India ranks second in Facebook's $1M bug bounty

Facebook says it paid more than US$1 million to researchers who report bugs on its website, with India ranked second in terms of the number of bug bounty recipients.
The Asian economy was second on the list of countries with the fastest growing number of recipients of Facebook's Bug Bounty program, the social network said in a statement on its website on Friday. The social network had started the program a little more than two years ago to reward security researchers who report issues and encourage people to help keep the site more secure.
"The countries with the fastest growing number of recipients are, in order, the U.S., India, Turkey, Israel, Canada, Germany, Pakistan, Egypt, Brazil, Sweden, and Russia," Collin Greene, security engineer at Facebook, said in the statement, adding that 329 people had been awarded a bounty so far.
Overall, the bug hunters spread across 51 countries, with 20 percent of the bounty paid so far awarded to U.S.-based recipients.
The social network said the program had been more successful than it anticipated, and paid out more than US$1 million in bounties and collaborated with researchers from all around the world to stamp out bugs in their products and infrastructure. "Our Bug Bounty program allows us to harness the talent and perspective of people from all kinds of backgrounds, from all around the world," Greene added.
Industry watchers previously told ZDNet Asia rewarding security researchers to spot website bugs and loopholes could minimize post-breach consequences, but noted that site operators planning such activities could run into privacy and regulatory hurdles.

Android Jelly Bean runs on 40.5 percent of smartphones and tablets

Over 40 percent of Android smartphones and tablets are running on a variant of the latest Jelly Bean version of the operating system, according to statistics from the Google Developer forum.
The statistics showed Jelly Bean has overtaken 2.3 Gingerbread to become the most commonly used variant for the first time. The older Gingerbread version is listed as still running on a hefty 33.1 percent of all Android devices, marking a minor one percent decrease on the 34.1 percent figure recorded in July.
Despite the positive move, the Google mobile OS is still struggling to deal with fragmentation, with 6.5 percent running on Android 4.2 and the latest 4.3 version's share being too low to record. Older versions like Android 4.0.x Ice Cream Sandwich still hold a significant proportion of the Android ecosystem, with the developer stats listing it as running on 23.3 percent of all Android tablets and smartphones.
Such fragmentation is hardly surprising, as data last week revealed there are almost 12,000 unique devices running a variation of Android in the market.
For years now security researchers have listed fragmentation within the Android ecosystem as a key concern, warning it makes it next to impossible to fully secure the platform. This is because the fragmentation and low use of newer versions makes it overly costly and time consuming to release security patches or updates to newly discovered threats.
Such warnings have proven right with numerous vendors listing Android as the most targeted mobile operating system. This phenomenon was showcased earlier in July when Bluebox Security reported finding an Android Master Key vulnerability in 99 percent of all Android devices.
The Master Key bug reportedly affects all smartphones and tablets not running on the latest version of Android. According to security vendor Doctor Web, it is already being actively exploited by cyber criminals.