750 for 26 vulnerability reports.

We paid 15 researchers $10,000 or more.

There were no payouts for the top reward for a complete remote exploit chain leading to TrustZone or Verified Boot compromise.

Thank you to those who submitted high quality vulnerability reports to us last year.

Improvements to Android VRP
We’re constantly working to improve the program and today we’re making a few changes to all vulnerability reports filed after June 1, 2016.
We’re paying more!

We will now pay 33% more for a high-quality vulnerability report with proof of concept. For example, the reward for a Critical vulnerability report with a proof of concept increased from $3000 to $4000.
A high quality vulnerability report with a proof of concept, a CTS Test, or a patch will receive an additional 50% more.
We’re raising our rewards for a remote or proximal kernel exploit from $20,000 to $30,000.
A remote exploit chain or exploits leading to TrustZone or Verified Boot compromise increase from $30,000 to $50,000.

All of the changes, as well as the additional terms of the program, are explained in more detail in our Program Rules. If you’re interested in helping us find security vulnerabilities, take a look at Bug Hunter University and learn how to submit high quality vulnerability reports. Remember, the better the report, the more you’ll get paid. We also recently updated our severity ratings, so make sure to check those out, too.

Thank you to everyone who helped us make Android safer. Together, we made a huge investment in security research that has made Android stronger. We’re just getting started and are looking forward to doing even more in the future.

Google

No hay comentarios :

Publicar un comentario

Feed

Give us feedback in our Product Forums.

Google
Privacy
Terms

Security Blog

One Year of Android Security Rewards

No hay comentarios :

Etiquetas

Archive

Feed