[ad_1]
Posted by Sarah Jacobus, Vulnerability Rewards Crew
It has been one other unbelievable 12 months for the Vulnerability Reward Applications (VRPs) at Google! Working with safety researchers all through 2022, we now have been capable of determine and repair over 2,900 safety points and proceed to make our merchandise safer for our customers around the globe.
We’re thrilled to see vital 12 months over 12 months development for our VRPs, and have had one more file breaking 12 months for our applications! In 2022 we awarded over $12 million in bounty rewards – with researchers donating over $230,000 to a charity of their selection.
As in previous years, we’re sharing our 2022 Yr in Evaluate statistics throughout all of our applications. We want to give a particular thanks to all of our devoted researchers for his or her continued work with our applications – we look ahead to extra collaboration sooner or later!
Android
The Android VRP had an unbelievable file breaking 12 months in 2022 with $4.8 million in rewards and the best paid report in Google VRP historical past of $605,000!
In our continued effort to make sure the safety of Google system customers, we now have expanded the scope of Android and Google Units in our program and are actually incentivizing vulnerability analysis within the newest variations of Google Nest and Fitbit! For extra data on the most recent program model and qualifying vulnerability studies, please go to our public guidelines web page.
We’re additionally excited to share that the invite-only Android Chipset Safety Reward Program (ACSRP) – a personal vulnerability reward program supplied by Google in collaboration with producers of Android chipsets – rewarded $486,000 in 2022 and acquired over 700 legitimate safety studies.
We want to give a particular shoutout to a few of our prime researchers, whose continued laborious work helps to maintain Android protected and safe:
Submitting a powerful 200+ vulnerabilities to the Android VRP this 12 months, Aman Pandey of Bugsmirror stays certainly one of our program’s prime researchers. Since submitting their first report in 2019, Aman has reported greater than 500 vulnerabilities to this system. Their laborious work helps guarantee the protection of our customers; an enormous thanks for all of their laborious work!Zinuo Han of OPPO Amber Safety Lab shortly rose by our program’s ranks, changing into certainly one of our prime researchers. Within the final 12 months they’ve recognized 150 legitimate vulnerabilities in Android. Discovering one more vital exploit chain, gzobqq submitted our highest valued exploit so far.Yu-Cheng Lin (林禹成) (@AndroBugs) stays certainly one of our prime researchers submitting just below 100 studies this 12 months.
Chrome
Chrome VRP had one other unparalleled 12 months, receiving 470 legitimate and distinctive safety bug studies, leading to a complete of $4 million of VRP rewards. Of the $4M, $3.5 million was rewarded to researchers for 363 studies of safety bugs in Chrome Browser and almost $500,000 was rewarded for 110 studies of safety bugs in ChromeOS.
This 12 months, Chrome VRP re-evaluated and refactored the Chrome VRP reward quantities to extend the reward quantities for probably the most exploitable and dangerous lessons and sorts of safety bugs, in addition to added a brand new class for reminiscence corruption bugs in extremely privileged processes, such because the GPU and community course of, to incentivize analysis in these vital areas. The Chrome VRP elevated the fuzzer bonuses for studies from VRP-submitted fuzzers working on the Google ClusterFuzz infrastructure as a part of the Chrome Fuzzing program. A brand new bisect bonus was launched for bisections carried out as a part of the bug report submission, which helps the safety crew with our triage and bug copy.
2023 would be the 12 months of experimentation within the Chrome VRP! Please preserve a lookout for bulletins of experiments and potential bonus alternatives for Chrome Browser and ChromeOS safety bugs.
Your complete Chrome crew sincerely appreciates the contributions of all our researchers in 2022 who helped preserve Chrome Browser, ChromeOS, and all of the browsers and software program primarily based on Chromium safe for billions of customers throughout the globe.
Along with posting about our Prime 0-22 Researchers in 2022, Chrome VRP want to particularly acknowledge some particular researcher achievements made in 2022:
Rory McNamara, a six-year participant in Chrome VRP as a ChromeOS researcher, grew to become the best rewarded researcher of all time within the Chrome VRP. Most spectacular is that Rory has achieved this in a complete of solely 40 safety bug submissions, demonstrating simply how impactful his findings have been – from ChromeOS persistent root command execution, leading to a $75,000 reward again in 2018, to his many studies of root privilege escalation each with and with out persistence. Rory was additionally form sufficient to talk on the Chrome Safety Summit in 2022 to share his experiences collaborating within the Chrome VRP over time. Thanks, Rory!
SeongHwan Park (SeHwa), a participant within the Chrome VRP since mid-2021, has been a tremendous contributor of ANGLE / GPU safety bug studies in 2022 with 11 stable high quality studies of GPU bugs incomes them a spot on Chrome VRP 2022 prime researchers record. Thanks, SeHwa!
Securing Open Supply
Recognizing the truth that Google is among the largest contributors and customers of open supply on the earth, in August 2022 we launched OSS VRP to reward vulnerabilities in Google’s open supply tasks – overlaying provide chain problems with our packages, and vulnerabilities which will happen in finish merchandise utilizing our OSS. Since then, over 100 bughunters have participated in this system and have been rewarded over $110,000.
Sharing Information
We’re happy to announce that in 2022, we’ve made the educational alternatives for bug hunters out there at our Bug Hunter College (BHU) extra various and accessible. Along with our present collections of articles, which help enhancing your studies and avoiding invalid studies, we’ve made greater than 20 tutorial movies out there. Clocking in at round 10 minutes every, these movies cowl probably the most related studying subjects and developments we’ve noticed over the previous years.
To make this occur, we teamed up with a few of your favourite and best-known safety researchers from across the globe, together with LiveOverflow, PwnFunction, stacksmashing, InsiderPhD, PinkDraconian, and plenty of extra!
For those who’re uninterested in studying our articles, or just curious and on the lookout for another technique to broaden your bug looking expertise, these movies are for you. Take a look at our overview, or hop proper in to the BHU YouTube playlist. Joyful watching & studying!
Google Play
2022 was a 12 months of change for the Google Play Safety Reward Program. In Might we onboarded each new teammates and a few outdated buddies to triage and lead GPSRP. We additionally sponsored NahamCon ‘22, BountyCon in Singapore, and NahamCon Europe’s on-line occasion. In 2023 we hope to proceed to develop this system with new bug hunters and associate on extra occasions targeted on Android & Google Play apps.
Analysis Grants
In 2022 we continued our Vulnerability Analysis Grant program with success. We’ve awarded greater than $250,000 in grants to over 170 safety researchers. Final 12 months we additionally piloted collaboration double VRP rewards for chosen grants and are trying ahead to increasing it much more in 2023.
If you’re a Google VRP researcher and need to be thought of for a Vulnerability Analysis Grant, be sure you opted in in your bughunters profile.
Wanting Ahead
With out our unbelievable safety researchers we wouldn’t be right here sharing this superb information at the moment. Thanks once more on your continued laborious work!
Additionally, in case you haven’t seen Hacking Google but, make certain to take a look at the “Bug Hunters” episode, that includes a few of our very personal tremendous proficient bug hunters.
Thanks once more for serving to to make Google, the Web, and our customers extra protected and safe! Observe us on @GoogleVRP for different information and updates.
Thanks to Adam Bacchus, Dirk Göhmann, Eduardo Vela, Sarah Jacobus, Amy Ressler, Martin Straka, Jan Keller, Tony Mendez, Rishika Hooda
[ad_2]