Slashdot Mirror
Google Is Offering $200K To Hack Android Phones Using Email and A Phone Number (thenextweb.com)
Google is feeling so confident about the security of their latest Android 7.0 Nougat operating system that they're offering $200,000 to anyone who can remotely execute code on a Nexus 6P or 5X running Android 7.0. The Next Web reports: Today, Google is launching the Project Zero Security Contest and awarding over $300,000 in prizes to anyone who can hack Nexus 6P and 5X knowing only the devices' phone number and email address. To be eligible to win, contestants are required to dig up vulnerabilities that can be exploited remotely -- by sending a text message or an email, for instance. All winning participants will be invited to describe the bugs they've discovered in a short technical report that will appear on the Project Zero Blog. The winner will scoop $200,000, while the runner-up will receive $100,000. There's also another $50,000 in the prize pool for any additional winning entries.
Neat.
is that enough money to temp state actors?
LOL once more they want to give chump change for this? really.
1 million like Iphone did.
Couldn't we find another article that's longer than 4 paragraphs. The Next Web editor seems to be bored with this story by the way he glossed over the subject.
Google is feeling so confident about the security of their latest Android 7.0 Nougat operating system that they're offering $200,000 to anyone who can remotely execute code on a Nexus 6P or 5X running Android 7.0.
I suspect this has more to do with trying to proactively find any such vulnerability - and making it pay off well enough to induce the hacker to give Google the info rather than selling it to criminal or state organizations. Selling it privately might still bring in more money, but this might be enough so the hacker will say "this way I still get a good payday and also get credit for doing the right thing".
#DeleteChrome
I'd put the value of that kind of exploit north of $20M. Biggest buyer would be governments around the world.
That would be easy.
If you do it they will remotely detonate your phone battery.
Looks like the going rate is less than $100k for this kind of exploit. So Google is doing good here.
"First they came for the slanderers and i said nothing."
Will they let someone test that out On a live phone?
It would probably be less, given how few devices will run Android 7.0 in the short to medium term, and how many other Android vulnerabilities are out there to try first, making it cost very little.
Google's offering for $200K is about 10 times the going rate (again, taking into account how few devices run it, so the chances of actually running into a phone you need to crack running Android 7.0 are practically nil).
It's Apple that needs to step up their game - their $250K is a quarter of the going rate for an iOS exploit ($1M+ is the going rate). And with iOS 10 out a lot of old exploits are going away. State actors have to guard their tools very closely or a leak like the one a few weeks ago could render their multi mullion dollar business moot. That's probably why they charge so much per installation - each installation runs the risk that the vulnerabilities are found and fixed.
The organizations that would make the exploit worth $20M don't advertise their intentions to buy on public web sites.
What's the going rate for getting a legal payoff and having a lot less to worry about? If I found an exploit like that, I'd sooner trade it to Google for a Starbucks gift card than I would try and negotiate with, like, Russia. How would you even start something like that? It sounds like suicide for your criminal record, surely every government has agents posing as agents of other governments to try and poach stuff like that.
For 300k they potentially get bugs found that could cost much more if they did this internally and outside eyes may take approaches Google never thought of. Of course, given the potential value to others beside Google they may not find out about the most serious vulnerabilities because they are much more valuable than $200k; and some hackers that didn't get anything may continue to probe and find vulnerabilities to sell. State actors have no reason to reveal their secrets because those are weapons to deploy when needed. While this is good publicity getting the word out you pay market rates for vulnerabilities might work better, plus possibly forcing prices up to where it is potentially unprofitable.
I'm a consultant - I convert gibberish into cash-flow.
I don't think there is any organization that would spend $20M for this kind of exploit. You made that number up.
"First they came for the slanderers and i said nothing."
If you refer back to my original post it's not a single organization that would pay $20M. And yes, $20M is just an estimate. For support of myestimate look up how much the FBI paid for the exploit on the San Bernardino phone - it was $1.3M. And that was for a single instance, single phone.
It certainly is not related to security in the real world.
As long as users can install apps from Google Play, the phone can be compromised.
And any private network it is logged onto can likewise be hacked.
Wouldn't a hack via SS7 qualify? It's certainly a remote attack.
Script kiddies, start your engines...........
Does it count if you phone people offering an upgrade to their phone, then email them a file and advise them to open it on their phone?
Guarantee me the 200.000 or i will report to someone else. What a cheap way to get all the exploits for a fixed price ...
The problem to selling stuff to state actors such as governments is they may get a refund by buying it off you, and then suddenly you've committed suicide via 10 shots to the back, and then tieing yourself in a bag and falling into a river.
And iOS.
There's a reason there's a backlog of over 600+ iPhones in the LEO community they'tr trying to break, and under 20 Androids. And it's not because criminals prefer iPhones to Androids.
iOS vulnerabilities are much harder to come by and they often require chaining together multiple ones just to even get them to jailbreak. And we're talking about phones where the user willingly lets the hack happen (jailbreak). Ones that try to start from a locked phone are much harder. Coupled with full disk encryption that's standard and enabled since the beginning and it gets a lot more difficult, even more so in modern phones with a secure enclave that keeps secrets from hitting flash storage (i.e., disk key).
The problem with Android is the defaults are insecure and most people leave it at the defaults, making it trivially easy to get at the data.