5 ms·

Google says Apple employee found a zero-day but did not report it

41 points by cdme 3y ago

scrum-treats 3y ago
... how about Google pays more for bug bounty. How about Google actually pays people who report bugs/vulnerabilities. How about Google hires talent that actively tests, discovers and mitigates vulnerabilities rather than pushing that responsibility off on "the community" for considerably less pay. You know: "ownership." There's no "obligation" to report, other than ethics and integrity. That's it. Further, there still exists no obligation for companies to report vulnerabilities as CVEs.
- verdverm 3y ago
  https://googleprojectzero.blogspot.com/p/about-project-zero.html https://googleprojectzero.blogspot.com/p/about-project-zero....
  - scrum-treats 3y ago
    Exactly. So why is Google pushing a presser about Apple "not reporting a zero day" when they have a team (Project Zero) dedicated to discovery of zero days? Is it really that Apple employee's responsibility, or is it Google Project Zero employee's responsibility?
    - verdverm 3y ago
      It's everybody's responsibility to make a safer world. project zero researches vulns in their competitors and responsibly reports them. So why is Apple not reporting vulns to others when others are reporting to them?
      - gumby 3y ago
        > So why is Apple not reporting vulns to others when others are reporting to them? The article includes an explanation. It seems plausible.
        verdverm 3y ago
        almost 3 months to find the right person, get the signatures, and deal with OOO Meanwhile another person reported in a timely manner. plausible versus reasonable?
        gumby 3y ago
        This is apple we're talking about. Some times magnificent, other (most?) times unable to get out of its own way, especially when it doesn't have a process for X. And anything that involves saying anything in public... Obviously they think their silos of secrecy are a net positive, but really I wonder. I do consider them the greatest, or one of the greatest execution machines in business, but I also think that's despite themselves.
      - scrum-treats 3y ago
        > It's everybody's responsibility to make a safer world. > project zero researches vulns in their competitors and responsibly reports them. I agree. Project Zero is a talented group.
    - LargeTomato 3y ago
      No one is perfect. No organization is perfect. US tech companies actively collaborate to improve security.
    - lesuorac 3y ago
      Google doesn't run TechCrunch .... The best you can do is say Google says "this issue was reported by sisu from CTF team HXP and discovered by a member of Apple Security Engineering and Architecture (SEAR) during HXP CTF 2022, which will be acknowledged in the security fix notes for the appropriate Stable channel release at the time they are updated" [1] which really is a nothingburger. [1]: https://bugs.chromium.org/p/chromium/issues/detail?id=1427865#c49 https://bugs.chromium.org/p/chromium/issues/detail?id=142786...
    - someplaceguy 3y ago
      I'm confused. Are you suggesting that having a team dedicated to discovering zero days means that this team will discover all zero days that could possibly exist? Or even, that they will discover all zero days that will be discovered before anyone else discovers them?
- gvb 3y ago
  How about Google hires talent that actively tests, discovers and mitigates vulnerabilities That's Project Zero: https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/ https://en.wikipedia.org/wiki/Project_Zero https://en.wikipedia.org/wiki/Project_Zero
- amf12 3y ago
  > How about Google actually pays people who report bugs/vulnerabilities. That's exactly what Google did. They paid the person who reported it and not discovered it. You can just follow the issue comments to get all your answers. > So why is Google pushing a presser about Apple "not reporting a zero day" Google did not release any "presser", they clarified the situation because there was some confusion about who discovered/reported it - and it didn't even mention Apple: https://bugs.chromium.org/p/chromium/issues/detail?id=1427865#c45 https://bugs.chromium.org/p/chromium/issues/detail?id=142786... In fact, Google is still going to credit the Apple employee for finding it, because they reported it (1451211) after it was fixed: https://bugs.chromium.org/p/chromium/issues/detail?id=1427865#c49 https://bugs.chromium.org/p/chromium/issues/detail?id=142786...
sterlind 3y ago
arbitrary r/w via WebGL, apparently: https://bugs.chromium.org/p/chromium/issues/detail?id=1427865#c49 https://bugs.chromium.org/p/chromium/issues/detail?id=142786... looks like a pretty powerful primitive for only a $10K bounty. what would it go for on Zerodium?
