Google to offer $1.5m to anyone that can break a Pixel 4

Google has expanded its Android bug bounty program to match the $1.5 million (£1.17m) payout Apple offers for bugs found in its flagship smartphones.

The Titan M security layer, which features in Google's latest Pixel 4 smartphone, is now included as part of the company's bounty list, with the discovery of a working remote-code execution (RCE) bug being worth a potential $1 million (£776,900).

The bug hunter will be eligible for an additional 50% bonus if the Titan M vulnerability is detected and provided to Google in a developer preview version of Android, taking the maximum reward up to $1.5 million.

Aside from Titan M, Google’s Android Security Reward Program will also continue to offer rewards to researchers who find vulnerabilities in other hardware.

Up to $500,000 (£388,365) will be awarded to those who can find bugs relating to issues such as unauthorised data exfiltration and bypassing of the Pixel’s lock screen. The 50% developer preview bonus also applies to these vulnerabilities.

Google has invested heavily in its proprietary Titan technology in recent years, adding its functionality to many of its products as a more secure method of account authentication compared to 2FA.

It’s designed to offer Google hardware owners better security by assigning a physical security layer to an account, meaning remote attackers can’t intercept authenticator codes or mimic approval actions of the true owner.

Despite the faith that Google has placed in its Titan technology, it has been proven in the past to be less than iron-clad.

Earlier this year, a security flaw was found in a version of Google’s Titan Key, a physical device outside of the Pixel line that authenticates account log-in.

It only affected the Bluetooth pairing protocol needed to pair the key with the device through which the account was being accessed and Google said it would offer free replacements for the faulty units worth $50.

The bounty rewards have been increased to match Apple’s own bug bounty program which itself expanded earlier this year.

Apple also offers a maximum reward of $1 million with a 50% bonus for bugs found during an iOS beta phase.

Apple announced the expansion at Black Hat 2019 along with the news that select researchers could apply for specially crafted iPhones that would make it easier for them to detect vulnerabilities.