Negligent Google Play is axing its Security Reward Program

"The program paid devs up to 20k to locate vulnerabilities in popular Android apps."

Program Ends

The program paid devs up to 20k to locate vulnerabilities in popular Android apps. Google says they’re “winding down the program due to a decrease in actionable vulnerabilities reported by security researchers” [1]

Rampant Malware

This is surprising given the massive increase in malware on Google Play. In March of this year Toms Guide reported on the rampant Google Play hack apps. [4] Further, BleepingComputer recently reported on 28 VPN apps that were hidden proxies for malware. [2] A different security firm Zimperium reports on “GriftHorse campaign used clever techniques to avoid detection in Google Play for nearly a year”, which affected over 10 million victims. [3]

Don’t give a shit

In other words, they no longer give a shit if there’s malware on Google Play, because now they changed the legal liability to be on the app dev. Over a year ago, they changed the legal wording so the dev has to self-report what permissions are used. This shifts responsibility away from the Play Store onto the dev.

But if Google shifts the responsibility on the dev for the bad side, but they keep the good side (collecting user data), then why do we even need them? We don’t. Avoid Google Play… switch to F-Droid, APKs, and Obtainium.