- veave 3y ago
  Tired of so many web technologies that are very rarely used by most users being potential giant gaping security holes.
  - mdaniel 3y ago
    curl https://chromereleases.googleblog.com/search/label/Stable%20updates \ | grep -i "type confusion in v8" I'm pretty sure that ship has sailed; an unholy amount of C++ that runs arbitrary code from the Internet is going as well as can be expected
- Veserv 3y ago
  Why would they pay more than $10k? It only costs ~$10k in engineering resources to find one and they get a steady stream at this level of cost. It is not like paying more and getting more reports improves lacking quality or decreases your defect rate. You can not buy your way to fixing a insecure design all you can do is paper over it. If they paid more then all that would mean is that people would report more of the expected defects. You have to fix reported defects, so you would then need to deploy more engineering resources to fix them even though it will not make a meaningful dent in the number of defects. So, all increasing the payout would do is increase direct costs, increase the number of defects you know about, and increase the number of engineers you need fixing, now known, defects slowing your feature velocity.
  - sterlind 3y ago
    there are a lot of freelance hackers. if companies pay more for bugs than the bad guys, it makes financial sense for hackers to sell bugs to the good guys. $10k seems quite undervalued, and the only reason they're getting any is because of either 1) the moral code of the researchers who find them, or 2) because the prize is a bonus on top of their other motivations (e.g. bragging rights, research funded by governments or universities.) Zerodium pays out up to $200k for a Chrome RCE without sandbox escape. 20x more! that's insanely tempting.
rgovostes 3y ago
CTF is a hobby completely unrelated to professional affiliations. It's shameful of the Google employee in the bug tracker to partially dox and bring the researcher's employer into this.
- lapcat 3y ago
  > CTF is a hobby completely unrelated to professional affiliations. It's shameful of the Google employee in the bug tracker to partially dox and bring the researcher's employer into this. That's not what happened. The TechCrunch article has a statement from the Apple employee: "It was reported on June 5th, through my company. Yes it was late, there are multiple reasons for that. I first had to find the person responsible, the report had to be signed off by people and then the person responsible was OOO." The alleged "dox" occurred on July 7, long after the June 5 bug report to Google from Apple.
  - rgovostes 3y ago
    The article was significantly rewritten after I posted my comment. However the original insinuation is still in the text: > What makes the story of this bug interesting is that it was apparently found by an Apple employee in a Google product, and — for some reason — that Apple employee decided not to report the bug.
firefoxkekw 3y ago
Insanity, a person in their free time, out of the working hours discover a bug, doesn't summit it immediately, the google engineers proceed to call it 'an apple engineer' instead of saying the name of the person, this is politics 101. Funny to see output of years of promoting politics inside a company.
- kramerger 3y ago
  Not insane at all. Just think for a second: ehy would someone withhold a 0day? I understand a 14 years old kid new to security doing this. But this guy is a pro, he knows the rules of responsible disclosure. Why help Google? Because Google routinely reports 0days to apple, making their platform more secure for everyone.
  - someplaceguy 3y ago
    Does anyone know why Google focuses so much effort in finding vulnerabilities in their competitors rather than focusing all energy in securing their own products and services? Is it because they can then publicize their discoveries and make themselves look good (while possibly making their competitors look bad)?
    - kramerger 3y ago
      It really saddens me so read this type of comments on HN of all places. Google has many issues, this is not one of them.
      - someplaceguy 3y ago
        So... what, are you trying to say they do what they do as a form of charity? Trying to improve the security landscape out of the goodness of their hearts, one bug at a time? To be clear, I'm not complaining, obviously I'm grateful for their work. I'm just trying to understand their motivation. As you can probably realize, it's highly unusual behavior for a company to employ an entire team to do what they're doing, without any obvious benefit to the company itself (except perhaps PR value?).
deleted 3y ago
[deleted]

