Bounty Bucks For Android

Posted on  by 

Researchers submitting reports including a proof of concept via Android security rewards program for reports originally submitted to third party bug bounty programs may qualify for a $1000 bonus. Google has announced a potential top payment of $1M as part of its Android bug bounty program. Bug hunters are encouraged to search for a particular kind of security issue linked to the Pixel.

  1. Bounty Bucks For Android Cell Phones
  2. Bounty Bucks For Android

Google’s security rewards program, which has handed out millions of dollars to researchers who found bugs in Chrome and other Google products since 2010, has now been extended to include the largest member of its product family: the Android operating system.

Android security engineer Jon Larimer said:

Today, we're expanding our program to include researchers that will find, fix, and prevent vulnerabilities on Android, specifically.

Google says the new Android Security Rewards Program will only cover vulnerabilities affecting the latest version of Android running on its own Nexus 6 smartphone and Nexus 9 tablet for now, but the list of eligible devices will change over time.

I hope Google will include older versions of the Android operating system or, better yet, encourage its partners to push out more timely updates in the future, otherwise any security benefits derived from this bug bounty program will only be enjoyed by a minority of customers.

To claim a bounty under the new program, researchers will need to discover bugs on one or both of the eligible devices that are not already covered by any of Google’s other reward programs with the rules stating:

Eligible bugs include those in AOSP code, OEM code (libraries and drivers), the kernel, and the TrustZone OS and modules. Vulnerabilities in other non-Android code, such as the code that runs in chipset firmware, may be eligible if they impact the security of the Android OS.

Rewards

Larimer said the program will pay out larger rewards to those who go beyond simply discovering a vulnerability, handing over larger piles of cash in return for tests and patches that will help to make the entire ecosystem more robust.

The largest possible rewards will go “to researchers that demonstrate how to work around Android’s platform security features, like ASLR, NX, and the sandboxing that is designed to prevent exploitation and protect users.”

Researchers submitting a bug can expect to earn anything up to $2000 (about £1200), depending on its severity level. By also submitting test cases, unit cases and AOSP (Android Open Source Project) patches, that reward could rise to as much as $8000 (about £5000).

If an exploit is able to compromise the kernel, TEE (TrustZone) or the Verified Boot process, the potential bounty could rise to between $20,000 and $30,000 (about £12,000 – £19,000).

Google suggests a reasonable disclosure deadline of 90 days, which matches the timescale its own Project Zero team adheres to when reporting Android bugs. The company says any researcher publicly revealing new bugs before the 90-day period is up will be unlikely to receive a reward, but it will consider each case on its own merits.

Non-AOSP issues will continue to be dealt with by the Google Vulnerability Reward Program while vulnerabilities in Chrome will be handled by the Chrome Rewards program.

Vulnerabilities which resolve around tricking the user, or eliciting complex interaction, such as phishing attacks, tap-jacking or a reliance on unlikely configuration changes are unlikely to qualify for a reward. Bugs that do nothing more than cause an app to crash will also be excluded from the program.

Android, Larimer said, will continue to participate in Google’s Patch Rewards Program, which pays for contributions that improve the security of Android (as well as other open source projects). Google will also continue to support mobile pwn2own, as it has done for the last 2 years, as well as other competitions designed to find vulnerabilities in Android.

Wrapping up, Larimer said:

Open security research is a key strength of the Android platform. The more security research that's focused on Android, the stronger it will become.

Image of Android courtesy of George Dolgikh / Shutterstock.com .

Below is a curated list of Bounty Programs by reputable companies

1) Intel

Intel's bounty program mainly targets the company's hardware, firmware, and software.

Limitations: It does not include recent acquisitions, the company's web infrastructure, third-party products, or anything relating to McAfee.

Minimum Payout: Intel offers a minimum amount of $500 for finding bugs in their system.

Maximum Payout: The Company pays $30,000 maximum for detecting critical bugs.

