Get Paid to Report Malware Apps on Google

In the wake of data abuse scandals and several instances of malware app being discovered on the Play Store, Google today expanded its bug bounty program to beef up the security of Android apps and Chrome extensions distributed through its platform. Report Malware Apps

Table of Contents

The expansion in Google’s vulnerability reward program majorly includes two main announcements.

First, a new program, dubbed ‘Developer Data Protection Reward Program’ (DDPRP), wherein Google will reward security researchers and hackers who find “verifiably and unambiguous evidence” of data abuse issues in Android apps, OAuth projects, and Chrome extensions.

Second, expanding the scope of its Google Play Security Rewards Program (GPSRP) to include all Android apps from the Google Play Store with over 100 million or more installs, helping affected app developers fix vulnerabilities through responsibly disclosures.’

Finding Malware Apps Using Bounty:

The goal of the data abuse bug bounty program is to prevent scandals like Cambridge Analytica, which cost Facebook $5 billion in fines for failing to spot instances of user data being used, sold, or otherwise improperly repurposed without the user’s permission

In a blog post published today, Google states that if “data abuse is identified linked to an app or Chrome extension, that app or extension will accordingly be removed from Google Play or Google Chrome Web Store.”
The API access of any app creator who abuses access to Gmail’s restricted scopes will be terminated.

Google has not yet released a reward schedule for the DDPRP program, but it has promised that, based on the impact, a single report could result in a bounty of up to $50,000.

Every Android app with 100 million or more downloads has a bug bounty:

The GPSRP Program, which was first introduced in 2017 and has since only been able to disclose vulnerabilities in well-known Android apps through the Google Play Store.

With the most recent statement, Google will now collaborate with developers of countless Android apps, each with at least 100 million downloads, to assist them in receiving vulnerability reports and guidance on how to patch them over their Play Consoles

Even if the app developers don’t have their own vulnerability disclosure or bug bounty program, Google claims these apps are now qualified for rewards.

Part of Google’s App Security Improvement (ASI) program, this existing initiative has already helped over 300,000 developers fix more than 1,000,000 apps on the Google Play Store.

Hopefully, both measures will now allow Google to prevent malicious Android apps and Chrome extensions from abusing its users’ data, as well as to beef up the security of apps distributed through Play Store. Get paid to report malware apps on google