4 ms·
> Just building silicon doesn't make you a security expert, clearly. What about building silicon and have the project zero level security experts in house?
by pkaye 7y ago
> Just building silicon doesn't make you a security expert, clearly.
What about building silicon and have the project zero level security experts in house?
- fataliss 7y agoBut do they though? Does project zero review all products made by google on top of the rest of the web? I doubt their oversight happens at the silicon designing stages. Maybe once it's out they battle test it, but I doubt it'd happen before that.
- delroth 7y agoProject Zero is a tiny subset of Google's security team. And while they do have an unusual concentration of extremely competent security researchers, it's not like they are the only competent security researchers/engineers in the company. Similar research happens internally, at all levels of the stack, including designing silicon (e.g. Titan chips that were shown publicly).
- joatmon-snoo 7y agoGoogle's Elie Burzstein and Jean Michel Picod gave a fascinating talk at Defcon last week about silicon-level SCAs: https://elie.net/talk/a-hackerguide-to-deep-learning-based-side-channel-attacks/ https://elie.net/talk/a-hackerguide-to-deep-learning-based-s... Disclosure: also work at G.
- pkaye 7y agoIts possible the Project Zero team consults or throws ideas to other teams. It is possible Google is able to recruit additional people of similar caliber for the silicon design teams.
- pojzon 7y agoI'll just say this: Samsung has a project zero team that secures their smart TVs for obvious reasons. A friend of mine cracked all their security with his ass on home couch and now works for them as an external security expert. I can cyte one of those "senior security expert architect" from Samsung during their meeting with my friend: "It's not possible you found a level zero vulnerability in our software, we are the best of the best". Few minutes later that security architect was fired.. TL;DR inhouse experts often dont mean much, there is a whole world of even better experts who sit on couch at home and hate corporate world..
- ziddoap 7y agoSometimes I wish this was Reddit, because I would love to send this comment over to r/thathappened. I sincerely doubt your entire story, especially the "few minutes later that security architect was fired" portion.
- pojzon 7y agoYou are right, I have no way to prove that what Im saying is true (beside posting here their contract which would be considered as infringement of it). Still a funny story which helped me look different at security in big corporations.
- sdinsn 7y agoIntel and AMD have security experts too.