Samsung Introduces Million-Dollar Bug Bounty for Critical Galaxy Vulnerabilities
Introduction
Samsung has introduced a groundbreaking bug bounty program offering up to $1,000,000 for discovering critical vulnerabilities in its mobile devices. This initiative, named the 'Important Scenario Vulnerability Program (ISVP),' underscores Samsung's commitment to bolstering the security of its Galaxy devices. The program focuses on vulnerabilities related to arbitrary code execution, device unlocking, data extraction, arbitrary application installation, and bypassing device protections.
ISVP Program Highlights
Samsung's ISVP program aims to address vulnerabilities in various aspects of its devices. Specifically, it targets issues within the Knox Vault, TEEGRIS OS, and the Rich OS. The program's highlights include:
1. Knox Vault Security:
- Knox Vault is Samsung's secure environment for storing sensitive biometric information and cryptographic keys.
- Reports demonstrating local arbitrary execution on Samsung devices can earn researchers $300,000.
- Remote code execution (RCE) vulnerabilities on Knox Vault are rewarded with a $1,000,000 payout.
2. TEEGRIS OS Vulnerabilities:
- TEEGRIS OS is Samsung's Trusted Execution Environment (TEE) operating system, designed for executing sensitive code securely.
- Local arbitrary code execution on TEEGRIS OS offers $200,000.
- RCE vulnerabilities on TEEGRIS OS can fetch up to $400,000.
3. Rich OS Security Flaws:
- The primary operating system on Samsung devices, known as Rich OS, also falls under the ISVP program.
- Local code execution on Rich OS has a reward of $150,000.
- RCE vulnerabilities on Rich OS can earn up to $300,000.
Top Payouts in the ISVP Program
The highest rewards in the ISVP program are reserved for the most critical scenarios:
- Achieving a device unlock combined with full user data extraction pays $400,000.
- If the extraction occurs after the first unlock, the payout is halved.
- Remote arbitrary application installation from an unofficial marketplace or an attacker's server is worth $100,000.
- Installing an app from the Galaxy Store earns $60,000.
- Local arbitrary installations are rewarded with $50,000 or $30,000, depending on the source.
Claiming Rewards
To claim these rewards, researchers must submit bug reports that include a buildable exploit working consistently on the latest security update of flagship models such as the Galaxy S and Z series. The exploits must be persistent and require zero user interaction (0-click) to qualify for the maximum rewards.
Samsung's Ongoing Commitment to Security
In 2023, Samsung paid $827,925 to 113 security researchers through its Mobile Security Rewards Program. Since the program's inception in 2017, over $4,900,000 in rewards have been distributed, with the highest payout being $120,000 and the record payout last year being $57,190. The launch of ISVP aims to surpass these records by offering strong incentives for identifying and reporting critical issues.
Conclusion
Samsung's new ISVP program represents a significant step in enhancing the security of its devices. By offering substantial rewards for discovering critical vulnerabilities, Samsung demonstrates its dedication to protecting user data and maintaining the integrity of its Galaxy devices. Security researchers are encouraged to participate in this program to help safeguard millions of users worldwide.
About Foresiet!
Foresiet is the pioneering force in digital security solutions, offering the first integrated Digital Risk Protection SaaS platform. With 24x7x365 dark web monitoring and proactive threat intelligence, Foresiet safeguards against data breaches and intellectual property theft. Our robust suite includes brand protection, takedown services, and supply chain assessment, enhancing your organization's defense mechanisms. Attack surface management is a key component of our approach, ensuring comprehensive protection across all vulnerable points. Compliance is assured through adherence to ISO27001, NIST, GDPR, PCI, SOX, HIPAA, SAMA, CITC, and Third Party regulations. Additionally, our advanced antiphishing shield provides unparalleled protection against malicious emails. Trust Foresiet to empower your organization to navigate the digital landscape securely and confidently.
Protect your brand, reputation, data, and systems with Foresiet's Integrated Digital Risk Platform. 24/7/365 threat monitoring for total peace of mind.
Nov. 5, 2024, 9:53 a.m.
Oct. 16, 2024, 3:33 p.m.