Google will start to pay security researchers who find bugs in its Android devices a reward of up to $40,000 (£25,600), in the first extension of its bug bounty programme to the mobile operating system.
The company has also announced a new programme to ensure the security of third-party software on the Android OS by nudging developers to stop using programming libraries which are known to be out-of-date in their applications.
“We see mobile becoming arguably the most important way people connect to the internet,” said Google’s Adrian Ludwig, the lead of Android security. “We’re seeing it providing two-factor authentication, as well, and the root of trust in the way that users interact.”
And yet currently, “most security research is still focused on legacy systems. We’re trying to move that, by incentivising security researchers to focus their energy on mobile.” The new scheme will be called Android Security Rewards, and follows the success of a similar programme for Google’s Chrome web browser. In 2014, the company paid out more that $1.5m to security researchers.
The decision to scan Android apps for software libraries which could pose a security threat was taken a year ago, Ludwig says, and will now be rolled out beyond its “experimental” introduction. “As part of the scanning of apps, we don’t just look for intentionally bad behaviour anymore: we’re also looking for mistakes.”
The obvious example Ludwig gives is OpenSSL, the open-source encryption library that was at the heart of 2014’s Heartbleed vulnerability.
“A really obvious example of what we’re looking out for: including a version of OpenSSL that’s an old version. Starting about a year ago, we began scanning apps, and notifying developers if they have made that sort of mistake,” Ludwig said.
“Our goal is to get to the point where there’s a common baseline. We want to put structures in place to help developers update their apps, so the quality of all apps rises.”
Developers who want to claim Google’s bug bounty will be required to show vulnerabilities affecting the company’s two shipping Nexus devices, the Nexus 6 and Nexus 9 (owing to the fragmentation of the Android market, Google can’t verify whether or not bugs affecting other Android devices are the fault of the operating system, or manufacturer additions). The rewards are on a sliding scale, from $500 for a minor bug presented with no extra work other than identification, all the way to $38,000 for a severe vulnerability supplied alongside a proof-of-concept remote exploit and a patch to fix the issue. “Our goal is that this could be a full-time research and a very well-paid opportunity,” says Ludwig.
A separate Google security scheme, Project Zero, has earned the company a minor amount of controversy for its practice of releasing proof-of-concept exploits for other companies’ devices. The project aims to identify previously-unknown vulnerabilities, and then disclose them to manufacturers with a 90-day time limit for fixing them. If no fix is forthcoming, the group will (and has) release the attack publicly, to spur companies into speeding up their security patches.
But the company practices what it preaches: Ludwig says that Android vulnerabilities are also sought out by Project Zero. “If Project Zero identifies an issue, we’re given a deadline, and we operate within that deadline, the same as everyone else. We haven’t yet missed a deadline.
“We absolutely believe in making manufacturers respond quickly, all those parties should be responding quickly.”
The company has also announced a new programme to ensure the security of third-party software on the Android OS by nudging developers to stop using programming libraries which are known to be out-of-date in their applications.
“We see mobile becoming arguably the most important way people connect to the internet,” said Google’s Adrian Ludwig, the lead of Android security. “We’re seeing it providing two-factor authentication, as well, and the root of trust in the way that users interact.”
And yet currently, “most security research is still focused on legacy systems. We’re trying to move that, by incentivising security researchers to focus their energy on mobile.” The new scheme will be called Android Security Rewards, and follows the success of a similar programme for Google’s Chrome web browser. In 2014, the company paid out more that $1.5m to security researchers.
The decision to scan Android apps for software libraries which could pose a security threat was taken a year ago, Ludwig says, and will now be rolled out beyond its “experimental” introduction. “As part of the scanning of apps, we don’t just look for intentionally bad behaviour anymore: we’re also looking for mistakes.”
The obvious example Ludwig gives is OpenSSL, the open-source encryption library that was at the heart of 2014’s Heartbleed vulnerability.
“A really obvious example of what we’re looking out for: including a version of OpenSSL that’s an old version. Starting about a year ago, we began scanning apps, and notifying developers if they have made that sort of mistake,” Ludwig said.
“Our goal is to get to the point where there’s a common baseline. We want to put structures in place to help developers update their apps, so the quality of all apps rises.”
Developers who want to claim Google’s bug bounty will be required to show vulnerabilities affecting the company’s two shipping Nexus devices, the Nexus 6 and Nexus 9 (owing to the fragmentation of the Android market, Google can’t verify whether or not bugs affecting other Android devices are the fault of the operating system, or manufacturer additions). The rewards are on a sliding scale, from $500 for a minor bug presented with no extra work other than identification, all the way to $38,000 for a severe vulnerability supplied alongside a proof-of-concept remote exploit and a patch to fix the issue. “Our goal is that this could be a full-time research and a very well-paid opportunity,” says Ludwig.
A separate Google security scheme, Project Zero, has earned the company a minor amount of controversy for its practice of releasing proof-of-concept exploits for other companies’ devices. The project aims to identify previously-unknown vulnerabilities, and then disclose them to manufacturers with a 90-day time limit for fixing them. If no fix is forthcoming, the group will (and has) release the attack publicly, to spur companies into speeding up their security patches.
But the company practices what it preaches: Ludwig says that Android vulnerabilities are also sought out by Project Zero. “If Project Zero identifies an issue, we’re given a deadline, and we operate within that deadline, the same as everyone else. We haven’t yet missed a deadline.
“We absolutely believe in making manufacturers respond quickly, all those parties should be responding quickly.”
No comments:
Post a Comment