Campaign run by a group of state-sponsored hackers appears to have been passing data-siphoning spyware through approved apps in Google Play Store for years.
Nearly 10,000 Android apps are found with a variety of undocumented backdoor abilities such as remotely resetting user passwords and blocking users from loading certain types of content.
Beyond the challenges around risk and uncertainty, can bug bounties really deliver on their promise? Even as crowdsourced security testing continues to gain acceptance, what’s important is designing the right model to increase efficiency and avoid diminishing marginal returns.