10 ms·

Announcing Project Zero

360 points by newscasta 12y ago

TomGullen 12y ago
> Security is a top priority for Google Can't take this seriously any more. Used to like Google, not any more. Remember this was a company co-operating with the NSA.
- bellerocky 12y ago
  > Can't take this seriously any more. Used to like Google, not any more. > Remember this was a company co-operating with the NSA. I don't have the same suspicions you do, and I don't know of any evidence of Google willingly co-operating with the NSA beyond their legal obligation to, but it might make more sense for Google to spin off this team into a non-profit organization that they fund. Project Zero would get more credibility and independence, and maybe more publicity and contributions from the community. Maybe there's some kind of financial benefit for Google separating it out of it's org, but I don't understand corporate structures or finance even a little.
- SEJeff 12y ago
  Cooperating when they had a court order compelling them to. The alternative would be to shut down all services and see people go to jail. They didn't have a choice.
tribaal 12y ago
Good to see Google doing this! Let's hope the bugs found are published in a timely and open fashion. Yes they say it will, but the proof is in the pudding :)
antocv 12y ago
Time for some trust-building with the community, after that um, unpleasant discovery that NSA has been up in that Google, and Google willingly accepted. About Google, Facebook, Apple, Microsoft etc, we have seen the list, Ive got to say, scumbags. They sold us all out and threw us under the bus. Lavabit - a simple company put up more of a fight than a multi billion dollar giant. Never forget.
- jarsin 12y ago
  I don't doubt that their cooperation with the government played a role in them getting a slap on wrist in the wage fixing conspiracy as well.
- viraptor 12y ago
  "unpleasant discovery that NSA has been up in that Google, and Google willingly accepted." [citation needed] Specifically for the willingly accepted part.
  - spacefight 12y ago
    That fibers have been tapped by state actors was well known pre-Snowden (I recall reading a story about how subs were used in Russia etc), yet Google only completed encrypting their private fibers post-Swnoden.
    - viraptor 12y ago
      Sure, but as far as we know Google was not aware of it (it = US internal taping) and introduced encryption of private traffic to counteract it. I'm not aware of articles proving they knew about the taps. Are you? (yes, we can speculate they did, but let's say it like that)
      - spacefight 12y ago
        So the US tapped overseas cables for at least a couple of centuries (http://en.wikipedia.org/wiki/Operation_Ivy_Bells http://en.wikipedia.org/wiki/Operation_Ivy_Bells) and people still feel amused by the MUSCULAR relevations...
    - mike_hearn 12y ago
      The assumption pre-Snowden was that only "hostile states" did that kind of thing, e.g fibres in and out of China were probably tapped, but most of the internet wasn't. Because, you know, search warrants do exist. It's rather arrogant to say "everyone should have known". Snowden's leaks have been making waves for a year solid now exactly because he showed that reality was the worst case scenario only the most extreme of the extreme postulated previously.
melvinmt 12y ago
It reads a bit like they're trying to recruit NSA employees to come work for Google...
- hessenwolf 12y ago
  Hmmm... job-for-life with enforced zealous national patriotism, vs five-year job with enforced zealous corporate patriotism (and everything is so god-damned colourful). They'd have a tough sell to get the NSA employees I would think.
  - tzakrajs 12y ago
    Don't forget the part where they make significantly more money than working for a federal acronym.
    - ForHackernews 12y ago
      The NSA pays quite well, and has excellent benefits. Also, if you want to work on really seriously challenging mathematics outside of academia, the NSA is close to being the only game in town.
      - jonknee 12y ago
        The NSA pays government salaries, if you want real money you need to be at an outside vendor (a la Snowden). I'm sure the benefits are great, but so are Google's. http://www.glassdoor.com/Salary/NSA-Salaries-E41534.htm http://www.glassdoor.com/Salary/NSA-Salaries-E41534.htm http://www.opm.gov/policy-data-oversight/pay-leave/salaries-wages/salary-tables/pdf/2014/GS.pdf http://www.opm.gov/policy-data-oversight/pay-leave/salaries-...
  - mike_hearn 12y ago
    A lot of these people are not American and thus not eligible to be NSA employees, assuming they'd even want to be (obviously not).
liricooli 12y ago
Security is a big issue for all these corporates to the bare minimum degree that would make most people feel secure enough. I don't buy it anymore.
- liricooli 12y ago
  I see the next PR headline: "We found so many bugs in all the vendors' programs. In google, there are no 0 days. Why not switch to our platform ?"
arkem 12y ago
This sounds like a new name (and possibly more executive support) for what those guys have been doing for years now. The guys in that article have been working on finding bugs in non-Google products for a little over two years and you can see their past results through the advisory credits they've received at Microsoft and Adobe as well as from open source projects like FFmpeg. For example see Ben Hawkes on this list of Google CVEs in other companies' products: https://www.google.com/about/appsecurity/research/ https://www.google.com/about/appsecurity/research/
- Chronic29 12y ago
  That's how PR works. You give a new brand name to something old to make it sexy.
- tptacek 12y ago
