Samsung will pay you over Rs. 8 crore if you can breach this ‘vault’ in Galaxy phones: Details here

Samsung is offering up to $1million to bug hunters who can crack the Samsung Knox Vault using no-click arbitrary code execution. Here’s everything you need to know.

Samsung uses Knox protection for its Galaxy phones. (HT Tech)

Samsung is offering a huge reward of up to $1 million (over Rs. 8 crore) for anyone who can breach its Knox Vault found in Galaxy devices. Additionally, there are other bounties available for vulnerabilities in platforms like TEEGRIS OS and Rich OS. This bug bounty is part of the Samsung Mobile Security division's Important Scenarios Vulnerability Programme. Samsung is undertaking this initiative to identify “critical attack scenarios” that could affect its products, such as the Galaxy S and Z series smartphones.

In announcing the programme, Samsung stated if someone can find vulnerabilities related to  "Arbitrary Code Execution” on highly privileged targets, Unlocking devices, Full User Data extractions, Arbitrary application installation or Bypass of device protection solution,” they will get rewarded with up to $1,000,000, and that is the maximum amount that Samsung covers for this program.

What Are Samsung's Requirements?

If you wish to earn up to $1 million, you must bypass Samsung Knox Vault and submit a report that proves your attempt was a no-click arbitrary code execution. Samsung will only pay the full amount if the report meets the following:

• Good Report Bonus criteria.
• Includes a buildable exploit that successfully targets one or more of the defined Important Scenarios.
• The exploit should work on the latest Security Update of the latest flagship devices (Galaxy S and Z series).
• The exploit must be performed without privileges.

Samsung's History with Bug Bounties

Samsung is known for placing a strong emphasis on the security of its devices, which is why it has been paying out bounties for nearly 6-7 years. The South Korean giant has paid around $5 million collectively to those who have been able to identify bugs. That said, there are multiple bounties on offer, each with a different set of conditions to secure the top prize. You can check Samsung's blog post here for all the details and conditions you need to meet.