sb-nz logo
Story image

Samsung Mobile launches bug bounty program

13 Sep 2017

Samsung is the latest vendor to jump into the world of bug bounties through the launch of Samsung Mobile Products Rewards Program.

The program covers vulnerabilities on Samsung Mobile devices, services and applications developed by Samsung, as well as eligible third party apps specifically designed for Samsung. It does not cover vulnerabilities that could be found on other Android devices.

“Samsung is officially launching our Mobile Security Rewards Program, a new vulnerability rewards program which invites members of the security community to assess the integrity of Samsung’s mobile devices and associated software to identify potential vulnerabilities in those products,” Samsung says in a statement.

Rewards range from US$200 to $200,000 depending on how severe the discovered vulnerability is.

If the vulnerability report does not include a proof of concept, reward amounts may be reduced although the vulnerability will still be considered.

“Higher rewards amount will be offered for vulnerabilities with greater security risk and impact, and even higher rewards amount will be offered for vulnerabilities that lead to TEE or Bootloader compromise. On the other hand, rewards amount may be significantly reduced if the security vulnerability requires running as a privileged process,” the rules state.

Participants must not conduct any illegal activities, attack any Samsung servers, damage data or physical assets, or infringe any third party rights.

Eligible devices include:

- Galaxy S series (S8, S8+, S8 Active, S7, S7 edge, S7 Active, S6 edge+, S6, S6 edge, S6 Active)  - Galaxy Note series (Note 8, Note FE, Note 5, Note 4, Note edge) - Galaxy A series (A3 (2016), A3 (2017), A5 (2016), A5 (2017), A7 (2017)) - Galaxy J series (J1 (2016), J1 Mini, J1 Mini Prime, J1 Ace, J2 (2016), J3 (2016), J3 (2017), J3 Pro, J3 Pop, J5 (2016), J5 (2017), J7 (2016), J7 (2017), J7 Max, J7 Neo, J7 Pop) - Galaxy Tab series (Tab S2 L Refresh, Tab S3 9.7)

Researchers who discover any vulnerabilities must be the first to report it if they want to qualify for the reward.

Furthermore, bugs that: have no security impact; a ‘very low’ exploit probability; must not involve extensive user involvement like clickjacking or phishing; result in a crash without an exploit or are up for grabs in other bounty programs do not count.

Participants must submit reports by Samsung Mobile’s security reporting page.

“Samsung’s Mobile Security Rewards program is the latest initiative to demonstrate our steadfast commitment to working in close partnership with the security research community and enabling secure experiences for all our customers,” Samsung concludes.

Story image
Attivo Networks expands Active Directory suite for greater protection
"We see Active Directory exploitation used in the majority of ransomware, insider and advanced attacks. We are pleased to now offer our customers early and efficient solutions for preventing the misuse of Active Directory.”More
Story image
Case study: How Pattern helped SimTutor secure online education
SimTutor provides a software-as-a-service (SaaS) solution designed for online healthcare education and e-learning content creators.More
Story image
Cloud services top threat vector for healthcare industry
"The coronavirus pandemic continues to highlight the unique cybersecurity needs of the healthcare industry, even as it has increased the number of threats these organisations face."More
Link image
Virtual demo: Diagnose network cabling problems with the LinkIQ Cable+Network Tester
If you’re finding it difficult to install access points and cabling, or if you can’t pinpoint an issue with a video camera or end user, the LinkIQ Cable+Network Tester could be exactly what you need. Try a free, fully interactive demo now.More
Story image
AvePoint brings Salesforce Cloud Backup to channel partners
The product adds to the AvePoint suite of trusted Cloud Backup for Microsoft 365 and Dynamics 365 to provide managed service providers with backup and restore capabilities across multiple, popular SaaS providers.More
Story image
New wormable Android malware discovered through auto-replies in WhatsApp
Check Point Research has discovered new malware on Google’s Play Store that could spread through WhatsApp messages. More