41 points by cdme 3y ago

... how about Google pays more for bug bounty. How about Google actually pays people who report bugs/vulnerabilities. How about Google hires talent that actively tests, discovers and mitigates vulnerabilities rather than pushing that responsibility off on "the community" for considerably less pay. You know: "ownership." There's no "obligation" to report, other than ethics and integrity. That's it. Further, there still exists no obligation for companies to report vulnerabilities as CVEs.

verdverm 3y ago
https://googleprojectzero.blogspot.com/p/about-project-zero.html https://googleprojectzero.blogspot.com/p/about-project-zero....
- scrum-treats 3y ago
  Exactly. So why is Google pushing a presser about Apple "not reporting a zero day" when they have a team (Project Zero) dedicated to discovery of zero days? Is it really that Apple employee's responsibility, or is it Google Project Zero employee's responsibility?
  - verdverm 3y ago
    It's everybody's responsibility to make a safer world. project zero researches vulns in their competitors and responsibly reports them. So why is Apple not reporting vulns to others when others are reporting to them?
    - gumby 3y ago
      > So why is Apple not reporting vulns to others when others are reporting to them? The article includes an explanation. It seems plausible.
      - verdverm 3y ago
        almost 3 months to find the right person, get the signatures, and deal with OOO Meanwhile another person reported in a timely manner. plausible versus reasonable?
        gumby 3y ago
        This is apple we're talking about. Some times magnificent, other (most?) times unable to get out of its own way, especially when it doesn't have a process for X. And anything that involves saying anything in public... Obviously they think their silos of secrecy are a net positive, but really I wonder. I do consider them the greatest, or one of the greatest execution machines in business, but I also think that's despite themselves.
    - scrum-treats 3y ago
      > It's everybody's responsibility to make a safer world. > project zero researches vulns in their competitors and responsibly reports them. I agree. Project Zero is a talented group.
  - LargeTomato 3y ago
    No one is perfect. No organization is perfect. US tech companies actively collaborate to improve security.
  - lesuorac 3y ago
    Google doesn't run TechCrunch .... The best you can do is say Google says "this issue was reported by sisu from CTF team HXP and discovered by a member of Apple Security Engineering and Architecture (SEAR) during HXP CTF 2022, which will be acknowledged in the security fix notes for the appropriate Stable channel release at the time they are updated" [1] which really is a nothingburger. [1]: https://bugs.chromium.org/p/chromium/issues/detail?id=1427865#c49 https://bugs.chromium.org/p/chromium/issues/detail?id=142786...
  - someplaceguy 3y ago
    I'm confused. Are you suggesting that having a team dedicated to discovering zero days means that this team will discover all zero days that could possibly exist? Or even, that they will discover all zero days that will be discovered before anyone else discovers them?
gvb 3y ago
How about Google hires talent that actively tests, discovers and mitigates vulnerabilities That's Project Zero: https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/ https://en.wikipedia.org/wiki/Project_Zero https://en.wikipedia.org/wiki/Project_Zero
amf12 3y ago
> How about Google actually pays people who report bugs/vulnerabilities. That's exactly what Google did. They paid the person who reported it and not discovered it. You can just follow the issue comments to get all your answers. > So why is Google pushing a presser about Apple "not reporting a zero day" Google did not release any "presser", they clarified the situation because there was some confusion about who discovered/reported it - and it didn't even mention Apple: https://bugs.chromium.org/p/chromium/issues/detail?id=1427865#c45 https://bugs.chromium.org/p/chromium/issues/detail?id=142786... In fact, Google is still going to credit the Apple employee for finding it, because they reported it (1451211) after it was fixed: https://bugs.chromium.org/p/chromium/issues/detail?id=1427865#c49 https://bugs.chromium.org/p/chromium/issues/detail?id=142786...

