Google Offers $1,000 Bounties For Hacking Dropbox, Tinder, Snapchat, and Others (mashable.com)

← Back to Stories (view on slashdot.org)

Google Offers $1,000 Bounties For Hacking Dropbox, Tinder, Snapchat, and Others (mashable.com)

Posted by EditorDavid on Saturday October 21, 2017 @05:34AM from the hacks-for-hire dept.

An anonymous reader quotes Mashable: Google, in collaboration with bug bounty platform HackerOne, has launched the Google Play Security Reward Program, which promises $1,000 to anyone who can identify security vulnerabilities in participating Google Play apps. Thirteen apps are currently participating, including Tinder, Duolingo, Dropbox, Snapchat, and Headspace... If you find a security vulnerability in one of the participating apps, you can report that vulnerability to the developer, and work with them to fix it. When the problem has been resolved, the Android Security team will pay you $1,000 as a reward, on top of any reward you get from the app developer. Google will be collecting data on the vulnerabilities and sharing it (anonymized) with other developers who may be exposed to the same problems. For HackerOne, it's about attracting more and better participants in bounty programs.

39 comments

Min score:

Reason:

Sort:

$1000? Convoluted. by Anonymous Coward · 2017-10-21 05:44 · Score: 0

I can get peanuts at the grocery store.
1. Re:$1000? Convoluted. by Anonymous Coward · 2017-10-21 05:50 · Score: 0
  
  How fat do you like your cashews?
Not enough by duke_cheetah2003 · 2017-10-21 05:45 · Score: 4, Interesting

This is not an acceptable 'reward' for the painstaking effort of analysis of any particular application for security flaws.
If you want to crowd source your QA, you're going to need to pay a much heftier bounty. I'm thinking 5 or 6 digits to make it worth someone's effort. And also, I think criminals will be paying a lot more than your piddly $1000 for juicy exploits. And as long as criminals pay more than you do, guess who's getting the sploits?
I personally think the entire concept of bounties and crowd sourcing your QA is utter stupidity and pretty frickin lazy and irresponsible. Hire a real QA department, pay some salaries for people to hunt this crap down, rather than paying one lucky fuck while every one else trying to find sploits gets zero. Total bullshit. Get a QA department.
1. Re: Not enough by Anonymous Coward · 2017-10-21 06:02 · Score: 0
  
  They keep doing this because it works, there are enough teenagers and third world workers that get excited about 1000 dollars and/or Google bug finding on their resume.
  Save your money because tech is a race to the bottom.
2. Re:Not enough by Anonymous Coward · 2017-10-21 06:05 · Score: 0
  
  I personally think the entire concept of bounties and crowd sourcing your QA is utter stupidity and pretty frickin lazy and irresponsible. Hire a real QA department, pay some salaries for people to hunt this crap down, rather than paying one lucky fuck while every one else trying to find sploits gets zero. Total bullshit. Get a QA department.
  +1
3. Re: Not enough by Anonymous Coward · 2017-10-21 06:08 · Score: 0
  
  Don't believe the stories of those who claim to be over 30 and still working in tech. They are fictional people made up to trick you.
4. Re:Not enough by Anonymous Coward · 2017-10-21 06:19 · Score: 0
  
  Yeah, seriously? WTF Google? $1000 is probably the amount you'll spend on doughnuts and cupcakes for all the management meetings you have to talk about the hack :P
5. Re:Not enough by Anonymous Coward · 2017-10-21 06:32 · Score: 0
  
  A researcher can get huge multiples of this 'reward' selling the vulnerabilities to other parties...
6. Re: Not enough by Anonymous Coward · 2017-10-21 06:42 · Score: 1
  
  Wow, the Slashdot crowd *is* getting older and more reactionary by the second.
  If you think $1,000 is not enough, than don't waste your time on it.
  Also, teenagers and "third world workers" *should* get excited about 1000 dollars. In places like India and most of South America, that works out to one of two months of salary for the average IT professional.
  These companies, although mostly founded and based in the US, operate all around the world, sell their products and services all around the world, evade taxes all around the world, and even have offices all around the world. Why do you think all the jobs and side gigs they create should be reserved to the US?
7. Re: Not enough by guruevi · 2017-10-21 08:26 · Score: 1
  
