Google offers up to $1.5 million bounty for remotely hacking Titan M chip

Starting today, Google will pay $1 million for a “full chain
remote code execution exploit with persistence which compromises
the Titan M secure element on Pixel devices,” the tech giant said
in a blog
post^[1] published on
Thursday.

Moreover, if someone manages to achieve the same in the
developer preview versions of Android, Google will pay an
additional $500,000, making the total to $1.5 million—that’s 7.5
times more than the previous top Android reward.

Introduced within the Pixel 3 smartphones last year, Google’s Titan
M secure element is a dedicated security chip that sits
alongside the main processor, primarily designed to protect devices
against the boot-time attacks.

In other words, Titan M chip is a separate hardware component to
Android Verified Boot^[3] that also takes care of
sensitive data, lock-screen passcode verification, factory-reset
policies, private keys, and also offers secure
API^[4] for critical operations
like payment and app transactions.

Considering this, it’s usually tough to find a 1-click remote
code execution exploit chain on the Pixel 3 and 4 devices, and,
until now, only one cybersecurity researcher, Guang Gong of Qihoo
360, has been able to do that.

In addition to RCE exploits for Pixel Titan M, Google has also
introduced two new categories of exploits to its rewards
program—data exfiltration and lockscreen bypass
vulnerabilities—which will reward up to $500,000 for depending on
the exploit category.

Google’s expanded Android reward program came over two months
after third-party exploit vendor Zerodium announced to pay up to $2.5
million^[5] for “full chain,
zero-click, with persistence” Android zero-days, which was a
straight 12x jump from its previous price tag of $200,000.

^[2]