  My read of the announcement is that they are now hiring vulnerability researchers to work on arbitrary targets, the way security product companies do to staff their research labs. Starting back in the 1990s, companies like ISS and McAfee staffed teams of bugfinders to comb through high-profile software for vulnerabilities, and kept score with advisories (and with IDS/IPS signatures and scanner checks for those bugs, which they'd have a semi-proprietary interest in, since they found them). They'd use this to market their expensive products. The researchers generally had a long leash so long as they were (a) looking at software that customers might care about and (b) were actually finding things. What Google seems to be doing is starting a lab like that, but without the hooks into products and marketing; instead: Google has cash, wants to retain security researchers, and so will throw money at a vulnerability lab run for the common good, partially for the PR win, partially for the knock-on benefits to Google of having lots of good security people, and yes, partially for the good of humanity. (FWIW: I worked at what I think was the industry's first vulnerability lab, at SNI, which eventually became McAfee's vulnerability team).
  - eli 12y ago
    Is working at one of those labs as much fun as it sounds?
p4bl0 12y ago
The HN discussion on the Wired article was interesting: https://news.ycombinator.com/item?id=8035726 https://news.ycombinator.com/item?id=8035726
meritt 12y ago
1) What steps will Google be taking to ensure timely vendor acknowledgement and fixing of issues? It often seems a public disclosure is the only thing which will trigger them to finally act (and then they like to fire back with litigation). If a vendor simply ignores Google, will the bug go unannounced indefinitely? Is there a reasonable timeline in which all bugs - fixed or not - are made public? 2) Will Google take bug submissions from 3rd parties and offer any degree of anonymity and/or protection for the bug-finder? I routinely come across gaping security flaws but when we have an over-zealous judicial system and the CFAA, it's often not worth the personal risk to get something fixed.
- sp332 12y ago
  For point 1, The Hacker News podcast (not related to this site, but Space Rogue's much older Hacker News Network) ran a list of all unresolved advisories in the Zero-Day Initiative older than 30 days. Apparently just being on the list, plus the popularity boost from Space Rogue's podcast, was enough to shame some companies into closing old vulnerabilities.
- amckenna 12y ago
  The answer to #1 is in the wired article about Project Zero: "When Project Zero’s hacker-hunters find a bug, they say they’ll alert the company responsible for a fix and give it between 60 and 90 days to issue a patch before publicly revealing the flaw on the Google Project Zero blog. In cases where the bug is being actively exploited by hackers, Google says it will move much faster, pressuring the vulnerable software’s creator to fix the problem or find a workaround in as little as seven days." http://www.wired.com/2014/07/google-project-zero/ http://www.wired.com/2014/07/google-project-zero/
- tptacek 12y ago
  Regarding point (2): if you're thinking about things like SQLI and XSS vulnerabilities in websites, that's not the kind of research Google is likely to be doing. But if you're thinking about finding memory corruption flaws in software you install on your own machines: you have very little to worry about from the CFAA to begin with.
danielweber 12y ago
They say they are hiring. Where is the job announcement?
- tptacek 12y ago
  If you want to be on that team, don't wait for the job announcement. Actually: don't ever wait for job announcements. :)
- trhaynes 12y ago
  Duo Labs is also hiring. https://labs.duosecurity.com/ https://labs.duosecurity.com/ Email labs@duosecurity.com.
dickinurass 12y ago
TL;DL google will hack the nsa, process their email and server them ads for google security products
saurik 12y ago
> Every bug we discover will be filed in an external database. https://code.google.com/p/google-security-research/issues/list?can=1 https://code.google.com/p/google-security-research/issues/li... I am surprised that they didn't use something (other than Google Code) where one could more easily search by vendor or product, or other kinds of tags like "privilege escalation possible", "CVE-2014-0160", or "stack overflow" (as far as I know Google Code Issues doesn't support tags of any kind; maybe I'm wrong?), but I can see the appeal of using off-the-shelf code from somewhere else in Google.
- hrrsn 12y ago
  Google Code really needs a bit of an overhaul these days.
- vog 12y ago
  As of now, this database contains some strange entries. Probably they have issues with access permissions? 01 | Invalid | This is a test 49 | Invalid | <please do not file bugs here> 50 | Invalid | <please do not file bugs here> 51 | Invalid | Random Guy Has Access To File Bugs 52 | Invalid | Google PR doesn't respond to press inquiries 53 | Invalid | The issue is the blog 54 | Invalid | FR 55 | Invalid | <please do not file bugs here> 56 | Invalid | hello
  - AaronFriel 12y ago
    Google Project Zero has it's Project #1: secure their bug tracker.
Cthulhu_ 12y ago
Another article or comment I read about this (or maybe an interview, IDK) highlighted the main reason behind this endeavour: more bugs squashed means a safer internet, a safer internet means people will be more likely to click on ads. Because ads have a bit of a trust issue; ad networks have been used to distribute malware via legitimate sites, and sites behind ads have frequently been serving malware themselves. So basically similar to other of Google's 'free' endeavours (Chrome, SPDY), this is another project intended to make the web safer, faster, more trusted, which by extension leads to more ad impressions / clicks.
deleted 12y ago
[deleted]