  The problem with these bounty programs is
  a) The "underworld" will pay more for it, regardless of where you live. A juicy bug can net you between $10k and $100k to the right people, even more if it's on the scale of Equifax. There is little incentive to the grey and black hatters to participate in these programs and the professionals are also precluded from participating due to a variety of contracts.
  b) You get hundreds of people trying to get the $1000, it's basically free employment to them and a lottery to the participants. Even if you're a 1337 h4x0r, there are hundreds of other ones and if one of them finds it faster than you for a variety of reasons (perhaps they're just submitting on a vague hunch), even if you are technically better and would get hired over them, you still don't get the reward.
  c) You typically sign away a bunch of things under these programs too. You could sign away the right to be named or publicize the exploit so even if you find one, the public will never know any better if Google and co. never fix the problem. And if they do fix it, you're typically not going to be credited for it, rather Google's bounty program gets the credit while you're a footnote in an advisory. If you truly want to enter the market, you're not going to get very far with these programs, again, it's much better if you're caught making millions because after a short stint in a penitentiary you get legitimate contracts even with government agencies.
  
  --
  Custom electronics and digital signage for your business: www.evcircuits.com
8. Re:Not enough by dave562 · 2017-10-21 08:30 · Score: 1
  
  You beat me to it. Anybody who finds a vulnerability in a widely used app like that is going to way more than $1000 exploiting it on their own for fun and profit.
9. Re:Not enough by physicsphairy · 2017-10-21 09:40 · Score: 1
  
  The very fine summary says the $1k is "on top of any reward you get from the app developer." Apparently the rewards for, e.g., Snapchat, range from $250 to $15,000.
  Who is paying for painstaking analysis? You might find a bug randomly. Personally, I would be pretty likely to ignore it, but $1k is probably enough incentive for me to formally report it. For that matter, I am quite sure Google and the other companies *do* pay for painstaking analysis, but a lot of bugs are going to be exposed by simply encountering them rather than meditating about source code.
  Criminals may pay more but they're probably not going to pay anything for bugs they already know about, they might pay you nothing anyway (hey, they're criminals), you might be one of those honest folk who won't sell to them regardless of what they're paying, you might be dishonest but not motivated to seek out an unknown disreputable buyer when you have easy money right in front of you, etc. Being an honest person, without a bug bounty program finding that bug is worth $0 to you.
  Anyway, isn't it a bit contradictory to complain that the money isn't enough to incentivize looking for bugs but then to also complain that it's creating a bunch of people looking for bugs who don't get paid?
  
  --
  When things get complex, multiply by the complex conjugate.
10. Re:Not enough by Threni · 2017-10-21 09:52 · Score: 1
  
  > Who is paying for painstaking analysis? You might find a bug randomly. Personally, I would be pretty
  > likely to ignore it, but $1k is probably enough incentive for me to formally report it.
  You're new to this, aren't you? Yeah, you might find an exploit randomly, while chatting to a mate, and think "yeah, i'll tell snapchat i was chatting to someone and the app revealed a backdoor and i could access anyone else's chats". Sort of like if you find a million dollars you hand it in and get $1000 in return, for being honest?
  No. They want people to tell them about flaws they've found when they've reversed the app, watched the traffic with wireshark and managed to pinpoint exactly what's happening and why. That's what's not worth the money. They're just not competitive.
11. Re:Not enough by Anonymous Coward · 2017-10-21 09:54 · Score: 0
  
  The good news is that all of this is voluntary. If you don't like the program or the rewards, there is no obligation to participate.
  It should be noted that the reward from Google is on top of whatever the company in question may pay. Companies that develop Android apps can start their own programs with their own bounties. Google's program comes on top of that.
  As a hacker, the more you submit valid vulnerability reports on HackerOne, the more skilled you will become and the higher your reputations score will go. This in turn will allow you to make money on many other programs.
  It's not easy to become a top whitehat hacker, but if you do, the rewards are significant.
  Here is how HackerOne celebrated the $500,000 milestone for a hacker: https://www.hackerone.com/blog/mlitchfield-Earned-500000-on-HackerOne
12. Re:Not enough by martenmickos · 2017-10-21 09:56 · Score: 1
  
  The good news is that all of this is voluntary. If you don't like the program or the rewards, there is no obligation to participate.
  It should be noted that the reward from Google is on top of whatever the company in question may pay. Companies that develop Android apps can start their own programs with their own bounties. Google's program comes on top of that.
  As a hacker, the more you submit valid vulnerability reports on HackerOne, the more skilled you will become and the higher your reputations score will go. This in turn will allow you to make money on many other programs.
  It's not easy to become a top whitehat hacker, but if you do, the rewards are significant.
  Here is how HackerOne celebrated the $500,000 milestone for a hacker: https://www.hackerone.com/blog/mlitchfield-Earned-500000-on-HackerOne
  (Sorry for first posting this as Anonymous Coward. I had forgotten to sign in.)
13. Re:Not enough by antdude · 2017-10-21 12:40 · Score: 1
  
  Ditto. Others and I used to be SQA testers, but we can't find those anymore these days. It is OK to have external testings, but seriously don't rely on them for the whole testing process. There are plenty of people who will be happy to get paid to do QA testings like me!
  
