Security in the mobile space is critical. With billions of users out there, app and operating system developers must work together to provide a robust experience against increasingly creative and malicious campaigns. At its latest Playtime event, Google announced the Google Play Security Reward program, under which it promises an extra payment of $1,000 to anyone who finds vulnerabilities in some of the most important apps in the Android ecosystem, including Snapchat, Tinder, and Dropbox.
There are hardly any doubts left: One of the best ways (if not "the best") to stimulate the search and detection of bugs in essential software is to offer rewards that are worthwhile for those involved. The most important discoveries are usually made by companies devoted entirely to computer security, but the effort of independent researchers is fundamental when it comes to protecting our favorite programs and operating systems. In the case of Android, its current scale demands specific actions, and one of them is what Google announced during the official Playtime event last week.
The Mountain View giant decided to join forces with HackerOne to launch the Google Play Security Reward Program, which promises a reward of $1,000 for each discovered vulnerability. The mechanism works like this: The researcher finds a bug in one of the participating apps and reports it to its developers through official channels. Both parties work to fix the problem, and once it is marked as fixed, Google makes the payment. Mountain View is not interested in knowing about the bug: The program is limited to requesting special bonuses, although it carries several rules. One of them is that it only accepts vulnerabilities that enable remote code execution with the corresponding proof of concept on devices running Android 4.4 or higher.
Which are the apps to investigate? For now there are eight: Alibaba, Duolingo, Dropbox, Headspace, Line, Snapchat, Tinder, and the Mail.ru service. As far as we have been able to verify, only entries fixed within 90 days will qualify. In other words, start hacking! There may be $1,000 with your name on it waiting in one of those apps.