sterlind 3y ago

arbitrary r/w via WebGL, apparently: https://bugs.chromium.org/p/chromium/issues/detail?id=1427865#c49 https://bugs.chromium.org/p/chromium/issues/detail?id=142786... looks like a pretty powerful primitive for only a $10K bounty. what would it go for on Zerodium?

veave 3y ago
Tired of so many web technologies that are very rarely used by most users being potential giant gaping security holes.
- mdaniel 3y ago
  curl https://chromereleases.googleblog.com/search/label/Stable%20updates \ | grep -i "type confusion in v8" I'm pretty sure that ship has sailed; an unholy amount of C++ that runs arbitrary code from the Internet is going as well as can be expected
Veserv 3y ago
Why would they pay more than $10k? It only costs ~$10k in engineering resources to find one and they get a steady stream at this level of cost. It is not like paying more and getting more reports improves lacking quality or decreases your defect rate. You can not buy your way to fixing a insecure design all you can do is paper over it. If they paid more then all that would mean is that people would report more of the expected defects. You have to fix reported defects, so you would then need to deploy more engineering resources to fix them even though it will not make a meaningful dent in the number of defects. So, all increasing the payout would do is increase direct costs, increase the number of defects you know about, and increase the number of engineers you need fixing, now known, defects slowing your feature velocity.
- sterlind 3y ago
  there are a lot of freelance hackers. if companies pay more for bugs than the bad guys, it makes financial sense for hackers to sell bugs to the good guys. $10k seems quite undervalued, and the only reason they're getting any is because of either 1) the moral code of the researchers who find them, or 2) because the prize is a bonus on top of their other motivations (e.g. bragging rights, research funded by governments or universities.) Zerodium pays out up to $200k for a Chrome RCE without sandbox escape. 20x more! that's insanely tempting.

rgovostes 3y ago

CTF is a hobby completely unrelated to professional affiliations. It's shameful of the Google employee in the bug tracker to partially dox and bring the researcher's employer into this.

lapcat 3y ago
> CTF is a hobby completely unrelated to professional affiliations. It's shameful of the Google employee in the bug tracker to partially dox and bring the researcher's employer into this. That's not what happened. The TechCrunch article has a statement from the Apple employee: "It was reported on June 5th, through my company. Yes it was late, there are multiple reasons for that. I first had to find the person responsible, the report had to be signed off by people and then the person responsible was OOO." The alleged "dox" occurred on July 7, long after the June 5 bug report to Google from Apple.
- rgovostes 3y ago
  The article was significantly rewritten after I posted my comment. However the original insinuation is still in the text: > What makes the story of this bug interesting is that it was apparently found by an Apple employee in a Google product, and — for some reason — that Apple employee decided not to report the bug.

firefoxkekw 3y ago

Insanity, a person in their free time, out of the working hours discover a bug, doesn't summit it immediately, the google engineers proceed to call it 'an apple engineer' instead of saying the name of the person, this is politics 101. Funny to see output of years of promoting politics inside a company.

kramerger 3y ago
Not insane at all. Just think for a second: ehy would someone withhold a 0day? I understand a 14 years old kid new to security doing this. But this guy is a pro, he knows the rules of responsible disclosure. Why help Google? Because Google routinely reports 0days to apple, making their platform more secure for everyone.
- someplaceguy 3y ago
  Does anyone know why Google focuses so much effort in finding vulnerabilities in their competitors rather than focusing all energy in securing their own products and services? Is it because they can then publicize their discoveries and make themselves look good (while possibly making their competitors look bad)?
  - kramerger 3y ago
    It really saddens me so read this type of comments on HN of all places. Google has many issues, this is not one of them.
    - someplaceguy 3y ago
      So... what, are you trying to say they do what they do as a form of charity? Trying to improve the security landscape out of the goodness of their hearts, one bug at a time? To be clear, I'm not complaining, obviously I'm grateful for their work. I'm just trying to understand their motivation. As you can probably realize, it's highly unusual behavior for a company to employ an entire team to do what they're doing, without any obvious benefit to the company itself (except perhaps PR value?).

deleted 3y ago

[deleted]