Story image

Samsung Mobile launches bug bounty program

13 Sep 17

Samsung is the latest vendor to jump into the world of bug bounties through the launch of Samsung Mobile Products Rewards Program.

The program covers vulnerabilities on Samsung Mobile devices, services and applications developed by Samsung, as well as eligible third party apps specifically designed for Samsung. It does not cover vulnerabilities that could be found on other Android devices.

“Samsung is officially launching our Mobile Security Rewards Program, a new vulnerability rewards program which invites members of the security community to assess the integrity of Samsung’s mobile devices and associated software to identify potential vulnerabilities in those products,” Samsung says in a statement.

Rewards range from US$200 to $200,000 depending on how severe the discovered vulnerability is.

If the vulnerability report does not include a proof of concept, reward amounts may be reduced although the vulnerability will still be considered.

“Higher rewards amount will be offered for vulnerabilities with greater security risk and impact, and even higher rewards amount will be offered for vulnerabilities that lead to TEE or Bootloader compromise. On the other hand, rewards amount may be significantly reduced if the security vulnerability requires running as a privileged process,” the rules state.

Participants must not conduct any illegal activities, attack any Samsung servers, damage data or physical assets, or infringe any third party rights.

Eligible devices include:

- Galaxy S series (S8, S8+, S8 Active, S7, S7 edge, S7 Active, S6 edge+, S6, S6 edge, S6 Active) 
- Galaxy Note series (Note 8, Note FE, Note 5, Note 4, Note edge)
- Galaxy A series (A3 (2016), A3 (2017), A5 (2016), A5 (2017), A7 (2017))
- Galaxy J series (J1 (2016), J1 Mini, J1 Mini Prime, J1 Ace, J2 (2016), J3 (2016), J3 (2017), J3 Pro, J3 Pop, J5 (2016), J5 (2017), J7 (2016), J7 (2017), J7 Max, J7 Neo, J7 Pop)
- Galaxy Tab series (Tab S2 L Refresh, Tab S3 9.7)

Researchers who discover any vulnerabilities must be the first to report it if they want to qualify for the reward.

Furthermore, bugs that: have no security impact; a ‘very low’ exploit probability; must not involve extensive user involvement like clickjacking or phishing; result in a crash without an exploit or are up for grabs in other bounty programs do not count.

Participants must submit reports by Samsung Mobile’s security reporting page.

“Samsung’s Mobile Security Rewards program is the latest initiative to demonstrate our steadfast commitment to working in close partnership with the security research community and enabling secure experiences for all our customers,” Samsung concludes.

JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t. 
Pitfalls to avoid when configuring cloud firewalls
Flexibility and granularity of security controls is good but can still represent a risk for new cloud adopters that don’t recognise some of the configuration pitfalls.
CERT NZ highlights rise of unauthorised access incidents
“In one case, the attacker gained access and tracked the business’s emails for at least six months. They gathered extensive knowledge of the business’s billing cycles."
Report finds GCSB in compliance with NZ rights
The Inspector-General has given the GCSB its compliance tick of approval for the fourth year in a row.
Securing hotel technology to protect customer information
Network security risks increase exponentially as hotels look to incorporate newer technologies to support a range of IoT devices, including smart door locks.
Why total visibility is the key to zero trust
Over time, the basic zero trust model has evolved and matured into what Forrester calls the Zero Trust eXtended (ZTX) Ecosystem.
Gartner names Proofpoint Leader in enterprise information archiving
The report provides a detailed overview of the enterprise information archiving market and evaluates vendors based on completeness of vision and ability to execute.
WatchGuard appoints new channel distributors in A/NZ
The appointments will enable WatchGuard to expand its regional channel reseller footprint.