It pays to be a hacker. Sometimes. At least that is what Google is telling all geeks out there who spent a lot of time hitting away at their computer keyboards. All in a bid to hack into programs or websites. Google’s advice to them in a nutshell is this, you can become really rich by becoming a white hat hacker of Google and Android softwares.
Two days ago, Google announced that it would increase the money paid out in its Android bugs bounty program by a decent 33%. This is to encourage them to work harder in finding vulnerabilities in Android. It was just a year ago that Google extended bugs bounty program to include devices powered by Android OS. We are talking devices like the Nexus series of phones here.
The new announcement also revealed how much Google had paid out to hackers since the program started. The Amount stands at a little over half a million dollars. $550 million to be precise. Paid out to 82 hackers (or security experts to be politically correct). A breakdown of that figure show that an average of $2000 was paid as rewards to individuals who found and reported vulnerabilities in Google products over the last one year. The report confirms that it is better to be a researcher than a hacker. Though, the line between the two is very blurred. Researchers, over the same period, got an average of $6700. As a Hacker or security researcher, you can increase you pay by almost 50% if your report on the glitches also include the solution to the problem. That is, you need to show ‘proof of concept’ and ‘proposed patch’.
The new changes would come into effect from the 1st of June. Here is how the announcement was made in a blog post by the Program Manager, Android security, Quan To;
A year ago, we added Android Security Rewards to the long standing Google Vulnerability Rewards Program. We offered up to $38,000 per report that we used to fix vulnerabilities and protect Android users.
Since then, we have received over 250 qualifying vulnerability reports from researchers that have helped make Android and mobile security stronger. More than a third of them were reported in Media Server which has been hardened in Android N to make it more resistant to vulnerabilities.
While the program is focused on Nexus devices and has a primary goal of improving Android security, more than a quarter of the issues were reported in code that is developed and used outside of the Android Open Source Project. Fixing these kernel and device driver bugs helps improve security of the broader mobile industry (and even some non-mobile platforms).
Thank you to everyone who helped us make Android safer. Together, we made a huge investment in security research that has made Android stronger. We’re just getting started and are looking forward to doing even more in the future.”
Checking out the list of the top earners over the last one year made interesting reading. Google received more than 250 vulnerability reports which qualified for the top prizes. The highest earner over the last one year earned about $76 000. He must have being very prolific because he churned out 26 reports to get to that amount. That is a nice slice of money to corner if you are living in a third world country I must confess. However, it is not that easy as it sounds to get the bugs bounty reward money. The number of security experts that got $10000 or more stood at just 15.
Going forward though, it is very likely it is going to be harder for bugs hunters to make money from the program. Because, of the 256 reports, more than 30% were bug reports on Android Media Server Component. The latest Android OS, Android N, coming out later in the year had that loophole fixed.
The bugs bounty program is not restricted to Google alone. Most tech companies have such a program in place to help them improve the performance and security of their products and services. In march, it was reported that Facebook paid a 10 year old $10000 for being able to spot a flaw in Instagram. Another white hat hacker from India was paid $15000 in the same month by Facebook’s bug bounty program. He discovered a flaw that made it possible for anyone with the knowledge to access any Facebook account.
photo credit: dailytech.com; npr.com