Jetpack
Kotlin
Docs
News
Platform
Android Studio
Google Play
Jetpack
Kotlin
Docs
News
Platform
Android Studio
Google Play
Jetpack
Kotlin
Docs
News
More
Android Developers Blog
The latest Android and Google Play news for app and game developers.
One Year of Android Security Rewards
16 Juni 2016
Posted by Quan To, Program Manager, Android Security
A year ago
, we added
Android Security Rewards
to the long standing
Google Vulnerability Rewards Program
. We offered up to $38,000 per report that we used to fix vulnerabilities and protect Android users.
Since then, we have received over 250 qualifying vulnerability reports from researchers that have helped make Android and mobile security stronger. More than a third of them were reported in Media Server which has been
hardened in Android N
to make it more resistant to vulnerabilities.
While the program is focused on Nexus devices and has a primary goal of improving Android security, more than a quarter of the issues were reported in code that is developed and used outside of the Android Open Source Project. Fixing these kernel and device driver bugs helps improve security of the broader mobile industry (and even some non-mobile platforms).
By the Numbers
Here’s a quick rundown of the Android VRP’s first year:
We paid over $550,000 to 82 individuals. That’s an average of $2,200 per reward and $6,700 per researcher.
We paid our top researcher,
@heisecode
, $75,750 for 26 vulnerability reports.
We paid 15 researchers $10,000 or more.
There were no payouts for the top reward for a complete remote exploit chain leading to TrustZone or Verified Boot compromise.
Thank you to
those
who submitted high quality
vulnerability reports
to us last year.
Improvements to Android VRP
We’re constantly working to improve the program and today we’re making a few changes to all vulnerability reports filed after June 1, 2016.
We’re paying more!
We will now pay 33% more for a high-quality vulnerability report with proof of concept. For example, the reward for a Critical vulnerability report with a proof of concept increased from $3000 to $4000.
A high quality vulnerability report with a proof of concept, a CTS Test, or a patch will receive an additional 50% more.
We’re raising our rewards for a remote or proximal kernel exploit from $20,000 to $30,000.
A remote exploit chain or exploits leading to TrustZone or Verified Boot compromise increase from $30,000 to $50,000.
All of the changes, as well as the additional terms of the program, are explained in more detail in our
Program Rules
. If you’re interested in helping us find security vulnerabilities, take a look at
Bug Hunter University
and learn how to submit high quality vulnerability reports. Remember, the better the report, the more you’ll get paid. We also recently updated our
severity ratings
, so make sure to check those out, too.
Thank you to everyone who helped us make Android safer. Together, we made a huge investment in security research that has made Android stronger. We’re just getting started and are looking forward to doing even more in the future.
Label
Android O
Android Studio
Design
Develop
Google Play
Archive
November 2021
(4)
Oktober 2021
(15)
September 2021
(11)
Agustus 2021
(7)
Juli 2021
(15)
Juni 2021
(9)
Mei 2021
(18)
April 2021
(10)
Maret 2021
(12)
Februari 2021
(11)
Januari 2021
(3)
Desember 2020
(7)
November 2020
(7)
Oktober 2020
(7)
September 2020
(9)
Agustus 2020
(18)
Juli 2020
(18)
Juni 2020
(18)
Mei 2020
(4)
April 2020
(7)
Maret 2020
(9)
Februari 2020
(9)
Januari 2020
(3)
Desember 2019
(8)
November 2019
(12)
Oktober 2019
(11)
September 2019
(5)
Agustus 2019
(9)
Juli 2019
(8)
Juni 2019
(6)
Mei 2019
(15)
April 2019
(10)
Maret 2019
(11)
Februari 2019
(5)
Januari 2019
(6)
Desember 2018
(11)
November 2018
(9)
Oktober 2018
(13)
September 2018
(5)
Agustus 2018
(13)
Juli 2018
(9)
Juni 2018
(16)
Mei 2018
(16)
April 2018
(8)
Maret 2018
(8)
Februari 2018
(7)
Januari 2018
(9)
Desember 2017
(9)
November 2017
(13)
Oktober 2017
(14)
September 2017
(11)
Agustus 2017
(19)
Juli 2017
(11)
Juni 2017
(13)
Mei 2017
(21)
April 2017
(12)
Maret 2017
(14)
Februari 2017
(11)
Januari 2017
(12)
Desember 2016
(17)
November 2016
(16)
Oktober 2016
(9)
September 2016
(6)
Agustus 2016
(7)
Juli 2016
(12)
Juni 2016
(14)
Mei 2016
(16)
April 2016
(14)
Maret 2016
(8)
Februari 2016
(8)
Januari 2016
(9)
Desember 2015
(9)
November 2015
(13)
Oktober 2015
(19)
September 2015
(15)
Agustus 2015
(13)
Juli 2015
(9)
Juni 2015
(8)
Mei 2015
(10)
April 2015
(10)
Maret 2015
(12)
Februari 2015
(8)
Januari 2015
(3)
Desember 2014
(9)
November 2014
(13)
Oktober 2014
(11)
September 2014
(6)
Agustus 2014
(2)
Juli 2014
(9)
Juni 2014
(10)
Mei 2014
(4)
Maret 2014
(4)
Februari 2014
(3)
Januari 2014
(2)
Desember 2013
(3)
November 2013
(2)
Oktober 2013
(7)
September 2013
(2)
Agustus 2013
(5)
Juli 2013
(5)
Juni 2013
(4)
Mei 2013
(9)
April 2013
(3)
Maret 2013
(2)
Februari 2013
(3)
Januari 2013
(3)
Desember 2012
(5)
November 2012
(3)
Oktober 2012
(3)
September 2012
(1)
Agustus 2012
(1)
Juli 2012
(2)
Juni 2012
(5)
Mei 2012
(1)
April 2012
(5)
Maret 2012
(5)
Februari 2012
(5)
Januari 2012
(5)
Desember 2011
(7)
November 2011
(7)
Oktober 2011
(5)
September 2011
(5)
Agustus 2011
(3)
Juli 2011
(7)
Juni 2011
(2)
Mei 2011
(5)
April 2011
(6)
Maret 2011
(8)
Februari 2011
(8)
Januari 2011
(4)
Desember 2010
(8)
November 2010
(3)
Oktober 2010
(4)
September 2010
(7)
Agustus 2010
(6)
Juli 2010
(10)
Juni 2010
(11)
Mei 2010
(11)
April 2010
(2)
Maret 2010
(3)
Februari 2010
(2)
Januari 2010
(5)
Desember 2009
(7)
November 2009
(5)
Oktober 2009
(5)
September 2009
(8)
Agustus 2009
(2)
Juli 2009
(1)
Juni 2009
(2)
Mei 2009
(5)
April 2009
(12)
Maret 2009
(5)
Februari 2009
(8)
Januari 2009
(3)
Desember 2008
(3)
November 2008
(1)
Oktober 2008
(4)
September 2008
(6)
Agustus 2008
(4)
Juni 2008
(1)
Mei 2008
(5)
April 2008
(4)
Maret 2008
(5)
Februari 2008
(2)
Januari 2008
(5)
Desember 2007
(3)
November 2007
(5)
Feed
Newsletter
Android Developers
Google Play
Platform
Android Studio
Google Play
Jetpack
Kotlin
Docs
News
