3 ms·
Wow, that is quite significant. 36k is not a small bounty for an RCE, but I feel like this is more critical to Google than the highest Android payout, for whic
by eyeareque 8y ago
Wow, that is quite significant.
36k is not a small bounty for an RCE, but I feel like this is more critical to Google than the highest Android payout, for which they pay up to 200k for: https://www.google.com/about/appsecurity/android-rewards/ https://www.google.com/about/appsecurity/android-rewards/
- lathiat 8y agoAndroid is probably one of those markets that are more liquid than most for "black market" sources (as talked about elsewhere in the comments for this)
- londons_explore 8y agoAndroid is wormable, and potentially not repairable by google. For example, with a decent remote android exploit, I could distribute a patched Google Play Services to all vulnerable handsets which disables updates and then listens to my own command and control infrastructure for further actions. I can now hold the phones hostage and extort google for money to regain control of them.
- eyeareque 8y agoThat would be pretty brutal and cause people to quit trusting android phones. But I think the same could be accomplished with the access he had, or worse, but would have taken a lot more work. He also would have needed to avoid detection too. His access sounds more troubling than the Aroura attacks they had years ago.