Bounty Link:https://security-center.intel.com/BugBountyProgram.aspx

2) Yahoo

Yahoo has its dedicated team that accepts vulnerability reports from security researchers and ethical hackers.

Limitations: The Company does not offer any reward for finding bugs in yahoo.net, Yahoo 7 Yahoo Japan, Onwander and Yahoo operated Word press blogs.

Minimum Payout: There is no set limit on Yahoo for minimum payout.

Maximum Payout: Yahoo can pay $15000 for detecting important bugs in their system.

Bounty Link:https://safety.yahoo.com/Security/REPORTING-ISSUES.html

3) Snapchat

Snapchat security team reviews all vulnerability reports and acts upon them by responsible disclosure. The company, we will acknowledge your submission within 30 days.

Minimum Payout: Snapchat will pay minimum $2000.

Maximum Payout: Maximum they will pay is $15,000.

Bounty Link:https://support.snapchat.com/en-US/i-need-help

4) Cisco

Cisco encourages individuals or organization that are experiencing a product security issue to report them to the company.

Minimum Payout: Cisco's minimum payout amount is $100.

Maximum Payout: Company will give maximum $2,500 to finding serious vulnerabilities.

Bounty Link: https://tools.cisco.com/security/center/resources/security_vulnerability_policy.html

5) Dropbox

Dropbox bounty program allows security researchers to report bugs and vulnerabilities on the third party service HackerOne.

Minimum Payout: The minimum amount paid is $12,167.

Maximum Payout: The maximum amount offered is $32,768.

Bounty Link:https://help.dropbox.com/accounts-billing/security/how-security-works

6) Apple

When Apple first launched its bug bounty program it allowed just 24 security researchers. The framework then expanded to include more bug bounty hunters.

The company will pay $100,000 to those who can extract data protected by Apple's Secure Enclave technology.

Minimum Payout: There is no limited amount fixed by Apple Inc.

Maximum payout: The highest bounty given by Apple is $200,000 for security issues affecting its firmware.

Bounty Link:https://support.apple.com/en-in/HT201220

7) Facebook

Under Facebook's bug bounty program users can report a security issue on Facebook, Instagram, Atlas, WhatsApp, etc.

Limitations: There are a few security issues that the social networking platform considers out-of-bounds.

Minimum Payout: Facebook will pay a minimum of $500 for a disclosed vulnerability.

Maximum Payout: There is no upper limit fixed by Facebook for the Payout.

Bounty Link:https://www.facebook.com/whitehat/

8) Google

Bounty Bucks For Android Cell Phones

Every content in the .google.com, .blogger, youtube.com are open for Google's vulnerability rewards program.

Limitations: This bounty program only covers design and implementation issues.

Minimum Payout: Google will pay minimum $300 for finding security threads.

Maximum Payout: Google will pay the highest bounty of $31.337 for normal Google applications.

Bounty Link:https://www.google.com/about/appsecurity/reward-program/

9) Quora

Quora offers Bug Bounty program to all users and researchers to find and report security vulnerabilities.

Minimum Payout: Quora will pay minimum $100 for finding vulnerabilities on their site.

Maximum Payout: Maximum payout offered by this site is $7000.

Bounty Link: https://engineering.quora.com/Security-Bug-Bounty-Program

10) Mozilla

Mozilla rewards for vulnerability discoveries by ethical hackers and security researchers.

Limitations: The bounty is offered only for bugs in Mozilla services, such as Firefox, Thunderbird and other related applications and services.

Minimum Payout: Minium amount given by Firefox is $500.

Maximum Payout: The Company is paying a maximum of $5000.

Bounty Link:https://www.mozilla.org/en-US/security/bug-bounty/

11) Microsoft

Microsoft's current bug bounty program was officially launched on 23rd September 2014 and deals only with Online Services.

Limitations: The bounty reward is only given for the critical and important vulnerabilities.

