Story image

Samsung Mobile launches bug bounty program

13 Sep 2017

Samsung is the latest vendor to jump into the world of bug bounties through the launch of Samsung Mobile Products Rewards Program.

The program covers vulnerabilities on Samsung Mobile devices, services and applications developed by Samsung, as well as eligible third party apps specifically designed for Samsung. It does not cover vulnerabilities that could be found on other Android devices.

“Samsung is officially launching our Mobile Security Rewards Program, a new vulnerability rewards program which invites members of the security community to assess the integrity of Samsung’s mobile devices and associated software to identify potential vulnerabilities in those products,” Samsung says in a statement.

Rewards range from US$200 to $200,000 depending on how severe the discovered vulnerability is.

If the vulnerability report does not include a proof of concept, reward amounts may be reduced although the vulnerability will still be considered.

“Higher rewards amount will be offered for vulnerabilities with greater security risk and impact, and even higher rewards amount will be offered for vulnerabilities that lead to TEE or Bootloader compromise. On the other hand, rewards amount may be significantly reduced if the security vulnerability requires running as a privileged process,” the rules state.

Participants must not conduct any illegal activities, attack any Samsung servers, damage data or physical assets, or infringe any third party rights.

Eligible devices include:

- Galaxy S series (S8, S8+, S8 Active, S7, S7 edge, S7 Active, S6 edge+, S6, S6 edge, S6 Active) 
- Galaxy Note series (Note 8, Note FE, Note 5, Note 4, Note edge)
- Galaxy A series (A3 (2016), A3 (2017), A5 (2016), A5 (2017), A7 (2017))
- Galaxy J series (J1 (2016), J1 Mini, J1 Mini Prime, J1 Ace, J2 (2016), J3 (2016), J3 (2017), J3 Pro, J3 Pop, J5 (2016), J5 (2017), J7 (2016), J7 (2017), J7 Max, J7 Neo, J7 Pop)
- Galaxy Tab series (Tab S2 L Refresh, Tab S3 9.7)

Researchers who discover any vulnerabilities must be the first to report it if they want to qualify for the reward.

Furthermore, bugs that: have no security impact; a ‘very low’ exploit probability; must not involve extensive user involvement like clickjacking or phishing; result in a crash without an exploit or are up for grabs in other bounty programs do not count.

Participants must submit reports by Samsung Mobile’s security reporting page.

“Samsung’s Mobile Security Rewards program is the latest initiative to demonstrate our steadfast commitment to working in close partnership with the security research community and enabling secure experiences for all our customers,” Samsung concludes.

New threat rears its head in new malware report
Check Point’s researchers view Speakup as a significant threat, as it can be used to download and spread any malware.
Oracle updates enterprise blockchain platform
Oracle’s enterprise blockchain has been updated to include more capabilities to enhance development, integration, and deployment of customers’ new blockchain applications.
Used device market held back by lack of data security regulations
Mobile device users are sceptical about trading in their old device because they are concerned that data on those devices may be accessed or compromised after they hand it over.
Gartner names ExtraHop leader in network performance monitoring
ExtraHop provides enterprise cyber analytics that deliver security and performance from the inside out.
Symantec acquires zero trust innovator Luminate Security
Luminate’s Secure Access Cloud is supposedly natively constructed for a cloud-oriented, perimeter-less world.
Palo Alto releases new, feature-rich firewall
Palo Alto is calling it the ‘fastest-ever next-generation firewall’ with integrated cloud-based DNS Security service to stop attacks.
The right to be forgotten online could soon be forgotten
Despite bolstering free speech and access to information, the internet can be a double-edged sword, because that access to information goes both ways.
Opinion: 4 Ransomware trends to watch in 2019
Recorded Future's Allan Liska looks at the past big ransomware attacks thus far to predict what's coming this year.