4 ms·

Apparently Google Project Zero timeline only applies to others...

Sebb767 5y ago
He reported the issue first on 2020-09-26 [0], nearly a year ago. [0] https://github.com/irsl/gcp-dhcp-takeover-code-exec#timeline https://github.com/irsl/gcp-dhcp-takeover-code-exec#timeline
- _trampeltier 5y ago
  Love the 2020-12-03: ... "holiday season coming up"
deleted 5y ago
[deleted]
viraptor 5y ago
I think you're mixing up the projects a bit. This vulnerability doesn't seem to be going via Project Zero. Other google teams are known to sometimes not react in time and when the reports are going through Project Zero, they are disclosed at 90 days, regardless if the project is internal or not. (I remember an unpatched Chrome vulnerability was published by Project Zero at the end of deadline) So the Zero timeline applies to everyone the same. It doesn't mean fixes actually happen on the same timeline.
- emayljames 5y ago
  parent comment is reffering to the double standards. One rule for google disclosing others vulns, another for their own vulns.
  - atatatat 5y ago
    was this found by, or originally reported to, Project Zero?
    - manquer 5y ago
      Precisely the point OP is saying. The rules for project zero are different not that project zero is applying it differently.
      - UncleMeat 5y ago
        90 days is fairly common in the industry, but not universal. GPZ is definitely not uniquely strict on disclosures.
        manquer 5y ago
        Thsts not problem It is not that project zero is strict, The researcher here allowed 9 months for them to fix. Should he have disclosed after 90 days ? Clearly google didn't use the time to fix. It looks bad when you have a hard policy to disclose but not to fix
        UncleMeat 5y ago
        He could have if he wanted to. He could have disclosed immediately if he wanted to. Google does not have a hard policy to disclose. GPZ does. Vulns in external products found through other groups within Google do not share all the same processes as GPZ.
        manquer 5y ago
        GPZ is not some independent entity google just funds, they are as much part of Google as any other team. If you want to be that precise, it is bad look for part of your organization to have hard policy that you expect external companies to follow, while parts of your organization itself cannot do the same. I am not saying Project Zero is wrong, clearly giving more time did not prod Google to actually fix timely, he certainly was being too polite and gave too much time, I don't know why, perhaps companies don't pay bounties if you disclose without their consent [2] ? All I am just saying Google as a company should hold itself to the same hard standard and fix issues in 90 days this is what Google Project Zero as a team expects other companies[1] to do so, they will even reject requests for extensions. As a company if they can't do it, they shouldn't expect others to do it either right? Or they should disclose reported vulnerabilities even if not fixed in 90 days. [1] Maybe they do it for internal teams as well, but that not relevant to us, all we should be concerned is how they behave externally with disclosing and solving issues. [2] Perhaps part of the reason GPZ is able to do this hard policy is because they don't depend on bug bounties as source of income as independent researchers do.
- breakingcups 5y ago
  Their point is, Project Zero is a very public Google project to hold other companies (and yes, themselves too) accountable with disclosure policies Google (as a company) presumably stands behind. Thus it is quite ironic for an issue to not be fixed in a year. Yes, sometimes other Google teams miss the deadline set by Project Zero too. That's not the point.
deleted 5y ago
[deleted]
jsnell 5y ago
The timeline for disclosure is set by the reporter, no? "We will disclose this bug on YYYY-MM-DD". The other side can ask for an extension, but has no intrinsic right to one. Unless I am missing something, this has nothing to do with PZ, so their default timeline is totally irrelevant.
- Cthulhu_ 5y ago
  I believe PZ can set the terms of reasonable disclosure (and the like) as a condition for paying out.
- manquer 5y ago
  Depends on if you want to get paid. Many organizations will not pay bug bounties if you disclose before they fix or without their consent. Project Zero probably doesn't care or doesn't even accept the bounties
  - jsnell 5y ago
    The post had no indication of a bounty being held hostage. From https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/reward-program/ it seems like the requirement for a bounty is not for "don't disclose before fix is released", but "don't disclose without reasonable advance notice". So I just don't see the inconsistency here. Project Zero gives a disclosure deadline. The reporter here chose not to give one. When they said they wanted to disclose, there was no stalling for extra time. Just what is the expectation here?
tptacek 5y ago
This superficial dismissal doesn't even make sense. Google didn't control the disclosure timeline here. The people who found these vulnerabilities could have published on T+90, or, for that matter, T+1. Meanwhile, the norm that does exist (it's a soft norm) is that you respect the disclosure preferences of the person who reports the vulnerability to the extent you reasonably can. I'm not sure I even understand the impulse behind writing a comment like this. Assume Google simply refuses to apply the P0 disclosure rule to themselves (this isn't the case, but just stipulate). Do you want them to stop funding Project Zero? Do you wish you knew less about high profile vulnerabilities?