360 points by newscasta 12y ago

> Security is a top priority for Google Can't take this seriously any more. Used to like Google, not any more. Remember this was a company co-operating with the NSA.

bellerocky 12y ago
> Can't take this seriously any more. Used to like Google, not any more. > Remember this was a company co-operating with the NSA. I don't have the same suspicions you do, and I don't know of any evidence of Google willingly co-operating with the NSA beyond their legal obligation to, but it might make more sense for Google to spin off this team into a non-profit organization that they fund. Project Zero would get more credibility and independence, and maybe more publicity and contributions from the community. Maybe there's some kind of financial benefit for Google separating it out of it's org, but I don't understand corporate structures or finance even a little.
SEJeff 12y ago
Cooperating when they had a court order compelling them to. The alternative would be to shut down all services and see people go to jail. They didn't have a choice.

tribaal 12y ago

Good to see Google doing this! Let's hope the bugs found are published in a timely and open fashion. Yes they say it will, but the proof is in the pudding :)

antocv 12y ago

Time for some trust-building with the community, after that um, unpleasant discovery that NSA has been up in that Google, and Google willingly accepted. About Google, Facebook, Apple, Microsoft etc, we have seen the list, Ive got to say, scumbags. They sold us all out and threw us under the bus. Lavabit - a simple company put up more of a fight than a multi billion dollar giant. Never forget.

