3 ms·

>Off the top of my head can not think of any big vulnerabilities found in the last couple years not discovered by Google. Shellshock?

• bostik 9y ago
  That's an interesting one. Original discovery was by Florian Weimer. Many of the Shellshock family bugs were discovered[ß] (IIRC) by Michal Zalewski, after David Wheeler announced that bash was likely infested with a whole bunch of additional parser bugs.[0] MZ is Employed by Google. Now, I think I recall MZ sharing at least some of the details of shellshock family bugs on his blog, so whether it goes under Google's umbrella or not might be subject to interpretation. I believe it's safe to say that the original bug was not discovered by Google, but it's subsequent manifestations, after the first round of fixes, were. 0: https://en.wikipedia.org/wiki/Shellshock_(software_bug) https://en.wikipedia.org/wiki/Shellshock_(software_bug) ß: can you say you "discovered" a bug if you are hunting on an already ripe ground with a fuzzer?
  • euyyn 9y ago
    Why ß though.
    • bostik 9y ago
      Because I wanted to avoid a naked asterisk. Index for references, something else for lesser footnotes. And no possibility to collide with emphasis parsing.