In 2014, Google spent over $1.5 million / 1,326 million euros, through its security bounty programs, on security researchers for reporting various bugs in software developed by the company. The money was given to 200 different researchers who uncovered over 500 security vulnerabilities in Google products.
One researcher, 25-year-old George Hotz (GeoHot), however, managed to attract a lot of attention, given that he received the largest reward in 2014, approximately $150,000 / €132,500, for an exploit that took advantage of four security holes in Chrome OS, and led to program execution on the system, during the Pwnium Hacking competition.
The bugs he found were memory corruption in Chrome's JavaScript, a command in Crosh, a problem in CrosDisks (responsible for files in Chrome OS), and a problem that occurred during startup. The result of all this was that Hotz became a member of Project Zero , a group of elite hackers dedicated to discovering vulnerabilities in software products from different manufacturers.
Google security engineer Eduardo Vela Nava says in a blog post that in the case of Chrome, most of the vulnerabilities that never made it into the stable version of the browser were patched in the developer and beta versions.
Along with the expense announcement, Nava also announced that two new security programs are about to begin. One is a research program to investigate bugs in products developed by Google, and the other is the inclusion of mobile apps officially developed by the company for Android and iOS in the Vulnerability Reward Program.
Since the start of the security program in 2010, the tech giant has paid over $4 / 3,526 million euros, which may not be much for the company, but it is still a heavy investment in the security of its products.
