6 ms·

This sounds like a new name (and possibly more executive support) for what those guys have been doing for years now. The guys in that article have been working

by arkem 12y ago

This sounds like a new name (and possibly more executive support) for what those guys have been doing for years now. The guys in that article have been working on finding bugs in non-Google products for a little over two years and you can see their past results through the advisory credits they've received at Microsoft and Adobe as well as from open source projects like FFmpeg. For example see Ben Hawkes on this list of Google CVEs in other companies' products: https://www.google.com/about/appsecurity/research/ https://www.google.com/about/appsecurity/research/

Chronic29 12y ago
That's how PR works. You give a new brand name to something old to make it sexy.
tptacek 12y ago
My read of the announcement is that they are now hiring vulnerability researchers to work on arbitrary targets, the way security product companies do to staff their research labs. Starting back in the 1990s, companies like ISS and McAfee staffed teams of bugfinders to comb through high-profile software for vulnerabilities, and kept score with advisories (and with IDS/IPS signatures and scanner checks for those bugs, which they'd have a semi-proprietary interest in, since they found them). They'd use this to market their expensive products. The researchers generally had a long leash so long as they were (a) looking at software that customers might care about and (b) were actually finding things. What Google seems to be doing is starting a lab like that, but without the hooks into products and marketing; instead: Google has cash, wants to retain security researchers, and so will throw money at a vulnerability lab run for the common good, partially for the PR win, partially for the knock-on benefits to Google of having lots of good security people, and yes, partially for the good of humanity. (FWIW: I worked at what I think was the industry's first vulnerability lab, at SNI, which eventually became McAfee's vulnerability team).
- eli 12y ago
  Is working at one of those labs as much fun as it sounds?
  - tptacek 12y ago
    Yes. Tim and I got something like 8 months to do this: http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf ... where we discovered (or were at least first to publish) two whole new attack classes, tracked down something like 6 different super expensive security products and got them up in a lab, designed and implemented a new programming language, and succeeded in giving a giant middle finger to surveillance software. It's the most fun I've had in my whole career. Not for nothing, but working at a software security consultancy is a close second; you lose the freedom to choose your targets (at least 80% of the time), but the work is the same.
    - chrisfosterelli 12y ago
      That's fascinating! I'm curious what sort of education and experience you had to land a job like that, do you mind sharing? I'd love to work in a lab like that one day, but I'm not sure what is considered "good enough" to get a career in security rather than just a hobby.
      - tptacek 12y ago
        I'm entirely self taught. I have a single semester of college. I took psych and political science. :) Here's two starting points: - a reading list: http://amzn.to/cthr46 http://amzn.to/cthr46 - how we hire: http://matasano.com/careers/ http://matasano.com/careers/
        mikevm 12y ago
        What's "A Supposedly Fun Thing I'll Never Do Again" doing there?
        12y ago
- arkem 12y ago
  It could also be that their semi-formal third party security team is now a formal team. Previously it was less than a full time project but more than a 20% project for many of Google's vulnerability researchers. I guess that'd have the same net result though since it's much more feasible to hire for if it's been formalized.

by arkem 12y ago

Chronic29 12y ago

That's how PR works. You give a new brand name to something old to make it sexy.

tptacek 12y ago

My read of the announcement is that they are now hiring vulnerability researchers to work on arbitrary targets, the way security product companies do to staff their research labs. Starting back in the 1990s, companies like ISS and McAfee staffed teams of bugfinders to comb through high-profile software for vulnerabilities, and kept score with advisories (and with IDS/IPS signatures and scanner checks for those bugs, which they'd have a semi-proprietary interest in, since they found them). They'd use this to market their expensive products. The researchers generally had a long leash so long as they were (a) looking at software that customers might care about and (b) were actually finding things. What Google seems to be doing is starting a lab like that, but without the hooks into products and marketing; instead: Google has cash, wants to retain security researchers, and so will throw money at a vulnerability lab run for the common good, partially for the PR win, partially for the knock-on benefits to Google of having lots of good security people, and yes, partially for the good of humanity. (FWIW: I worked at what I think was the industry's first vulnerability lab, at SNI, which eventually became McAfee's vulnerability team).

eli 12y ago
Is working at one of those labs as much fun as it sounds?
- tptacek 12y ago
  Yes. Tim and I got something like 8 months to do this: http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf ... where we discovered (or were at least first to publish) two whole new attack classes, tracked down something like 6 different super expensive security products and got them up in a lab, designed and implemented a new programming language, and succeeded in giving a giant middle finger to surveillance software. It's the most fun I've had in my whole career. Not for nothing, but working at a software security consultancy is a close second; you lose the freedom to choose your targets (at least 80% of the time), but the work is the same.
  - chrisfosterelli 12y ago
    That's fascinating! I'm curious what sort of education and experience you had to land a job like that, do you mind sharing? I'd love to work in a lab like that one day, but I'm not sure what is considered "good enough" to get a career in security rather than just a hobby.
    - tptacek 12y ago
      I'm entirely self taught. I have a single semester of college. I took psych and political science. :) Here's two starting points: - a reading list: http://amzn.to/cthr46 http://amzn.to/cthr46 - how we hire: http://matasano.com/careers/ http://matasano.com/careers/
      - mikevm 12y ago
        What's "A Supposedly Fun Thing I'll Never Do Again" doing there?
        12y ago
arkem 12y ago
It could also be that their semi-formal third party security team is now a formal team. Previously it was less than a full time project but more than a 20% project for many of Google's vulnerability researchers. I guess that'd have the same net result though since it's much more feasible to hire for if it's been formalized.