Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/15/2014
10:10 AM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Google Forms Zero-Day Hacking Team

'Project Zero' to hunt bugs in all software that touches the Net.

Google today revealed a new white-hat security team it has formed that will root out vulnerabilities in all software that touches the Internet.

The search engine giant is recruiting talent for the so-called Project Zero team, which spun out of Google's security research on its own products as well as previous part-time vulnerability research on other vendors' products by some of its researchers.

"Beyond securing our own products, interested Googlers also spend some of their time on research that makes the Internet safer, leading to the discovery of bugs like Heartbleed," says Chris Evans, researcher herder for Google charged with forming the team. "The success of that part-time research has led us to create a new, well-staffed team called Project Zero."

Google plans to hire top security researcher talent that will be focused full-time on "improving security across the Internet," he said in a post today announcing Project Zero.

"We're not placing any particular bounds on this project and will work to improve the security of any software depended upon by large numbers of people, paying careful attention to the techniques, targets and motivations of attackers," Evan said. "We'll use standard approaches such as locating and reporting large numbers of vulnerabilities. In addition, we’ll be conducting new research into mitigations, exploitation, program analysis -- and anything else that our researchers decide is a worthwhile investment."

The goal is to reduce the threat of targeted attacks, he said, and the team will post the vulnerabilities it discovers in an external database, and only report them to the affected vendor. The vulnerabilities likely will become public once the vendor has issued a patch, and Google will provide information on time-to-fix, exploitability, and exploits and other information.

Among the current members of Project Zero is George Hotz, who jailbroke the iPhone in 2007, reverse-engineered the Playstation 3, and found major flaws in Google's Chrome operating system this year, according to a report by Wired today. Renowned researchers Ben Hawkes and Tavis Ormandy also round out the team thus far.

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
brianriley
50%
50%
brianriley,
User Rank: Author
7/23/2014 | 10:59:26 AM
Re: Great news!
This will be a good thing if it leads to organizations incorporating or augmenting processes that significantly reduce the number of bugs that make it out the door with their products. Do all bugs need to be eliminated? No, that is not always practical, feasible, or appropriate. Organizations should at least address the ones that impact safety and/or security.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/16/2014 | 9:30:42 AM
getting access to the vuln database
Kelly -- Who has access to the project zero vulnerabiity db? Is it just the Zero-day team or can other legitimate parties participate in some way?
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
7/15/2014 | 4:38:33 PM
Re: Great news!
Excellent initiative ... but we are in a era in which trust someone is very dangerous.

Do you trust this team?

qui custodiet ipsos custodes?
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
7/15/2014 | 10:37:41 AM
Great news!
This is a great step in the right direction, however, it is not the whole journey.  While the creation of this team will put a large spotlight on security research it will not solve the problem on its own.  We need other companies to realize the importance of information security and instill it into every facet of their operations.  Once that is a reality we will finally be headed in the right direction.
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31458
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...