Security Post
-
Announcement
Annual Report in 2023 and New Announcements
Jasper Park, Lead of PSIRT at Samsung Mobile Security 06 Aug 2024- It has been more than 6 years since we officially launched Samsung Mobile Security Rewards Program, and today, we are finally releasing our first ever "Annual Report" for the Rewards Program.
- Although there have been many challenges and difficulties in running our Rewards Program, with the help of numerous security experts and communities around the world, it has been able to run our Rewards Program.
- The program was started with the goal of securing our products by receiving vulnerabilities that were not detected internally with external security communities' help. As we received more and more reports, and analyzed and rolled out patches for them, our products became securer and safer. Thanks to the assistance from our valuable researchers.
- After running the program for several years, the Biggest Lesson Learned is that Researchers are my dear and grateful friends who take their time to look at our products from various perspectives and help make them secure and safe.
- I sincerely appreciate your help, 감사합니다!
- With the help of our friends, our Rewards Program has continued to evolve, and as part of it, I will summarize a review of the program in 2023.
Review of 2023- Since starting our official Rewards Program in 2017, we have paid about $5 million. In 2023, we rewarded over $800,000 to 113 researchers.
-
- Rewarded $827,925 to 113 researchers
- The highest reward in one report was $57,190 by TASZK Security Labs.
- The researcher with the highest total reward was also TASZK Security Labs.
- The researcher with most reports was Oversecured Inc.
- Among all of dedicated my friends, there are two that deserve special appreciation.
-
- TASZK Security Labs who helped us from long time ago was a researcher whose report received the highest single reward in 2023. There impressive researches helped secure our products against potential remote attacks. Although Exynos Baseband related reports became out of scope with our program and his reports involved chains with baseband, resulting in a reduction of the overall reward, it was still TASZK Security Labs who received the highest total payout in 2023.
-
- Oversecured is one of our best friends, having submitted numerous valuable reports since their initial report with us back in 2021. In 2023, they reported the greatest number of valid reports. Their valuable researches have covered various targets including applications and frameworks, helping us towards securing diverse targets of and introducing novel types of vulnerabilities in our products. (they were also ranked as the top researcher who filed the most reports and received the highest total rewards in 2022.)
- We sincerely appreciate all of our friends who worked with us with the valuable findings. It was all thanks to your efforts that we were able to run this program and make our products and services more safe and secure to keep our customers from potential attacks.
- In order to collaborate better with our friends, we have continuously made efforts to listen to your voices. As a result, we have come to the conclusion that an update is required to work more closely with you and run a better Rewards Program.
And we are now- And we are now understanding the needed updates what we learned your voices of worries and complaints.
- We cannot emphasize enough how much we appreciate all the researchers for working with us and we hope to get greater interest from more security experts, researchers and Galaxy users.
- We fully understand that it may have become harder and harder to find vulnerabilities with the products, as we are working effortlessly for additional security features while releasing security patches as quickly as possible and as often as possible to keep our customers safer.
- So some may be discouraged to submit findings with a concern that it may be an inefficient research due to potentially low rewards compared to the efforts.
- And we also understood your concerns regarding the transparency of criteria and unpredictable reward amounts.
- Good news!
- We are very excited to announce the largest update we have ever done since releasing our Rewards Program.
- In order to encourage more researchers and users to participate in Samsung Mobile Security Rewards program, we have set new goals. Below is some of our initiatives to the find the best win-win path forward for Samsung and our friends as part of improving our program.
As transparent as possible- We have heard many voices stating difficulty in predicting the severity and reward amounts. So we are now sharing updates indicating clearer criteria of severity and factors used for rewards amount. And please also refer to the FAQ for most frequent inquiries and discussions.
Don’t let your efforts go in vain- We have tried to find ways to offer higher rewards for reports with high impact reports and high quality reports. And now we want to introduce our new Program and Bonus Rewards which provide extra reward and maximum amount covered by our program.
- Please refer to the Good Report Bonus and Important Scenario Vulnerability Program.
AI Security- We started a pilot rewards program for Samsung mobile AI Security.
- We hope to get your interest and active participation for Samsung Mobile AI Security. Since we are in early stage for this, working on setting up the policies for reports related to AI Security, your interests and researches will greatly help us to finalize our policies and standards.
- We want your continuous interest in Samsung Mobile Security Rewards Program. Stay tuned!
- We are preparing additional programs, announcements, and events within 2024.
- I would like to express my gratitude to my friends, our valuable security researchers.
- And I sincerely appreciate for the efforts of my team, PSIRT at Samsung Mobile Security.
