4 ms·

This might also be useful to counter the sometimes line of complaint that Google only runs Project Zero to make their competitors look bad. While they found so

This might also be useful to counter the sometimes line of complaint that Google only runs Project Zero to make their competitors look bad. While they found some exploitable bugs on the iPhone here, they also found (and reported) that quite a few systems did not seem currently exploitable. It seems clear this is not a hit job, at least to me.

luch 7y ago
Sorry but it will take more than a blogpost for me to believe it. When P0 recruits two prominent Chrome hackers (Ned Williamson & Samuel Gross) and make them work directly on iOS, it look like a hit team to me.
- dmortin 7y ago
  Only if the guys working on other systems are less talented. If equally talented guys work on other systems then it's not a hit job, and I'm sure google puts its best guys to find holes in google products.
- kbenson 7y ago
  If Google's idea of a hit squad is to pay a few hundred thousand dollars worth of salary to have people do your own bug searching for you and give you a few months to fix it before letting anyone know (or until after you've fixed it, if sooner), then sign any company I'm working for up, and I'm sure there are plenty of other companies that would love the attention too. Apple gets attention from them because a lot of people have apple hardware and software. That means problems there have a higher impact than on some less used product. Apple is more than welcome to respond with its own researchers finding Android and other software bugs, and we'd all be better off if they did.
  - close04 7y ago
    I don't think Apple has a problem with this unless it's irresponsible disclosure. They get a service from P0 and they're quite fast at fixing the issue which works to their advantage. When an exploit is published it will always say "Apple already fixed the issue" which works just great for their image with customers.
    - tptacek 7y ago
      "Responsible disclosure" is an Orwellian term invented by vendors to coerce security researchers, who have no duty to vendors and are virtually never compensated for their work, to conform to the vendor's own schedule and commercial preferences. The better term is "coordinated" (or "uncoordinated") disclosure.
      - close04 7y ago
        Semantics aside I hope the point I was making is clear. By "irresponsible" I meant the regular definition of the word: reckless, or careless. Not following any best practices. Out of personal curiosity, how is "coordinated" mitigating the issue you mentioned? It eliminates the vagueness of "responsible" but seems a lot more strict for the researchers: > The primary tenet of coordinated disclosure is that nobody should be informed about a vulnerability until the software vendor gives their permission
        maxerickson 7y ago
        Notifying people that their devices are vulnerable to something is never reckless or careless or irresponsible. Those words all focus on the fact that 'bad guys' also get notified and ignore that users get notified.
        close04 7y ago
        I think there's a balance to strike here. The fact that security researchers like the Project Zero people don't just publish exploit details and sample codes on day 1 suggests that it might not actually be in the best interest of users to do it. It may actually cause far more damage to the users than giving the manufacturers the standard time to patch. As a matter of fact every such disclosure made "irresponsibly/uncoordinated" on Twitter was universally condemned by security researchers and software providers alike. Doing something "responsibly" isn't just the prerogative or duty of security researchers. It's a general term which means "putting thought into it".
- danw1979 7y ago
  Apple should be performing this kind of research themselves on such a high profile target as iOS. If you let a competitor discover stuff like this then you kind of deserved to get "hit".
- kps 7y ago
  As mentioned in the article, they looked at Android messaging earlier this year: https://googleprojectzero.blogspot.com/2019/03/android-messaging-few-bugs-short-of.html https://googleprojectzero.blogspot.com/2019/03/android-messa...

luch 7y ago

Sorry but it will take more than a blogpost for me to believe it. When P0 recruits two prominent Chrome hackers (Ned Williamson & Samuel Gross) and make them work directly on iOS, it look like a hit team to me.

dmortin 7y ago
Only if the guys working on other systems are less talented. If equally talented guys work on other systems then it's not a hit job, and I'm sure google puts its best guys to find holes in google products.
kbenson 7y ago
If Google's idea of a hit squad is to pay a few hundred thousand dollars worth of salary to have people do your own bug searching for you and give you a few months to fix it before letting anyone know (or until after you've fixed it, if sooner), then sign any company I'm working for up, and I'm sure there are plenty of other companies that would love the attention too. Apple gets attention from them because a lot of people have apple hardware and software. That means problems there have a higher impact than on some less used product. Apple is more than welcome to respond with its own researchers finding Android and other software bugs, and we'd all be better off if they did.
- close04 7y ago
  I don't think Apple has a problem with this unless it's irresponsible disclosure. They get a service from P0 and they're quite fast at fixing the issue which works to their advantage. When an exploit is published it will always say "Apple already fixed the issue" which works just great for their image with customers.
  - tptacek 7y ago
    "Responsible disclosure" is an Orwellian term invented by vendors to coerce security researchers, who have no duty to vendors and are virtually never compensated for their work, to conform to the vendor's own schedule and commercial preferences. The better term is "coordinated" (or "uncoordinated") disclosure.
    - close04 7y ago
      Semantics aside I hope the point I was making is clear. By "irresponsible" I meant the regular definition of the word: reckless, or careless. Not following any best practices. Out of personal curiosity, how is "coordinated" mitigating the issue you mentioned? It eliminates the vagueness of "responsible" but seems a lot more strict for the researchers: > The primary tenet of coordinated disclosure is that nobody should be informed about a vulnerability until the software vendor gives their permission
      - maxerickson 7y ago
        Notifying people that their devices are vulnerable to something is never reckless or careless or irresponsible. Those words all focus on the fact that 'bad guys' also get notified and ignore that users get notified.
        close04 7y ago
        I think there's a balance to strike here. The fact that security researchers like the Project Zero people don't just publish exploit details and sample codes on day 1 suggests that it might not actually be in the best interest of users to do it. It may actually cause far more damage to the users than giving the manufacturers the standard time to patch. As a matter of fact every such disclosure made "irresponsibly/uncoordinated" on Twitter was universally condemned by security researchers and software providers alike. Doing something "responsibly" isn't just the prerogative or duty of security researchers. It's a general term which means "putting thought into it".
danw1979 7y ago
Apple should be performing this kind of research themselves on such a high profile target as iOS. If you let a competitor discover stuff like this then you kind of deserved to get "hit".
kps 7y ago
As mentioned in the article, they looked at Android messaging earlier this year: https://googleprojectzero.blogspot.com/2019/03/android-messaging-few-bugs-short-of.html https://googleprojectzero.blogspot.com/2019/03/android-messa...