Google has officially announced the expansion of its bug bounty program. Researchers will now be able to earn money by detecting misuse of user data and by identifying vulnerabilities in Android apps with more than 100 million installs.
Developer Data Protection Reward Program (DDPRP)
The first initiative will be the DDPRP program, in which information security specialists will be able to report cases of user data abuse. These issues may be found in third-party applications with access to Google APIs, in Android apps on the Google Play Store, and in apps and extensions on the Chrome Web Store.
“The goal of this program is to encourage anyone who can provide reliable and unambiguous evidence of data misuse,” Google said. “This program aims in particular to identify situations in which user data is used or sold unexpectedly, or reused illegally without the user’s consent.”
Information security professionals who detect cases of data abuse are eligible for a reward of up to $50,000.
In this case, Google is following Facebook’s example. In April 2018, following the scandal involving Cambridge Analytica and the misuse of user data, the social network updated its bug bounty program so that people who discover such misuse in a third-party application could receive up to $40,000 in rewards.
Let me remind you that earlier this month, Facebook extended the scope of this program to Instagram following another unpleasant incident involving Hyp3r. In early August 2019, Hyp3r, an advertising partner of Instagram, was found guilty of collecting user data to later compile advertising profiles. Hyp3r secretly collected and stored millions of user stories, images, geolocation data, biographies, interests, and more. As a result, Hyp3r was blocked by Facebook for violating platform rules.
Bug bounties for large apps
Another interesting announcement from Google is a reward program for all bugs found in large apps on the Google Play Store. Researchers will now be able to look for vulnerabilities in any app with more than 100 million installs and report the issues to Google. In this case, developers of such apps do not need to sign up specifically or take any other action.
Vulnerability reports will be received through the Google Play Security Reward Program (GPSRP) on the HackerOne platform, and then they will be passed on to app developers. If they fail to fix the identified bugs, Google will remove the apps from the Play Store.
Interestingly, major developers such as Facebook, Microsoft, or Twitter, which have their own bug bounty programs, are not excluded from the GPSRP. Moreover, Google says researchers can report bugs twice: through the GPSRP and directly through companies’ own bug bounty programs, allowing them to earn rewards twice over.
While at first glance it may seem that Google is paying out of its own pocket for bugs in third-party apps, and that this makes no sense, the company explains that it is actually practical and cost-effective. The fact is that the GPSRP was launched in 2017 but did not gain much popularity: to date, Google had only paid researchers $265,000, although the program already included a number of popular apps (manually selected by Google).
Google explains that all vulnerability reports received over the past three years were not in vain. All bug reports have been cataloged and included in a system that automatically scans apps on the Google Play Store for similar issues. If a bug is detected, the developers of the vulnerable app receive a warning through the Google Play Console and have the option to fix the problem, or their apps are removed from the directory. This system is called App Security Improvement (ASI) and, according to the company, it has already helped 300,000 developers fix more than 1,000,000 apps on Google Play.