  --
  Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
14. Re:Not enough by Anonymous Coward · 2017-10-21 15:09 · Score: 0
  
  The good news is that all of this is voluntary. If you don't like the program or the rewards, there is no obligation to participate.
  The bad news is that this kind of lowball offer won't attract the attention of worthwhile participants and won't compete with criminals who are willing to pay what these exploits are worth.
  This stunt by Google is counter productive. It diminishes the value of the work. And if the deep pockets of Goigke can only spare 1000, any other company is off the hook to pay real money.
15. Re:Not enough by swillden · 2017-10-21 17:34 · Score: 1
  
  I personally think the entire concept of bounties and crowd sourcing your QA is utter stupidity and pretty frickin lazy and irresponsible.
  I think perhaps you missed the part where Google is offering bounties for vulnerabilities in other companies' apps. Google's QA has no responsibility for these apps, so your argument is off target. Also, your terminology is a little off: QA is usually the organization responsible for functional testing and validation. Vulnerability prevention and discovery usually falls to a dedicated security team. QA and security skills are quite different.
  That said, Google absolutely does offer bounties for bugs in its own software, up to $200,000 in the case of Android. Actually, I think the true maximum is a little higher than that, since reporters can get a little more if they provide patches and tests. In addition, Android does have a good-sized security team, including an organization focused on finding vulnerabilities.
  Why both? Why do bounties and have an internal team? Because neither approach alone is as effective as both together. Any organization that really cares about the security of its products must do both -- and more; there's a third approach that is also needed. Let me explain why all three are important.
  First, the internal team matters because they bring something to the table that no outsider can: long-term focus. Especially with respect to large systems, it's very difficult for someone who researches many different products to develop really deep knowledge of any one of them. Essentially, the internal team provides breadth of focus across all security aspects of the product.
  Second, the external vulnerability researchers are important because they provide breadth of focus on attack techniques. Many of the external researchers are academics. Their focus is on devising some clever new way to break systems, or some especially effective way to automate old ways of breaking systems, and so their goal is to apply their technique to a wide variety of products. Bug bounties ensure that they turn their techniques on your product, and that they take the next step to do the work necessary to really prove that the vulnerability they found can be attacked, so you don't waste a lot of time trying to fix theoretical issues.
  There's no way to hire all of the world's security researchers, and even if you could, it wouldn't make sense. These guys focus on new techniques, so while you want them to put a little effort into your product, you don't want to pay them full time.
  The third group of people you want attacking your product is contract penetration testers. You can (and should!) have your internal team doing penetration testing, but they risk developing tunnel vision. Bringing in outside experts provides an infusion of fresh ideas (like the academic researchers) and the fact that you're paying a nice contract fee provides focus. Thus, they provide a blend of the benefits of external and internal research.
  The combination of these three things is dramatically more effective than any one of them.
  
  --
  Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
16. Re: Not enough by bn-7bc · 2017-10-21 23:20 · Score: 1
  
  Hmm what about the old timers stil writing fortran for banks, or the mainframe peoiplewith2 decades+ experience in IBM systemZ etc. While not the majority they still prove that tech is more than X86 (64bit). Sadly I don't have numbers but since mainframes ar still being used fin these applications and not everyone have moved to more modern languages yet they exist.
17. Re: Not enough by Anonymous Coward · 2017-10-23 14:06 · Score: 0
  
  We found the VC shill.
18. Re: Not enough by Reverend+Green · 2017-10-23 14:13 · Score: 1
  
  The really good thing is, with an insultingly low "reward", all these fine pieces of surveillance... er, social media... software area going to remain full of vulnerabilities. I'm pretty sure that's a win for society.
Why? by Anonymous Coward · 2017-10-21 05:46 · Score: 0