He reported the issue first on 2020-09-26 [0], nearly a year ago. [0] https://github.com/irsl/gcp-dhcp-takeover-code-exec#timeline https://github.com/irsl/gcp-dhcp-takeover-code-exec#timeline

_trampeltier 5y ago
Love the 2020-12-03: ... "holiday season coming up"

deleted 5y ago

[deleted]

viraptor 5y ago

I think you're mixing up the projects a bit. This vulnerability doesn't seem to be going via Project Zero. Other google teams are known to sometimes not react in time and when the reports are going through Project Zero, they are disclosed at 90 days, regardless if the project is internal or not. (I remember an unpatched Chrome vulnerability was published by Project Zero at the end of deadline) So the Zero timeline applies to everyone the same. It doesn't mean fixes actually happen on the same timeline.

emayljames 5y ago
parent comment is reffering to the double standards. One rule for google disclosing others vulns, another for their own vulns.
- atatatat 5y ago
  was this found by, or originally reported to, Project Zero?
  - manquer 5y ago
    Precisely the point OP is saying. The rules for project zero are different not that project zero is applying it differently.
    - UncleMeat 5y ago
      90 days is fairly common in the industry, but not universal. GPZ is definitely not uniquely strict on disclosures.
      - manquer 5y ago
        Thsts not problem It is not that project zero is strict, The researcher here allowed 9 months for them to fix. Should he have disclosed after 90 days ? Clearly google didn't use the time to fix. It looks bad when you have a hard policy to disclose but not to fix
        UncleMeat 5y ago
        He could have if he wanted to. He could have disclosed immediately if he wanted to. Google does not have a hard policy to disclose. GPZ does. Vulns in external products found through other groups within Google do not share all the same processes as GPZ.
        manquer 5y ago
        GPZ is not some independent entity google just funds, they are as much part of Google as any other team. If you want to be that precise, it is bad look for part of your organization to have hard policy that you expect external companies to follow, while parts of your organization itself cannot do the same. I am not saying Project Zero is wrong, clearly giving more time did not prod Google to actually fix timely, he certainly was being too polite and gave too much time, I don't know why, perhaps companies don't pay bounties if you disclose without their consent [2] ? All I am just saying Google as a company should hold itself to the same hard standard and fix issues in 90 days this is what Google Project Zero as a team expects other companies[1] to do so, they will even reject requests for extensions. As a company if they can't do it, they shouldn't expect others to do it either right? Or they should disclose reported vulnerabilities even if not fixed in 90 days. [1] Maybe they do it for internal teams as well, but that not relevant to us, all we should be concerned is how they behave externally with disclosing and solving issues. [2] Perhaps part of the reason GPZ is able to do this hard policy is because they don't depend on bug bounties as source of income as independent researchers do.
breakingcups 5y ago
Their point is, Project Zero is a very public Google project to hold other companies (and yes, themselves too) accountable with disclosure policies Google (as a company) presumably stands behind. Thus it is quite ironic for an issue to not be fixed in a year. Yes, sometimes other Google teams miss the deadline set by Project Zero too. That's not the point.

deleted 5y ago

[deleted]

jsnell 5y ago

The timeline for disclosure is set by the reporter, no? "We will disclose this bug on YYYY-MM-DD". The other side can ask for an extension, but has no intrinsic right to one. Unless I am missing something, this has nothing to do with PZ, so their default timeline is totally irrelevant.

Cthulhu_ 5y ago
I believe PZ can set the terms of reasonable disclosure (and the like) as a condition for paying out.
manquer 5y ago
Depends on if you want to get paid. Many organizations will not pay bug bounties if you disclose before they fix or without their consent. Project Zero probably doesn't care or doesn't even accept the bounties
- jsnell 5y ago
  The post had no indication of a bounty being held hostage. From https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/reward-program/ it seems like the requirement for a bounty is not for "don't disclose before fix is released", but "don't disclose without reasonable advance notice". So I just don't see the inconsistency here. Project Zero gives a disclosure deadline. The reporter here chose not to give one. When they said they wanted to disclose, there was no stalling for extra time. Just what is the expectation here?

tptacek 5y ago

This superficial dismissal doesn't even make sense. Google didn't control the disclosure timeline here. The people who found these vulnerabilities could have published on T+90, or, for that matter, T+1. Meanwhile, the norm that does exist (it's a soft norm) is that you respect the disclosure preferences of the person who reports the vulnerability to the extent you reasonably can. I'm not sure I even understand the impulse behind writing a comment like this. Assume Google simply refuses to apply the P0 disclosure rule to themselves (this isn't the case, but just stipulate). Do you want them to stop funding Project Zero? Do you wish you knew less about high profile vulnerabilities?