An 11-year-old bug that could leave your Android device susceptible to a stealth attack was discovered recently. A bug bounty program discovered the long-standing vulnerability.

In the ever-evolving landscape of cybersecurity, the presence of vulnerabilities remains a constant threat. We rely heavily on our devices, and it's important to stay informed about potential risks. 

Skywatchers: Cold Moon Delights Light Up December Nights - USA Herald

Murder in Paradise: Chocolate Mogul Arrested for Death of Canadian Entrepreneur and Wife - USA Herald

Americans Wrongly Detained Abroad: Brittney Griner’s Urgent Call for Action - USA Herald

Israel Gaza Update: On October 7 Hamas raped and mutilated women - USA Herald

Bug Bounty Program

Bug bounty programs have become instrumental in identifying and mitigating potential threats. 

Companies like Google have actively embraced these programs, offering substantial rewards to researchers who uncover vulnerabilities. In 2022 alone, Google disbursed over $12 million to those who reported flaws in Android and Chrome, emphasizing the importance of community collaboration in bolstering digital defenses.

Google pays bug hunters to report such issues. In 2022, the company shelled out cash to researchers who discovered vulnerabilities in Android. Google also paid out to those who found bugs in Chrome, as well.

$12 million doesn’t seem like much when compared to Google's 2022 revenue of about $280 billion. The investment makes a lot of sense for the tech giant. Actively exploited vulnerabilities pose a much greater risk to the company's bottom line than any rewards program could ever be.

Newlin finds old Bluetooth bug

Despite the advances in cybersecurity, users often assume their devices are safe and secure with measures like two-factor authentication.

However, the recent revelation of a bug dating back to at least 2012 challenges this assumption. This bug, identified by bug tracker Marc Newlin, exploits a Bluetooth vulnerability, posing a risk to Android, Linux, MacOS, and iOS devices.

The exploit allows hackers to gain access to Android devices merely by enabling Bluetooth. On Linux, devices become vulnerable if Bluetooth is discoverable, while iOS and MacOS devices with enabled Bluetooth, especially those paired with a Magic Keyboard, are also at risk. 

Newlin brought this issue to Google's attention, leading to a security fix for Android devices running versions 11 through 14. 

Find the fix

Supported Pixel devices are expected to receive the patch in December's security update. However, devices operating on older Android versions remain vulnerable. Shockingly, ChromeOS is the sole Linux-based OS that has been patched, leaving popular distros like Ubuntu, Debian, Fedora, and Gentoo exposed to potential hacking threats.

While Apple has been made aware of the issue, a definitive timeline for a patch remains elusive. This revelation underscores the need for users to stay vigilant about potential security issues on their devices.

Bug bounty programs, like the one offered by Google, play a crucial role in fortifying digital security. By rewarding researchers for uncovering vulnerabilities, these programs encourage a proactive approach to identifying and resolving potential threats. 

Vicki Li is a Senior Security Engineer at Instacart. She got her start as a bug hunter. She wrote, Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities. Li is teaching white hat hackers how to become a bug bounty hunter.