Google offers bug hunters $3,000 to investigate rumoured security flaws

[Aerosol]

Google is offering grants worth up to $3,000 to investigate suspected security flaws as a part of a new "experimental" initiative.

Google security engineer Eduardo Vela Nava announced the move in a blog post, promising to offer further incentives for researchers to investigate suspected problems that they would otherwise ignore.

"Today we're rolling out a new, experimental programme: Vulnerability Research Grants. These are upfront awards that we will provide to researchers before they ever submit a bug," he explained.

"We'll publish different types of vulnerabilities, products and services for which we want to support research beyond our normal vulnerability rewards.

"We'll award grants immediately before research begins, with no strings attached. Researchers then pursue the research they applied for, as usual. There will be various tiers of grants, with a maximum of $3,133.70."

Google also announced plans to expand its existing bug bounty programme to include flaws in mobile applications.

"Also starting today, all mobile applications officially developed by Google on Google Play and iTunes will now be within the scope of the Vulnerability Reward Programme," read the post.

Google has been a constant supporter of bug bounty schemes, and announced reforms to its programmes in 2014.

Google tripled Chrome bug bounty payments to $15,000 in October prior to launching the Project Zero initiative.

Project Zero was launched in July 2014 with the apparent intention of speeding up companies' patch release schedules.

The team of researchers does this by initially disclosing flaws privately to the firms responsible and giving them 90 days to release a fix before making the research public.

The project was criticised earlier this year for the public disclosure of bugs in Microsoft's Windows and Apple's Mac OS X operating systems.

Nava credited the schemes as a success despite the controversy. He revealed that Google paid researchers more than $1.5m for discovering over 500 bugs last year.

Source