Best Of Google VRP 2018
summary
Summary of Google VRP 2018: program has full-time triage engineers in Zurich and California and pays real money for impact — examples include up to $7.5K for leaking Gmail, typical XSS in acquisitions often nets ~$100 versus ~$5,000 on core origins, and there's a six-month blackout after acquisitions. Useful attack vectors: protocol buffers reversal across services, Android intent parameter leaks (~$1,300 examples), sandboxed libraries, abuse-reward reports, research grants and fuzz/patch bounties.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:23Google VRP overview
- 4:48Targeting acquisitions
- 9:33Core product challenges
- 13:14Product specialization
- 17:57Vector-based searching
- 20:51Reporting best practices
- 23:52Additional reward programs
- 28:44Q&A
related talks
30mGoogle Give Me Vulnz
42mHack, Patch, Repeat: Insider Tales from Android’s...
41mOverview of common Android app vulnerabilities
30mBeyond Quick Cash: Rethinking Bug Bounties for...
35mSetting up a bug bounty program for your app
39mHacking Google - Lessons learned running and growing an internal red team
29mThe Smörgåsbord of web app hacking
39m"Inter-application" vulnerabilities - hunting for bugs in..."