Minimum Payout: Microsoft ready to pay $15,000 for finding critical bugs.

Maximum Payout: Maximum amount can be $250,000.

Bounty Link:https://technet.microsoft.com/en-us/library/dn425036.aspx

12) OpenSSL

OpenSSL bounty allows you to report vulnerabilities using secure email (PGP Key). You can also report vulnerabilities to the OpenSSL Management Committee.

Minimum Payout: The Company pays minimum bounty rewards of $500.

Maximum Payout: The highest amount given by the company is $5000.

Bounty Link:https://www.openssl.org/news/vulnerabilities.html

13) Vimeo

Vimeo welcomes any security vulnerability reporting in their products as the company pays good rewards to that person.

Minimum payout: The Company will pay minimum $500

Maximum Payout: The maximum amount paid by this company is $5000.

Bounty Link:https://vimeo.com/about/security

14) Apache

Apache encourages ethical hackers to report security vulnerabilities to one of their private security mailing lists.

Minimum payout: The minimum pay out amount given by Apache is $500.

Maximum Payout: This Company can maximum give a reward of $3000.

Bounty Link:https://www.apache.org/security/

15) Twitter

Twitter allows security researchers and experts about possible security vulnerabilities in their services. The company encourages people to find bugs.

Minimum Payout: Twitter is paying minimum $140 amount.

Maximum Payout: Maximum amount pay by the company is $15000.

Bounty Link:https://support.twitter.com/articles/477159

16) Avast

Avast bounty program rewards ethical hackers and security researchers to report Remote code execution, Local privilege escalation, DOS, scanner bypass amongst other issues.

Minimum Payout: Avast can pay you the minimum amount of $400.

Maximum Payout: The maximum amount offered by the company is $10,000.

Bounty Link:https://www.avast.com/bug-bounty

17) Paypal

Payment gateway service Paypal also offers bug bounty programs for security researchers.

Limitations:

Vulnerabilities dependent upon social engineering techniques, Host Header

Download bounty bucks for android

Denial of service (DOS), User defined payload, Content spoofing without embedded links/HTM and Vulnerabilities which require a jailbroken mobile device, etc.

Minimum Payout: Paypal can pay minimum $50 for finding security vulnerabilities in their system.

Maximum Payout: Maximum payout amount given by Paypal is $10000.

Bounty Link:https://hackerone.com/paypal

18) GitHub

GitHub's runs bug bounty program since 2013. Every successful participant earned points for their vulnerability submissions depending on the severity.

Limitation: The security researcher will receive that bounty only if they respect users' data and don't exploit any issue to produce an attack that could harm the integrity of GitHub's services or information.

Minimum Payout: Github pays a minimum amount of $200 for finding bugs.

Maximum Payout: Github can pay $10000 for finding critical bugs.

Bounty Link:https://bounty.github.com/

19) Uber

The vulnerability rewards program of Uber primarily focused on protecting the data of users and its employees.

Minimum Payout: There is no predetermined minimum amount.

Maximum Payout: Uber will pay you $10,000 for finding critical bug issues.

Bounty Link:https://eng.uber.com/bug-bounty-map/

20) Magento

Magneto bounty program allows you to report security vulnerabilities in Magneto software or websites.

Limitations:

Following security research is not eligible for the bounty

  • Potential or actual denial of service of Magento applications and systems.
  • Use of an exploit to view data without authorization.
  • Automated/scripted testing of web forms

Minimum Payout: Minimum payout amount for this is bounty program is $100.

Maximum Payout: Magento is paying maximum $10,000 for finding critical bugs.

Bounty Link:https://magento.com/security

21) Perl

Perl is also running bug bounty programs. If someone found a security vulnerability in Perl, they can contact the company.

Minimum Payout: The Company pays a minimum amount of $500.

Maximum Payout: The highest amount given by Perl is $1500.

