5 ms·

Off topic but does project zero ever publish vulnerabilities on google products? More and more it seems like they mostly target google's competitors (Firefox, i

Off topic but does project zero ever publish vulnerabilities on google products? More and more it seems like they mostly target google's competitors (Firefox, iOS, etc)

comfydragon 6y ago
Sure. https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html https://googleprojectzero.blogspot.com/2019/11/bad-binder-an... https://googleprojectzero.blogspot.com/2020/02/mitigations-are-attack-surface-too.html https://googleprojectzero.blogspot.com/2020/02/mitigations-a... https://googleprojectzero.blogspot.com/2016/12/chrome-os-exploit-one-byte-overflow-and.html https://googleprojectzero.blogspot.com/2016/12/chrome-os-exp...
jbroman 6y ago
The very first sentence points to a PZ blog post about the Chrome sandbox.
- jgon 6y ago
  The very first sentence points to a PZ blog post about a Windows vulnerability that affects the Chrome sandbox, not an issue with their own code.
  - staticassertion 6y ago
    I suspect from the Chrome security team's perspective there is very little difference, which is why they take significant measures to reduce the Windows kernel attack surface.
  - _jal 6y ago
    Is the claim that PZ is some sort of PR attack on other companies? Because as someone who is highly skeptical of Google's motives a lot of the time, that just seems like a batty take for anyone who is familiar with their work.
    - lawnchair_larry 6y ago
      That’s been the claim for as long as they existed, and one that Microsoft employees like to respond with in the media (and behind closed doors). It’s not true though. I have talked to some of the early PZ folks and they are unwavering in their devotion to sincerely held beliefs that they are making the internet safer. They feel strongly that their hard disclosure deadline is a critical component of this and they stick to those principles, even when it is unfavorable to Google. The only reason that deadline exists is because many vendors have had a long history of taking advantage of researchers who agree to embargo details of their work while the vendors work on a fix. Bugs were going unfixed for years. It has been my observation that this strategy only partially worked. The main thing that happened is that vendors now won’t sit on Google reported vulns, because they know Google are not bluffing, but they’re still generally happy to take their sweet time if the report comes from someone else. I know of some companies who put PZ bugs in a special queue to fast track them. I think it has done a little bit in terms of setting norms for shorter disclosure timelines though.
simcop2387 6y ago
As siblings mentioned they do, I think part of the impression is a bit of a selection bias. Because Google puts itself into so many domains they have many many possible competitors. PZ tries to look at everything so they're bound to also look at google's competitors and find things. So even if they report on both themselves and on competitors, the numbers immediately look like they're reporting more on competitors because the number of companies involved is larger.
albntomat0 6y ago
Here's the post I put together when this same question was asked 6 days ago. All counts are rough numbers. Project zero posts: Google: 24 Apple: 28 Microsoft: 36 I was curious, so I poked around the project zero bug tracker to try to find ground truth about their bug reporting: https://bugs.chromium.org/p/project-zero/issues/list https://bugs.chromium.org/p/project-zero/issues/list For all issues, including closed: product=Android returns 81 results product=iOS returns 58 vendor=Apple returns 380 vendor=Google returns 145 (bugs in Samsung's Android kernel,etc. are tracked separately) vendor=Linux return 54 To be fair, a huge number of things make this not an even comparison, including the underlying bug rate, different products and downstream Android vendors being tracked separately. Also, # bugs found != which ones they choose to write about.

Off topic but does project zero ever publish vulnerabilities on google products? More and more it seems like they mostly target google's competitors (Firefox, iOS, etc)

comfydragon 6y ago

Sure. https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html https://googleprojectzero.blogspot.com/2019/11/bad-binder-an... https://googleprojectzero.blogspot.com/2020/02/mitigations-are-attack-surface-too.html https://googleprojectzero.blogspot.com/2020/02/mitigations-a... https://googleprojectzero.blogspot.com/2016/12/chrome-os-exploit-one-byte-overflow-and.html https://googleprojectzero.blogspot.com/2016/12/chrome-os-exp...

jbroman 6y ago

The very first sentence points to a PZ blog post about the Chrome sandbox.

jgon 6y ago
The very first sentence points to a PZ blog post about a Windows vulnerability that affects the Chrome sandbox, not an issue with their own code.
- staticassertion 6y ago
  I suspect from the Chrome security team's perspective there is very little difference, which is why they take significant measures to reduce the Windows kernel attack surface.
- _jal 6y ago
  Is the claim that PZ is some sort of PR attack on other companies? Because as someone who is highly skeptical of Google's motives a lot of the time, that just seems like a batty take for anyone who is familiar with their work.
  - lawnchair_larry 6y ago
    That’s been the claim for as long as they existed, and one that Microsoft employees like to respond with in the media (and behind closed doors). It’s not true though. I have talked to some of the early PZ folks and they are unwavering in their devotion to sincerely held beliefs that they are making the internet safer. They feel strongly that their hard disclosure deadline is a critical component of this and they stick to those principles, even when it is unfavorable to Google. The only reason that deadline exists is because many vendors have had a long history of taking advantage of researchers who agree to embargo details of their work while the vendors work on a fix. Bugs were going unfixed for years. It has been my observation that this strategy only partially worked. The main thing that happened is that vendors now won’t sit on Google reported vulns, because they know Google are not bluffing, but they’re still generally happy to take their sweet time if the report comes from someone else. I know of some companies who put PZ bugs in a special queue to fast track them. I think it has done a little bit in terms of setting norms for shorter disclosure timelines though.

simcop2387 6y ago

As siblings mentioned they do, I think part of the impression is a bit of a selection bias. Because Google puts itself into so many domains they have many many possible competitors. PZ tries to look at everything so they're bound to also look at google's competitors and find things. So even if they report on both themselves and on competitors, the numbers immediately look like they're reporting more on competitors because the number of companies involved is larger.

albntomat0 6y ago

Here's the post I put together when this same question was asked 6 days ago. All counts are rough numbers. Project zero posts: Google: 24 Apple: 28 Microsoft: 36 I was curious, so I poked around the project zero bug tracker to try to find ground truth about their bug reporting: https://bugs.chromium.org/p/project-zero/issues/list https://bugs.chromium.org/p/project-zero/issues/list For all issues, including closed: product=Android returns 81 results product=iOS returns 58 vendor=Apple returns 380 vendor=Google returns 145 (bugs in Samsung's Android kernel,etc. are tracked separately) vendor=Linux return 54 To be fair, a huge number of things make this not an even comparison, including the underlying bug rate, different products and downstream Android vendors being tracked separately. Also, # bugs found != which ones they choose to write about.