Google to offer $1.5m to anyone that can break a Pixel 4

In a bid to make its Titan technology more secure, Google takes a page out of Apple's playbook

Google has expanded its Android bug bounty program to match the $1.5 million (£1.17m) payout Apple offers for bugs found in its flagship smartphones.

The Titan M security layer, which features in Google's latest Pixel 4 smartphone, is now included as part of the company's bounty list, with the discovery of a working remote-code execution (RCE) bug being worth a potential $1 million (£776,900).

The bug hunter will be eligible for an additional 50% bonus if the Titan M vulnerability is detected and provided to Google in a developer preview version of Android, taking the maximum reward up to $1.5 million.

Aside from Titan M, Google’s Android Security Reward Program will also continue to offer rewards to researchers who find vulnerabilities in other hardware.

Up to $500,000 (£388,365) will be awarded to those who can find bugs relating to issues such as unauthorised data exfiltration and bypassing of the Pixel’s lock screen. The 50% developer preview bonus also applies to these vulnerabilities.

Google has invested heavily in its proprietary Titan technology in recent years, adding its functionality to many of its products as a more secure method of account authentication compared to 2FA.

It’s designed to offer Google hardware owners better security by assigning a physical security layer to an account, meaning remote attackers can’t intercept authenticator codes or mimic approval actions of the true owner.

Despite the faith that Google has placed in its Titan technology, it has been proven in the past to be less than iron-clad.

Earlier this year, a security flaw was found in a version of Google’s Titan Key, a physical device outside of the Pixel line that authenticates account log-in. 

It only affected the Bluetooth pairing protocol needed to pair the key with the device through which the account was being accessed and Google said it would offer free replacements for the faulty units worth $50.

The bounty rewards have been increased to match Apple’s own bug bounty program which itself expanded earlier this year.

Apple also offers a maximum reward of $1 million with a 50% bonus for bugs found during an iOS beta phase.

Apple announced the expansion at Black Hat 2019 along with the news that select researchers could apply for specially crafted iPhones that would make it easier for them to detect vulnerabilities.

Featured Resources

Become a digital service provider

How to transform your business from network core to edge

Download now

Optimal business results with the cloud

Evaluating the best approaches to hybrid cloud adoption

Download now

Virtualisation that enables choices, not compromises

Harness the virtualisation technology that's right for your hybrid infrastructure

Download now

Email security threat report 2020

Four key trends from spear fishing to credentials theft

Download now

Most Popular

150,000 arrest records accidentally deleted from police database
data management

150,000 arrest records accidentally deleted from police database

15 Jan 2021
How to recover deleted emails in Gmail
email delivery

How to recover deleted emails in Gmail

6 Jan 2021
What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

12 Jan 2021