Download LetterMagic here
Called the “Google Play Security Reward” program, the new program aims to get researchers to work directly with Android app developers to find vulnerabilities.
If you help a developer squash a bug, Google will pay you $1,000 (on top of whatever bounty the third-party dev themselves might pay).
Google is tapping HackerOne to handle much of the back end for this program, from submitting reports to inviting white-hat hackers into new parts of the program as they roll out.
Here’s what we know so far:
- The program only includes a limited selection of Android apps at the moment. Not all Android apps. The list currently includes Alibaba, Dropbox, Duolingo, Headspace, LINE, Snapchat and Tinder along with “all Google-developed Android apps available on Google Play”.
- Apps must be invited into the program for now; when it eventually opens up to more apps, a rep from Google tells me it’ll be opt-in.
- Researchers will work directly with the app developer to confirm/squash vulnerabilities; once a bug is fixed, the researcher tells Google, who confirms the bug and issues the $1,000 reward. Google doesn’t want to know about the bug before it’s fixed. “This program is only for requesting bonus bounties after the original vulnerability was resolved with the app developer,” it notes.
- As with most bug bounty programs, Google is looking for a specific type of nasty issue here. Not “this icon looks funny” kind of stuff. The scope currently includes forcing an app to download/execute arbitrary code, manipulating an app’s UI to force a transaction (they mention tricking a bank app to send money without a user’s consent as an example) or forcing an app to open a webview that might be used for phishing.
Source: techcrunch.com
No comments: