Slashdot Mirror
Google's Project Zero Aims To Find Exploits Before Attackers Do
DavidGilbert99 (2607235) writes "Google has announced Project Zero, a group of security experts who will hunt down security flaws in all software which touches the Internet. Among the group is a 24-year-old called George Hotz who shot to fame in 2007 when he was the first to unlock the iPhone before reverse engineering the PlayStation 3."
Quoting the Project Zero announcement: You should be able to use the web without fear that a criminal or state-sponsored actor is exploiting software bugs to infect your computer, steal secrets or monitor your communications. Yet in sophisticated attacks, we see the use of "zero-day" vulnerabilities to target, for example, human rights activists or to conduct industrial espionage. This needs to stop. ...
We're not placing any particular bounds on this project and will work to improve the security of any software depended upon by large numbers of people, paying careful attention to the techniques, targets and motivations of attackers.
All issues will be reported to the usual public vulnerability databases after vendors are given a short period to fix their systems and software.
All software that touches the Internet?
Good luck with that.
Perhaps it'd be more practical to target all commercial off-the-shelf software that touches the Internet.
>> automated software that throws random data at target software for hours on end to find which files cause potentially dangerous crashes.
You could just replace that with "fuzzing tools." :) The "files...cause...crashes" is kind of funny too.
+1 if i had mod points left
how can anyone trust anything these guys say anymore? If they are working with the governments they can never say and if they aren't the history of their involvement is to much to get past.
I for one, from now on will avoid all large american corporate products and services. I will never again trust an american software company, at least before we could believe their agendas we're purely greed for owners/stock holders now we have no idea who's pulling the strings and who's motive is it we need to worry about
...abandoning it in favor of what? What real (or trending) alternatives do you think they'll pick? Phones and fax?
It's not the fall that kills you. It's the sudden stop at the end. -Douglas Adams
So, are they planning on buying copies of said software, and testing it in house?
Or do they think they're going to be doing penetration testing without permission? Because, the last I heard, that was actually illegal.
Lost at C:>. Found at C.
I thought there were stories here about white hat/ black hat the courts don't care - go to jail.( Not that I agree with the rulings) So Google gets a by on the laws?
You don't have to trust them. Even if they don't point out the vulnerabilities that the NSA use, they will point out vulnerabilities that the Russians or Chinese might use, and that's already better than nothing.
The Internet is insecure by design: http://www.worldofends.com/#BM...
Okay, but *eventually* I think they are bound to figure out that a better alternative to this situation is going back to a site-local webmail service instead of a third-party black-box cloud (even if they promise the data stays in your server room).
In this sense, I think it's not a risk but a good thing - people start to realize that giving data to third parties may not be smart.
It's not the fall that kills you. It's the sudden stop at the end. -Douglas Adams
SO I just post my software and these guys do a free security analysis. Cool, now I can be sloppy!
Some drink at the fountain of knowledge. Others just gargle.
Typewriters.
If you're going to specifically call out one person... shouldn't you post publicly under your own account rather than hiding in anonymity? Otherwise you have no credibility.
#DeleteChrome
personally if i had a choice i'd give my data to Russia or China before i gave it to the USA.
america needs power taken away not exclusive rights to this sort of power.
It's not an exclusive right; what's stopping you, or anyone else, from doing the same thing, so you can be sure you're finding *all* the vulnerabilities?
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Interesting, I didn't even consider this possible angle, I always figured they were in kahoots with a government agency but lets not rule out the possibility that google is doing evil for its own benefit and not being coerced by a greater power.
Between Google and the NSA?
"If any question why we died, Tell them because our fathers lied."
If its like their past behaviors, they'll tell everyone unless the government asks them not to under penalty of law - and they'll have the FISA court paperwork to make it stick. After all, Google now has a responsibility to its shareholders to not do illegal things, right? As such, I can't see this as more than a PR stunt.
That is all.
If their history is any indication though, it'll be in Beta for months or years. More than enough time to breed a resistance, develop time travel, and send someone back to protect John.
Defending IP by destroying access to it? That makes sense, RIAA/MPAA. Go to the corner until you can play nice!
all my data will be seized by Google and used for nefarious purposes! call out the National Guard! we are doomed!
if this is supposed to be a new economy, how come they still want my old fashioned money?
Ah yes. "I have no ethics and would do this if I could get away with it, therefore nobody has any ethics and would do this if they could get away with it."
Good logic! The next part is where you try to deflect by calling me naïve.
Google wants to sell us your sploits now?
or even some random hacker/script kiddie.
security is not a binary, more security == better.
Also, the less backdoors exist, the more aparant the ones that do exist are.
If you eliminate all other backdoors except the NSA's, you can be more certain the backdoors that do exist actually belong to the NSA, and the more a single entity relies on a single backdoor is the more likely it will be discovered/found/patched/made irrelivant/worked around.
The poster of "Future Proof Jobs" should have read this subject rather than posting his question.
no, I don't have a sig
I'm glad to hear Google is dedicating resources to finding exploits in Internet softw...hey, wait, where'd my Bitcoins go???
That's bullshit. A lot of people don't even have an account. An account ads nothing.
Look at the statement, not the poster.
If you ignore ACs because they are anonymous - you're an idiot.
I'll reply to you, as you're the closest to the angle I was going for.
Cross-posted from another site, with two more sentences here.
Okay, picking my words a little and hoping I get my tone right...
I get that Google (and Facebook and all kinds of other gangs) are *selling info*. It's sleazy, but to me that's "grey hat". It's "we're psychologically manipulating you to make money, but you knew that but we made the services nice and fun/useful so you don't care". I've been reading a huge Star Trek DS9 Re-Watch overview, and that feels so like a Quark move - he's devious but eventually even he draws his lines.
Secret silent software bugs that only X number of governments even know exist is a whole other level of Black Hat. (Really, somewhere in the combo of Heartbleed and the True-Crypt mess I got grumpier than I have been in a while.)
So Google isn't some poor 12 man op with a lonely tech who was beaten by big guys - behind the sales guys there's a *lot* of tech crunching firepower there. So *maybe* the Agencies have a bit of a lead on them, but I'd bet not as big as those Agencies thought.
It's a fascinating twist - Govt can beat up "little guys" a few at a time in a Divide and Conquer strategy, but what if this story catches on, and then Microsoft and Facebook and Apple and Samsung and your choice of others jump in?
(I put Samsung in there because software bugs know no boundaries, so it's specifically a test of geographic negotiations beyond the US level.)
Short Selling jokes aside, can the US even manage to indict the CEO's of all of US tech? Their dealmaking might just be on the verge of coming to bite them. (There was a TV series about all that, corps, totally owning govt openly and outright.)
When we're not busy snarking in the Basement or the Living Room, having a gaping security flaw in software isn't good for any of these companies. So maybe (making up a name) Gennady Li Chandarovskiyij-Maharujshi is the greatest programmer alive at one of the Agencies, but can he really stand up to a world wide team that's now pissed off??
Going all story fiction for a moment, imagine it:
All these companies, led by the big dogs with little guys lending a spare hour;
CEO's around the world getting royally pissed and saying "our products are dominant enough and we have time to put away our micro-jockeying. Let's spend an entire year and 700 billion dollars/whatever to clean this mess up. Grab anyone who has any legit idea whatsoever about software security and let them do whatever they want (jokes aside), no questions asked including extra perks like the 90's like croissant sandwiches in the break room."
US Govt is slowly winning the PR war against "Anonymous", but what if the Big Tech companies with tips from millions of freelancers all unite and say "Thanks for all the fish, yummy, now watch what you made! We have a worldwide "team" of over a *thousand* software people (and four space aliens, only three of which you know about.) Do you *really* wanna keep doing this? Or can we just get back to selling people's info for money?"
At least in my imagination I wanna believe we're on the verge of Tech calling Govt's bluff that they've been going "Divide and Subdue" too long, and the beautiful part is all the bribery is (mostly) illegal - how can they even pretend to shout about 770 companies and 12,345,845 freelancers all spending an entire year on software security?
So that's my message of daydream hope!
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine