# Negligent Google Play is axing its Security Reward Program

Source: https://simplifiedprivacy.com/negligent-google-play/index.html
Kiwi News: https://news.kiwistand.com/stories/Negligent-Google-Play-is-axing-its-Security-Reward-Program?index=0x66c39ffb80ae7383f1983294c59ec4d3a0eb2dcb0ad31f136dd6761748645291bef7510b
Submitted by simplifiedprivacy.eth on 2024-08-19 UTC, 1 upvote, 0 comments

## Summary

Google is ending its Security Reward Program, which paid developers up to $20,000 to find vulnerabilities in popular Android apps. Google says it is "winding down the program due to a decrease in actionable vulnerabilities reported by security researchers." The article argues this is surprising given rising malware on Google Play, citing a Zimperium report that the GriftHorse campaign evaded detection for nearly a year and affected over 10 million victims. It also says Google changed its legal wording so developers must self-report the permissions their apps use, shifting responsibility onto developers.

## Article

The program paid devs up to 20k to locate vulnerabilities in popular Android apps.

Program Ends

The program paid devs up to 20k to locate vulnerabilities in popular Android apps. Google says they’re “winding down the program due to a decrease in actionable vulnerabilities reported by security researchers” [1]

Rampant Malware

This is surprising given the massive increase in malware on Google Play. In March of this year Toms Guide reported on the rampant Google Play hack apps. [4] Further, BleepingComputer recently reported on 28 VPN apps that were hidden proxies for malware. [2] A different security firm Zimperium reports on “GriftHorse campaign used clever techniques to avoid detection in Google Play for nearly a year”, which affected over 10 million victims. [3]

Don’t give a shit

In other words, they no longer give a shit if there’s malware on Google Play, because now they changed the legal liability to be on the app dev. Over a year ago, they changed the legal wording so the dev has to self-report what permissions are used. This shifts responsibility away from the Play Store onto the dev.

But if Google shifts the responsibility on the dev for the bad side, but they keep the good side (collecting user data), then why do we even need them? We don’t. Avoid Google Play… switch to F-Droid, APKs, and Obtainium.

The sources for this article can be found here

If you really want to learn and take your privacy to the next level, Learn about HydraVeil, Access our VPN, and subscribe to our new content via: Podcast, Email List, Nostr, Bastyon, RSS, or join the Signal Group

Related Posts