Attacks/Breaches

10/23/2017
02:29 PM
50%
50%

Google Play Bug Bounty Program Debuts

Google teams up with HackerOne to create the Google Play Security Reward Program.

Google has teamed up with HackerOne to launch the Google Play Security Reward Program.

Top Google Play application developers that have opted into the program will be listed on the Google Play Security Reward program page, which currently includes such apps as Dropbox, Tinder, Snapchat, and others. Google is also including some of its own apps in the program.

Independent security researchers are required to report the vulnerability to the app developer, who then works with the researcher to resolve the flaw. After app maker pays the researcher his or her bounty and fixes the vulnerability, Google will provide the researcher an additional $1,000 bonus award.

Google already has public bug bounty programs Google Vulnerability Reward Program (VRP), Android Rewards, and Chrome Rewards in place. Under the VRP program, independent security researchers are paid anywhere from $100 to $31,337 for finding vulnerabilities in Google-developed apps, extensions, some of its hardware devices like OnHub and Nest, and on Google-owned Web properties. 

Read more about the Google Play Security Reward Program here.

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
10/25/2017 | 6:55:35 AM
Bug Bounty Programs
Bug Bounty Programs are a great idea because it provides incentive for individuals with no vested interested to try and white-hat hack into applications for which they have no vested interest. It would be nice to see this premise expanded more organizations. Typcially what you will find is the amount payable for a bounty will be much less than the amount you would pay for a malicious entity exploiting the same flaw.
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I'm not sure I like this top down management approach!"
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17321
PUBLISHED: 2018-09-22
An issue was discovered in SeaCMS 6.64. XSS exists in admin_datarelate.php via the time or maxHit parameter in a dorandomset action.
CVE-2018-17322
PUBLISHED: 2018-09-22
Cross-site scripting (XSS) vulnerability in index.php/index/category/index in YUNUCMS 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the area parameter.
CVE-2018-14889
PUBLISHED: 2018-09-21
CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability.
CVE-2018-14890
PUBLISHED: 2018-09-21
Vectra Networks Cognito Brain and Sensor before 4.2 contains a cross-site scripting (XSS) vulnerability in the Web Management Console.
CVE-2018-14891
PUBLISHED: 2018-09-21
Management Console in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local privilege escalation vulnerability.