Google's Project Zero to hunt for zero-days

Posted by   Virus Bulletin on   Jul 16, 2014

Bugs to be reported to the vendor only, and to become public once patched.

Google has created a new team, called Project Zero, whose task is to find vulnerabilities in any kind of widely used software and to report them to the respective vendor.

Few subjects in security are as controversial as the disclosure of zero-day vulnerabilities. Some argue that vulnerabilities should always be reported to the affected vendor, and that a 'bug bounty' is a nice, but not mandatory extra. Others say that without a bug bounty rewarding the researchers for their work, they shouldn't report it - and even if there is a reward, the bug should only be reported if the bounty is deemed reasonable.

Indeed, bug bounties aren't the only way researchers can monetize the vulnerabilities they find: there are various entities that will gladly pay for such vulnerabilities, some of which aren't always seen to have the best interests of the average Internet user at heart. This has led to calls to regulate the sale of zero-days, and in response, strongly voiced opinions that such regulation would be a bad idea, and would violate the researchers' right to free speech.

None of the vulnerabilities found by Google will be reported to third-parties, though: only the affected vendor will be notified, and will be given time to patch. Once the bug has been made public (which, Google says, will typically happen "once a patch is available"), it will be added to a public database. This allows anyone to monitor the time it takes vendors to fix vulnerabilities.

Unless you have an interest in the use or sale of vulnerabilities, it is hard not to see this as a good development. Google researchers have already discovered a number of high-profile vulnerabilities, with Heartbleed being the most prominent among them. The fact that they have now set up a team dedicated to finding vulnerabilities is in the interest of Internet users in general, and likely potential victims of targeted attacks in particular.

Posted on 16 July 2014 by Martijn Grooten

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2019 paper: A study of Machete cyber espionage operations in Latin America

At VB2019 in London a group of researchers from the Stratosphere Lab at the Czech Technical University in Prague presented a paper in which they analysed and dissected the cyber espionage activities of an APT group in Latin America through the…

VB2019 paper: The push from fiction for increased surveillance, and its impact on privacy

In a paper presented at VB2019 in London, researchers Miriam Cihodariu (Heimdal Security) and Andrei Bogdan Brad (Code4Romania) looked at how surveillance is represented in fiction and how these representations are shaping people's attitudes to…

VB2019 paper: Oops! It happened again!

At VB2019 in London industry veterans Righard Zwienenberg and Eddy Willems took a detailed look at the relationship between past and current cyber threats. Today, we publish both their paper and the recording of their presentation.

Job vacancy at VB: Security Evangelist

Virus Bulletin is recruiting for a person to be the public face of the company

VB2019 video: Thwarting Emotet email conversation thread hijacking with clustering

At VB2019 in London, ZEROSPAM researchers Pierre-Luc Vaudry and Olivier Coutu discussed how email clustering could be used to detect malicious Emotet emails that hijacked existing email threads. Today we publish the recording of their presentation.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.