jarsin 12y ago
I don't doubt that their cooperation with the government played a role in them getting a slap on wrist in the wage fixing conspiracy as well.
viraptor 12y ago
"unpleasant discovery that NSA has been up in that Google, and Google willingly accepted." [citation needed] Specifically for the willingly accepted part.
- spacefight 12y ago
  That fibers have been tapped by state actors was well known pre-Snowden (I recall reading a story about how subs were used in Russia etc), yet Google only completed encrypting their private fibers post-Swnoden.
  - viraptor 12y ago
    Sure, but as far as we know Google was not aware of it (it = US internal taping) and introduced encryption of private traffic to counteract it. I'm not aware of articles proving they knew about the taps. Are you? (yes, we can speculate they did, but let's say it like that)
    - spacefight 12y ago
      So the US tapped overseas cables for at least a couple of centuries (http://en.wikipedia.org/wiki/Operation_Ivy_Bells http://en.wikipedia.org/wiki/Operation_Ivy_Bells) and people still feel amused by the MUSCULAR relevations...
  - mike_hearn 12y ago
    The assumption pre-Snowden was that only "hostile states" did that kind of thing, e.g fibres in and out of China were probably tapped, but most of the internet wasn't. Because, you know, search warrants do exist. It's rather arrogant to say "everyone should have known". Snowden's leaks have been making waves for a year solid now exactly because he showed that reality was the worst case scenario only the most extreme of the extreme postulated previously.

melvinmt 12y ago

It reads a bit like they're trying to recruit NSA employees to come work for Google...

hessenwolf 12y ago
Hmmm... job-for-life with enforced zealous national patriotism, vs five-year job with enforced zealous corporate patriotism (and everything is so god-damned colourful). They'd have a tough sell to get the NSA employees I would think.
- tzakrajs 12y ago
  Don't forget the part where they make significantly more money than working for a federal acronym.
  - ForHackernews 12y ago
    The NSA pays quite well, and has excellent benefits. Also, if you want to work on really seriously challenging mathematics outside of academia, the NSA is close to being the only game in town.
    - jonknee 12y ago
      The NSA pays government salaries, if you want real money you need to be at an outside vendor (a la Snowden). I'm sure the benefits are great, but so are Google's. http://www.glassdoor.com/Salary/NSA-Salaries-E41534.htm http://www.glassdoor.com/Salary/NSA-Salaries-E41534.htm http://www.opm.gov/policy-data-oversight/pay-leave/salaries-wages/salary-tables/pdf/2014/GS.pdf http://www.opm.gov/policy-data-oversight/pay-leave/salaries-...
- mike_hearn 12y ago
  A lot of these people are not American and thus not eligible to be NSA employees, assuming they'd even want to be (obviously not).

liricooli 12y ago

Security is a big issue for all these corporates to the bare minimum degree that would make most people feel secure enough. I don't buy it anymore.

liricooli 12y ago
I see the next PR headline: "We found so many bugs in all the vendors' programs. In google, there are no 0 days. Why not switch to our platform ?"

arkem 12y ago

This sounds like a new name (and possibly more executive support) for what those guys have been doing for years now. The guys in that article have been working on finding bugs in non-Google products for a little over two years and you can see their past results through the advisory credits they've received at Microsoft and Adobe as well as from open source projects like FFmpeg. For example see Ben Hawkes on this list of Google CVEs in other companies' products: https://www.google.com/about/appsecurity/research/ https://www.google.com/about/appsecurity/research/

Chronic29 12y ago
That's how PR works. You give a new brand name to something old to make it sexy.
tptacek 12y ago
My read of the announcement is that they are now hiring vulnerability researchers to work on arbitrary targets, the way security product companies do to staff their research labs. Starting back in the 1990s, companies like ISS and McAfee staffed teams of bugfinders to comb through high-profile software for vulnerabilities, and kept score with advisories (and with IDS/IPS signatures and scanner checks for those bugs, which they'd have a semi-proprietary interest in, since they found them). They'd use this to market their expensive products. The researchers generally had a long leash so long as they were (a) looking at software that customers might care about and (b) were actually finding things. What Google seems to be doing is starting a lab like that, but without the hooks into products and marketing; instead: Google has cash, wants to retain security researchers, and so will throw money at a vulnerability lab run for the common good, partially for the PR win, partially for the knock-on benefits to Google of having lots of good security people, and yes, partially for the good of humanity. (FWIW: I worked at what I think was the industry's first vulnerability lab, at SNI, which eventually became McAfee's vulnerability team).
- eli 12y ago
  Is working at one of those labs as much fun as it sounds?

