Atticusblog
Android
Found a bug in Android? Google will pay you up to $40,000 to tell it

Google will begin to pay protection researchers who discover insects in its Android devices a reward of up to $40,000 (£25, six hundred), inside the first extension of its computer virus bounty program to the cell operating device. The company…

Google will begin to pay protection researchers who discover insects in its Android devices a reward of up to $40,000 (£25, six hundred), inside the first extension of its computer virus bounty program to the cell operating device.

The company has also announced a brand new program to ensure the security of 0.33-party software on the Android OS by way of nudging developers to stop using programming libraries that are acknowledged to be out-of-date in their applications.

“We see cell becoming arguably the maximum essential way people hook up with the net,” said Google’s Adrian Ludwig, the lead of Android safety. “We’re seeing it supplying two-factor authentication, as well, and the basis of trust within the manner that users have interaction.”

 bug in Android
And yet presently, “most security research continues to be targeted on legacy structures. We’re trying to move that, by incentivizing safety researchers to cognizance their strength on cell.” the brand new scheme might be referred to as Android protection Rewards, and follows the success of a comparable program for Google’s Chrome net browser. In 2014, the company paid out greater than $1.5m to protect researchers.

The choice to scan Android apps for software libraries that could pose a protection risk became taken a year ago, Ludwig says, and will now be rolled out beyond its “experimental” introduction. “As part of the scanning of apps, we don’t simply search for deliberately awful behavior anymore: we’re additionally looking for mistakes.”

Ludwig’s obvious instance is OpenSSL, the open-source encryption library that changed into at the coronary heart of 2014’s Heartbleed vulnerability.

“An, in reality, apparent example of what we’re searching out for: including a version of OpenSSL that’s an antique version. Starting about a year in the past, we started our scanning apps, and notifying builders if they have made that kind of mistake,” Ludwig said Stump Blog.

“Our goal is to get to the point wherein there’s a common baseline. We need to put structures in location to help builders update their apps, so the fine of all apps rises.”

Developers who need to assert Google’s worm bounty might be required to show vulnerabilities affecting the company’s shipping Nexus gadgets, the Nexus 6 and Nexus 9 (as a result of the fragmentation of the Android marketplace, Google can’t verify whether or know not insects affecting other Android gadgets are the fault of the working machine or producer additions). The rewards are on a sliding scale, from $500 for a minor worm provided and not using a more painting apart from identification, all the manner to $38,000 for an extreme vulnerability supplied along with a proof-of-concept faraway exploit and a patch to restoration the difficulty. “Our aim is that this can be a full-time study and a completely well-paid opportunity,” says Ludwig.

A separate Google protection scheme, assignment 0, has earned the company a minor amount of controversy for its practice of releasing proof-of-concept exploits for other businesses’ gadgets. The task ambitions to identify formerly-unknown vulnerabilities and then reveal them to producers with a ninety-day time restriction for solving them. If no fix is impending, the organization will (and has) release the assault publicly to spur businesses into dashing up their protection patches.

RELATED ARTICLES :

But the company practices what it preaches: Ludwig says that Android vulnerabilities are also sought out by using venture zero. “If task zero identifies an issue, we’re given a deadline, and we function inside that deadline, similar to everybody else. We haven’t but ignored a deadline.

“We surely consider in making manufacturers reply speedy, all the one’s events have to be responding quickly.”

About the author

Related Posts