-
Announcement
Important Scenario Vulnerability Program
Samsung Mobile Security 06 Aug 2024- We started running a program for the reports which prove critical attack scenarios which have significant impact on our products. If you find any vulnerabilities related to Arbitrary Code Execution on highly privileged targets, Unlocking devices, Full User Data extractions, Arbitrary application installation or Bypass of device protection solution, you are able to receive up-to $1,000,000 which is the maximum amount covered by our program.
Requirements- To join our Important Scenario Vulnerability Program, report must demonstrate a successful attack targeting Important Scenarios. Report can receive the maximum reward amount when it fully satisfy all of the factors below.
-
- Report should fully meets Good Report Bonus
- Report should include buildable exploit which proves successful attack targeting one or many of defined Important Scenarios
- Exploit should work consistently on the latest Security Update of latest Flagship devices (Galaxy S and Z series)
- Exploit should be executed without privileges
- To join in the program, please add the prefix [ISVP] to the title when submitting your report through our rewards program.
Important ScenariosArbitrary code execution on privileged targets-
Target Local ACE Remote ACE Knox Vault ~ $ 300,000 ~ $ 1,000,000 TEEGRIS OS ~ $ 200,000 ~ $ 400,000 Rich OS ~ $ 150,000 ~ $ 300,000 - ※ Full rewards for Knox Vault should meet all the requirements, and demonstrate accessing credential related data stored in Knox Vault.
※ Targeting TEEGRIS OS doesn’t include vulnerabilities of Trustlets. This target refers to Secure OS itself.
※ Rewards for targeting Rich OS depends on the escalated privileges and the functionality by ACE.
※ Full rewards for each targets should provide 0-click exploit with persistence.
Device Unlock & Full User Data Extraction-
Target After first unlock Before first unlock Device Unlock
+ Full User Data Extraction~ $ 200,000 ~ $ 400,000 - ※ We will provide partial rewards for exploits which prove partial success of this target.
Arbitrary Application Install-
Target Local Remote Application from Galaxy Store ~ $ 30,000 ~ $ 60,000 Arbitrary applications ~ $ 50,000 ~ $ 100,000 - ※ Arbitrary application is an application from unofficial market place or attacker’s server.
Bypass of Device Protection Solution-
Target Bypass Auto Blocker ~ $ 100,000 - ※ Full rewards will be paid for exploits which prove fully bypassing Auto Blocker with persistence.
※ Targets for Bypass of Device Protection Solution will be updated irregularly.
-
Announcement
Bonus Rewards
Samsung Mobile Security 06 Aug 2024- We offer bonus rewards for your valuable reports, if they qualify our expectations which greatly help us for working on the vulnerabilities.
Good Report Bonus- All reports should include the following mandatory items in order to be determined eligible.
-
- Version information of affected products
- Description of vulnerability, it should properly explain the practical security impact
- Detailed steps to reproduce the report (if needed, including video, image and other ways)
- High quality report helps us for analyzing and understanding the vulnerability better, and this reduces the time for releasing patch to make users safe.
- After trying to find ways to offer higher rewards for reports with high impact reports and high quality reports, we are offering extra rewards for well-written reports with Good Report Bonus.
- It is recommended to submit high quality report.
- The more items report includes from the list below, the larger amount of Good Report Bonus will be paid out.
-
- We are offering currently Good Report Bonus only for reports related to Android
- Clear and detailed information for mandatory items
- Root cause analysis and suggestion for remedy which clearly proves the impact
- Providing buildable Proof of Concepts(PoC) which clearly demonstrates the vulnerability and outputs from the PoC ※ Bonus vary depending on how much has been proven by the PoC. If the PoC proves not only simple crash or error, but a practical security impact on the device, you may get higher bonus.
- If reports fully meet the conditions, you will receive Good Report Bonus equal to the original reward, resulting in a total payout of twice the reward.
- We are constantly researching to find new factors to provide more rewards for important vulnerabilities discovered by your valuable researches and efforts.
- We hope you continue to show your interest and participate in our program.
-
Notice
Site Maintenance Notice
Samsung Mobile Security 17 May 2024Please note that site maintenance is planned according to below schedule.
We apologize for the inconvenience and appreciate your patience.
Maintenance ScheduleFriday May 17, from 10AM to 1PM KST (3 hours)
(or from Thursday May 16, 6PM to 9PM PST)
E-mail : mobile.security@samsung.com -
FAQ
I don’t want to use your system for reporting my finding.
Samsung Mobile Security 16 May 2024If there is an issue for creating ticket on our system after agreeing the consent "Terms & Conditions" and "Privacy Notice" of Samsung Mobile Security Rewards Program or you don’t want to use Samsung Account, you can report a vulnerability through an official email as guided below.
https://security.samsungmobile.com/securityReporting.smsbWe offer Acknowledgements and CVEs for the reports by email, but there is no reward in this case. Please keep in mind that reports submitted through "ticketing system" only are eligible for reward.
No Contents.