p4bl0 12y ago

The HN discussion on the Wired article was interesting: https://news.ycombinator.com/item?id=8035726 https://news.ycombinator.com/item?id=8035726

meritt 12y ago

1) What steps will Google be taking to ensure timely vendor acknowledgement and fixing of issues? It often seems a public disclosure is the only thing which will trigger them to finally act (and then they like to fire back with litigation). If a vendor simply ignores Google, will the bug go unannounced indefinitely? Is there a reasonable timeline in which all bugs - fixed or not - are made public? 2) Will Google take bug submissions from 3rd parties and offer any degree of anonymity and/or protection for the bug-finder? I routinely come across gaping security flaws but when we have an over-zealous judicial system and the CFAA, it's often not worth the personal risk to get something fixed.

sp332 12y ago
For point 1, The Hacker News podcast (not related to this site, but Space Rogue's much older Hacker News Network) ran a list of all unresolved advisories in the Zero-Day Initiative older than 30 days. Apparently just being on the list, plus the popularity boost from Space Rogue's podcast, was enough to shame some companies into closing old vulnerabilities.
amckenna 12y ago
The answer to #1 is in the wired article about Project Zero: "When Project Zero’s hacker-hunters find a bug, they say they’ll alert the company responsible for a fix and give it between 60 and 90 days to issue a patch before publicly revealing the flaw on the Google Project Zero blog. In cases where the bug is being actively exploited by hackers, Google says it will move much faster, pressuring the vulnerable software’s creator to fix the problem or find a workaround in as little as seven days." http://www.wired.com/2014/07/google-project-zero/ http://www.wired.com/2014/07/google-project-zero/
tptacek 12y ago
Regarding point (2): if you're thinking about things like SQLI and XSS vulnerabilities in websites, that's not the kind of research Google is likely to be doing. But if you're thinking about finding memory corruption flaws in software you install on your own machines: you have very little to worry about from the CFAA to begin with.

danielweber 12y ago

They say they are hiring. Where is the job announcement?

tptacek 12y ago
If you want to be on that team, don't wait for the job announcement. Actually: don't ever wait for job announcements. :)
trhaynes 12y ago
Duo Labs is also hiring. https://labs.duosecurity.com/ https://labs.duosecurity.com/ Email labs@duosecurity.com.

dickinurass 12y ago

TL;DL google will hack the nsa, process their email and server them ads for google security products

saurik 12y ago

> Every bug we discover will be filed in an external database. https://code.google.com/p/google-security-research/issues/list?can=1 https://code.google.com/p/google-security-research/issues/li... I am surprised that they didn't use something (other than Google Code) where one could more easily search by vendor or product, or other kinds of tags like "privilege escalation possible", "CVE-2014-0160", or "stack overflow" (as far as I know Google Code Issues doesn't support tags of any kind; maybe I'm wrong?), but I can see the appeal of using off-the-shelf code from somewhere else in Google.

hrrsn 12y ago
Google Code really needs a bit of an overhaul these days.
vog 12y ago
As of now, this database contains some strange entries. Probably they have issues with access permissions? 01 | Invalid | This is a test 49 | Invalid | <please do not file bugs here> 50 | Invalid | <please do not file bugs here> 51 | Invalid | Random Guy Has Access To File Bugs 52 | Invalid | Google PR doesn't respond to press inquiries 53 | Invalid | The issue is the blog 54 | Invalid | FR 55 | Invalid | <please do not file bugs here> 56 | Invalid | hello
- AaronFriel 12y ago
  Google Project Zero has it's Project #1: secure their bug tracker.

Cthulhu_ 12y ago

Another article or comment I read about this (or maybe an interview, IDK) highlighted the main reason behind this endeavour: more bugs squashed means a safer internet, a safer internet means people will be more likely to click on ads. Because ads have a bit of a trust issue; ad networks have been used to distribute malware via legitimate sites, and sites behind ads have frequently been serving malware themselves. So basically similar to other of Google's 'free' endeavours (Chrome, SPDY), this is another project intended to make the web safer, faster, more trusted, which by extension leads to more ad impressions / clicks.

deleted 12y ago

[deleted]