5 ms·

How did they even discover this in the first place? Fuzzing every software they use? I know Google has a team dedicated to find exploits...

• krasin 12y ago
  I guess it's related to Project Zero: http://googleprojectzero.blogspot.com/ http://googleprojectzero.blogspot.com/
  • DrewHintz 12y ago
    It's not actually related to Project Zero. There are quite a few people here at Google, both on Project Zero and on other projects and teams, that routinely find vulnerabilities. Here's a list of some of the vulnerabilities: http://www.google.com/about/appsecurity/research/ http://www.google.com/about/appsecurity/research/
• chadillac 12y ago
  They are very likely maintaining their own apt repos internally, might have been a bug in one of their packages or something that triggered quirkiness, warranting review. Also, ProjectZero...
• valarauca1 12y ago
  They may have found a way to automate testing software that's more in-depth then say valgrind. Maybe involving machine learning. Most buffer overflow exploits likely rely on common patterns in source code (if you ignore variable names). Which could be taught to a computer. Actually 90% of buffer overflows result in the length of your read and the place of read coming from highly independent sources.
  • toomuchtodo 12y ago
    I just got a shiver thinking about Google's machine learning ingesting most of GNU/Linux source code from distros, and "learning" how to write software better than a human.
    • Phlarp 12y ago
      Machine learning applied to vulnerability research in open source code distributions =/= strong AI.
      • toomuchtodo 12y ago
        Well, maybe not yet. I think its silly to start discounting what level of AI we'll be able to develop with enough computing power and storage. Not to say we'll be able to duplicate biological system levels of computing in silicon, but who knows. Technology is moving pretty damn fast.
        • valarauca1 12y ago
          >but who knows. Technology is moving pretty damn fast. We've been saying this for nearly 70 years. I'm still waiting.
          • toomuchtodo 12y ago
            You can ask your phone for the weather and to change the temperature of your home. You can store your entire music collection on a device the size of a postage stamp (512GB Sandisk MicroSD card). There are cars that can literally drive themselves. There is mini version of the space shuttle that runs completely autonomously in space, and has loitered up there for over a year, waiting to come home when it receives a specially coded signal. IBM has software that is slowly replacing doctors and lawyers. The future is already here.
            • DasIch 12y ago
              Most of these things are solved with simple algorithms though. That we are able to solve a lot of these problems is pretty much inevitable as the technology stack grows and we are able to stick stuff together via APIs. These systems may seem smart or intelligent but really they are just a large complex network of systems. There is nothing intelligent about them. AI of this kind is not just the result of a simple step or several. AI will probably be a revolutionary break through that requires an understanding of intelligence and being, we have not made any significant progress in.
• DrewHintz 12y ago
  Just someone reading source code. Coincidentally, the same way Heartbleed was found.
• peterwwillis 12y ago
  pwillis@zippy:~$ grep -e "^[[:space:]]\+\(strcpy\|strcat\|sprintf\)" -r apt-1.0.1ubuntu2.1 | wc -l 43 Hmm.