Bounty Link:http://perldoc.perl.org/perlsec.html#SECURITY-VULNERABILITY-CONTACT-INFORMATION

22) PHP

PHP allows ethical hackers to find a bug in their site.

Limitations: You need to check the list of already finding bugs. If you not follow this instruction your bug is not considered.

Maximum Payout: Minimum Payout amount is $500.

Minimum Payout: Maximum $1500 is given by PHP for searching important bugs.

Bounty Link:https://bugs.php.net/report.php?bug_type=Security

23) Starbucks

Starbucks runs bug Bounty program to protect their customers. They encourage to find malicious activity in their networks, web and mobile applications policies.

Minimum Payout: The minimum amount paid by Starbucks $100.

Maximum Payout: The maximum amount goes up to $4000.

Bounty Link:https://www.starbucks.com/whitehat

24) AT&T

AT&T also has its bug hunting channel. Developers and security experts can research the various platforms like websites, APIs, and mobile applications.

Minimum Payout: Minimum Amount Paid by them is $500.

Maximum Payout: There is no such upper limit for payout.

Bounty Link:https://bugbounty.att.com/

25) LinkedIn

The LinkedIn welcomes Individual researchers who contribute their expertise and time to find bugs.

The company will reward you, but neither minimum nor maximum amount is a fix for this purpose.

Bounty Link:https://security.linkedin.com/posts/2015/private-bug-bounty-program

Bounty Bucks For Android

26) Paytm

Paytm invites independent security groups or individual researchers to study it across all platforms

Limitations:

  • Reports that state that software is out of date/vulnerable without a 'Proof of Concept.'
  • XSS issues that affect only outdated browsers.
  • Stack traces that disclose information.
  • Any fraud issues

Minimum Payout: The Company will pay minimum $15 for finding bugs.

Maximum Payout: This company does not fix the upper limit.

Bounty Link:https://paytm.com/offer/bug-bounty/

27) Shopify

Shopify's Whitehat program rewards security researchers for finding severe security vulnerabilities

Minimum Payout: The minimum amount paid by the Shopify is $500.

Maximum Payout: There is no fix upper limit for paying the bounty.

Bounty Link:https://www.shopify.in/whitehat

28) Word Press

WordPress also welcomes security researchers to report about the bugs that they have found.

Minimum Payout: WordPress Pays $150 minimum for reporting bugs on their site.

Maximum Payout: The Company does not fix a maximum limit to pay as bounty.

Bounty Link:https://make.wordpress.org/core/handbook/testing/reporting-bugs/

29) Zomato

Zomato helps security researcher to identified security-related issues with company's website or apps.

Minimum Payout: Zomato will pay minimum $1000 for finding important bugs.

Maximum Payout: There is no maximum fix amount.

Bounty Link:https://www.zomato.com/security

30) Tor Project

Tor Project's bug bounty program covers two of its core services: its network daemon and browser.

Limitation: OpenSSL applications are excluded from this scope.

Minimum Payout: The minimum amount paid by them is $100.

Maximum Payout: The Company will pay you maximum $4000.

(No link available) Bounty Link:This email address is being protected from spambots. You need JavaScript enabled to view it.

31) Hackerone

HackerOne is one of the biggest vulnerability coordination and bug bounty platform. It helps companies to protect their consumer data by working with the global research community for finding most relevant security issues. Many known companies like Yahoo, Shopify, PHP, Google, Snapchat, and Wink are taking the service of this website to give a reward to security researchers and ethical hackers.

Bounty Link:https://hackerone.com/bug-bounty-programs

32) Bugcrowd

A powerful platform connecting the global security researcher community to the security market. This site aims to provide right mix and type of researcher suited according to the specific website to their worldwide clients. The hackers just need to select their reports on this site, and if they can detect right bugs, the specific company will pay the amount to that person.

Bounty Link: https://www.bugcrowd.com/bug-bounty-list/

Coments are closed