Samsung Mobile Security

1. 1. Security vulnerability report ("Report") must be applicable to eligible Samsung Mobile devices (including smartphones, tablets, wearable devices and personal computers), services, applications developed and signed by Samsung Mobile, or eligible 3rd party applications developed for Samsung Mobile.
   • Eligible Samsung Mobile Devices in their latest available Android version and firmware.
   • Applicable Samsung Mobile services must be currently active. Vulnerabilities in services offered by other divisions of Samsung may not be eligible for a reward.
   • Applications developed and signed by Samsung Mobile must be up-to-date with the latest update.
   • Vulnerabilities in 3rd party software, in general, are not eligible for a reward.
2. 2. In case of receiving duplicate Reports of a specific vulnerability, only the first Report is eligible for a reward. In some cases, Reports may also be considered duplicate if the patch for the vulnerability is already planned for release.
3. 3. Reports related to the following categories are not eligible:
   • Software bugs that have ineligible or less-than-Low Security Impact
   • A behavior of the software that is consistent with the security concept implemented by Samsung
   • Require excessive preconditions to exploit a vulnerability such as physical connection to the device with hacking tools
   • Scenarios requiring excessive user interaction or tricking users like phishing or clickjacking
   • Vulnerability of a 3rd party code that affects not only Samsung devices but also other Android devices
   • Vulnerabilities (affecting Samsung as well as other Android devices) that are covered by other bug bounty programs (Android Rewards, Qualcomm Bug Bounty, Samsung DS Bug Bounty, etc.) do not qualify
   • Reports from people employed by Samsung and its affiliates, partners, or families of people employed by Samsung
   • Reports based on information taken or obtained through illegal access of Samsung Confidential information
   • Reports based on information that is already public
   • Scenarios that can be mitigated if secure lock (PIN, Pattern, Password, or Biometric) authentication is enforced
   • If Participant discloses any contents or information included in its Report before receiving the rewards or before receiving the disqualification notice from Samsung.
   • Reports not submitted through "ticketing system", but sent via direct email (mobile.security@samsung.com).
4. 4. Samsung Mobile Security Rewards Program("rewards program") is operated by Samsung Mobile and offers monetary rewards to eligible participants in order to improve the security of Samsung Mobile products and services. Thus, the process of the rewards program from start to payout, the decision of severity level and reward amount, and terms and conditions, will be entirely determined and governed by Samsung. The policy, guidelines, qualification requirements and eligibility requirements for the rewards program may change without advanced notice. We may also stop the rewards program at any time.
5. 5. Participation in the rewards program and reporting to Samsung Mobile shall not involve any illegal activities:
   • Samsung Mobile services must not be interrupted and the reporting must not attack any Samsung internal or external servers, nor cause damage of data or physical assets.
   • Participation in the rewards program or reporting to Samsung Mobile must not violate any applicable laws and regulations, or infringe any third party rights (including intellectual property rights).
6. 6. While participants’ comments and justifications will be carefully considered, Samsung will decide in its sole discretion:
   • Whether the Report qualifies for the rewards program
   • Which level of security risk ("severity") would be assigned to each Report
   • The final rewards amount
7. 7. For rewards eligibility, participants are asked not to publish or disclose the vulnerability in public until coordination with Samsung via communication at mobile.security@samsung.com
8. 8. Reported vulnerability or related exploits shall not be used for any illegal activities.
9. 9. Residents from countries sanctioned by the government of South Korea are not eligible for the rewards program.
10. 10. Depending on your local law, there may be additional restrictions on your eligibility to participate the rewards program.
11. 11. You acknowledge and agree that the Reports may be shared with our partners.

1. The rewards amount will range between USD $200 and USD $1,000,000 for qualified Reports.
2. Generally, higher severity issues, more rewards amount will be offered.
3. However, to estimate the rewards amount, we consider various factors including severity level such as report quality, working Proof of Concepts(PoC), attack vector(network, adjacent local, physical), affected scope, difficulty of attacks(attack complexity, privileges required, user interaction required), and so on.
4. So, a lower severity issue well qualified can get more bounty than a higher severity issue. On the other hand, please understand that no reward will be given to Reports with No Security Impact.
5. Also, Reports that merely describe a software bug or a behavior of a software that is consistent with the security concept implemented by Samsung will be considered as Working as Intended.
6. Please see below for detailed information related to Rewards Amount.

1. All reports should include the following mandatory items in order to be determined eligible.
   • Version information of affected products
   • Description of vulnerability, it should properly explain the practical security impact
   • Detailed steps to reproduce the report (if needed, including video, image and other ways)
2. High quality report helps us for analyzing and understanding the vulnerability better, and this reduces the time for releasing patch to make users safe.
3. After trying to find ways to offer higher rewards for reports with high impact reports and high quality reports, we are offering extra rewards for well-written reports with Good Report Bonus.
4. Please check Good Report Bonus to gain additional rewards with your efforts.

1. The range of affected devices is one of important criteria for determining the reward amounts. The scope is calculated by the factors including affected Android OS, and model ranges.
2. There are weights for models, OS, deployment scopes, and latest OS, so with more globally affected vulnerabilities in newer, flagship models can lead to higher rewards with a larger scope.
3. For example, vulnerabilities which only resides in limited SW in specific region, and restricted OS are going to be determined as small scope, and the reward amount can be reduced. On the other hand, vulnerabilities without any restriction for OS, model, and other ranges guaranteeing higher rewards.

We also consider difficulty of attack as an important factor, such as attack complexity, and required privileges or user interaction.

1. We started running a program for the reports which prove critical attack scenarios which have significant impact on our products. If you find any vulnerabilities related to Arbitrary Code Execution on highly privileged targets, Unlocking devices, Full User Data extractions, Arbitrary application installation or Bypass of device protection solution, you are able to receive up-to $1,000,000 which is the maximum amount covered by our program.
2. Please join us in Important Scenario Vulnerability Program with your valuable researches.

1. When we completed releasing patches, our bounty team starts the Rewards process for the payout. Please check below information regarding our rewards process.
   • You are responsible for any tax implications depending on your country of residency and citizenship. Withholding tax may be deducted from the monetary reward in accordance to the laws of applicable jurisdiction and the tax rate may differ by applicable countries.
   • For qualified Reports, rewards will be paid out through Samsung's designated partner Bugcrowd via payment processing and participants will be contacted by Bugcrowd during the process. (Please note that some payouts can be delivered through an alternative way which will be guided through our official e-mail)
   • This rewards program process will be terminated if the Report or participant's handling of the vulnerability does not meet the qualification requirements or any other necessary conditions.
   • Once the rewards program process is initiated, it may take up to 2 months or more until the reward is paid out assuming the required documents are prepared with completeness and all required information are submitted on time.