Google, Dropbox, Tinder, Snapchat, and Slashdot
Why would anyone ever use any of that shit?
Such hard choices by Anonymous Coward · 2017-10-21 06:10 · Score: 1

1000 from Google, or 1/2 million from various government entities.. "Hey Google, let me get back to you on that."
At least it is better than a T-shirt, thanks Microsoft.
1. Re:Such hard choices by Anonymous Coward · 2017-10-21 06:19 · Score: 0
  
  The choice would depend upon whether the government considers you to be a criminal hacker terrorist.
Oh please by Anonymous Coward · 2017-10-21 06:29 · Score: 1

Hacking is easy. Just make typing motions on any surface!
Hollywood taught us this. Hollywood knows best. Or was it Friend Computer?
1. Re:Oh please by Anonymous Coward · 2017-10-21 06:36 · Score: 0
  
  You forgot the soundtrack. Hacking is rapid-fire typing to trance music.
2. Re:Oh please by Anonymous Coward · 2017-10-21 07:23 · Score: 0
  
  You forgot the soundtrack. Hacking is rapid-fire typing to trance music.
  While getting a blowjob.
just look at related links by Anonymous Coward · 2017-10-21 06:42 · Score: 0

Get real; get a real QA department. Don't look at us for damage control. Keep your money for lawsuits later.
We're not beta testers by duke_cheetah2003 · 2017-10-21 06:44 · Score: 2

I'm really getting tired of this whole atmosphere of the public is your beta testers. I'm not your beta tester and I don't want to be.
It's frickin everywhere, games, apps, websites, we're all guinea-pigs for this garbage and I'm sick of it. Get some QA ffs. Stop treating the public as your freebie beta testers. We're fucking sick of it. I am at least.
1. Re:We're not beta testers by Anonymous Coward · 2017-10-21 06:51 · Score: 0
  
  Yes you are. Google is Your God. Sit down, shut up, and get used to it.
2. Re:We're not beta testers by MrL0G1C · 2017-10-21 07:06 · Score: 1
  
  They could at least have the decency to ask people and offer incentives for beta-testing.
  
  --
  Waterfox - a Firefox fork with legacy extension support, security updates and better privacy by default.
3. Re:We're not beta testers by antdude · 2017-10-21 12:32 · Score: 1
  
  Ditto. Others and I used to be SQA testers, but we can't find those anymore these days. It is OK to have external testings, but seriously don't rely on them for the whole testing process.
  
  --
  Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Why not just wait by bobstreo · 2017-10-21 06:46 · Score: 1

for the next DefCon? It's even cheaper than $1000
Throw pennies on the ground and watch them scurry by Anonymous Coward · 2017-10-21 07:21 · Score: 0

Disgusting, Google. Disgusting.
Redundant, but $1000????? by GodfatherofSoul · 2017-10-21 09:41 · Score: 1

This is what you pay your security analysts MILLIONS for. Hell, any hacker who finds an exploit can sell it for probably 100 times what Google is offering.

--
I swear to God...I swear to God! That is NOT how you treat your human!
Well that sounds like a bad deal... by Anonymous Coward · 2017-10-21 18:56 · Score: 0

The criminals will pay 10k easy for good exploits.
Sure it's paid in stolen bitcoins. but hey. 10k is 10k.
hacking by Anonymous Coward · 2017-10-27 08:36 · Score: 0

Can you? I don't think you can cuz you are not skilled enough to have it done only or unless you are a skilled personnel trained to have it done, I was in need of a way to solve the above question until I saw an endorsed post about Bianca, I almost ignore this post but my intuitive reaction won't let me.
Well the post later worked for me, so I decided to endorse her too on my own way. by advising you to talk to Enrique Lewis
Enriquehackdemon11@gmail.com
Or text
+1(628)203-7005
Since I'm doing this as a method of endorsement, please tell Bianca I recommend
hacking by Anonymous Coward · 2017-10-27 08:53 · Score: 0

Can you? I don't think you can cuz you are not skilled enough to have it done only or unless you are a skilled personnel trained to have it done, I was in need of a way to solve the above question until I saw an endorsed post about Bianca, I almost ignore this post but my intuitive reaction won't let me.
Well the post later worked for me, so I decided to endorse her too on my own way. by advising you to talk to Enrique Lewis
Enriquehackdemon11@gmail.com
Or text
+1(628)203-7005
Since I'm doing this as a method of endorsement, please tell Bianca I recommend.xoxo