Google Online Security Blog

Compare this to Symantec's response to issuing signed certificates for google.com[1], where they downplayed the issue and said they only found 3 instances when back over the last decade with a fine tooth comb. Followed by Google finding many more instances just using the certificate transparency logs, answered by Symantec with more doublespeak. [1]: https://googleonlinesecurity.blogspot.com/2015/10/sustaining-digital-c…

They fight back exploit peddlers like Zerodium or criminals who sell their findings to the highest bidder. You know, PR. They're basically do a huge service to their users and software companies by allowing the best exploit finders to focus on some software and then responsibly disclose their findings to the vendors, free of charge. http://googleonlinesecurity.blogspot.de/2014/07/announcing-project-zer… The headline is kinda silly in the sense that if Project Zero focuses on any software in the world, they'll most likely find exploitable vulnerabilities. With Kaspersky the ridiculous thing is that they have stuff compiled without /GS, which e.g. since VS2005 has required you to actively disable it, as it's on by default.

djb aims to write bug-free programs and actively works on improving the process to do so. While Bellard is a great programmer, I don't think Bellard aims to write bug-free programs. See section 8 of http://cr.yp.to/cv/activities-20050107.pdf There are more people who aims to write bug-free programs, but most of them seem to use formal verification. djb seems pretty unique in aiming bug-free programs in normal programming and getting close. Re: Bellard software quality. Fuzzing found 1120 bugs in FFmpeg. While Bellard's code is only small part of entire FFmpeg, FFmpeg is very far from being bug-free. http://googleonlinesecurity.blogspot.com/2014/01/ffmpeg-and-thousand-f…

SEEKING WORK - Remote Need a solid, secure app on multiple platforms, on a tight deadline? I'm your man. One of the winners at SyScan Hardcode 2013 (http://googleonlinesecurity.blogspot.in/2013/05/the-results-.... ) and two-time grand prize winner of Google Code-in Platforms (in order of experience): - Web Applications (Python, Node.js, Frontend/JS, MEAN stack) - Android apps - Cross Platform Desktop Apps (Qt) - I love experimenting. Currently learning Haskell; will gladly pick up whatever your team uses! Accounts: https://github.com/aviraldg, http://stackoverflow.com/users/152873/aviraldg, http://in.linkedin.com/in/aviraldg/ Contact: me [at] aviraldg.com (prefix subject with 'work', please) --- Keyword Soup: C, C++, Python, JavaScript, Node.js, Qt, Django, Flask, Web2py, Android, HTML5, Angular.js

This is great. I'd love to see this extended for natural images with whatever algorithm Google uses for OCR in streetview - http://googleonlinesecurity.blogspot.co.uk/2014/04/street-view-and-rec…

from http://news.ycombinator.com/item?id=3321366: > I think having a bug bounty program is actually a lot better than the vast majority of sites / vendors that don't even have a whitehat [aka responsible] disclosure program, let alone a bug bounty program. It's worth noting that this is just the base bounty - I've seen us pay out a lot more for good discoveries. $500 is also the base that Google and Mozilla offer for their programs (http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w..., http://www.mozilla.org/security/bug-bounty.html). What would be a good price, do you think? I'm not hooked in enough to know what black market prices are like for bugs like this.

They clarified their responsible disclosure policy here in 2010: http://googleonlinesecurity.blogspot.com/2010/07/rebooting-responsible… (tl;dr: 60 days for the vendor to it fix it). Would like to know if they followed it in this case.

I shouldn't have been so harsh, because despite the fact that these techniques are already widely deployed [1], most people don't understand them. In fact I had a conversation with an ffmpeg developer on this forum and he didn't think securing ffmpeg this way was feasible. And I think another reply to my message mistook FFI for IPC, as you did. So the vocabulary hasn't even trickled down to most programmers. Application compartmentalization is certainly difficult in practice, and should be made easier, but it is deployed and it's a lot easier than rewriting all code in a different language. ffmpeg is a great example. It is hideously broken, with thousands of likely security bugs [2]. Now let's compare these two strategies: 1) Rewrite EVERY video codec in Rust 2) Reuse existing code, but run it in a completely untrusted process (no OS privileges), and only communicate with IPC. The claim is that #2 is much more achievable than #1. You could say that #1 takes orders of magnitude more work, which is true, but that doesn't even quite capture it -- it actually scales differently because for #2 you do constant work and get security for ALL video codecs. It's O(1) vs O(n). Why not get secure foundations by 2025 instead of 2035? What I'm arguing for is a hybrid, heterogeneous architecture -- instead of rewriting 100% of code in Rust, rewrite 5% in Rust and isolate the remaining 95%. That gets you a better result which much less effort. These…

> really? so those discussions are all held amongst programmers eager to use these security vulnerabilities to illegally exploit systems? Those discussions tend to occur on different forums. Their absence here is no sign of their absence elsewhere. And for many of us, our biggest issue with Aaron Swartz is not what he did, but how he was treated. > Or are they entirely groups of programmers dedicating their careers to being very worried about the prospect that our systems might not be secure enough? Is that not an ethical position? That's a nice, positive view of security researchers. For what it's worth, it's one I hold myself. But we don't exactly hear a lot about those who skipped the whole "ethical disclosure" debate, of if their specific position is indeed ethical, and went straight to selling exploits to the NSA or criminal enterprise. > I think you're grossly underestimating the scale of crime being perpetrated by banks even very recently. Start with worldwide currency manipulation: http://www.nytimes.com/2015/05/23/opinion/banks-as-felons-or... Meanwhile, global botnets are common enough that we don't hear about most of them in the news - because they're not newsworthy - except for the rare occasions some security researchers manage to put a dent in one of the larger ones. And everyone gets pissed at Microsoft for mishandling no-ip.com's domains in an effort to fight malware. Not to mention the number of times I've heard of account details of services I…

This was indeed a pleasant surprise when I logged into my CloudFlare account. What intrigues me is that CloudFlare missed an opportunity to allow secure self-signed certificates. The new CloudFlare SSL setup allows the origin server to present to CloudFlare's servers either (i) an unverified self-signed certificates; or (ii) a certificate signed by a CA. Neither provides great security. In the former case, a MITM can trivially generate a new self-signed certificate. History has shown the latter case is also problematic, as there have been several events where CAs have generated invalid keys [1]. What would be nice is if I could generate a self-signed certificate and upload the fingerprint(s) to CloudFlare. CloudFlare would could then verify the fingerprint when connecting to my origin server, without needing to trust a CA. Am I missing anything obvious as to why this wouldn't be as secure (or more secure) than the two options CloudFlare has introduced? [1]: For instance: http://googleonlinesecurity.blogspot.com.au/2013/12/further-improving-…

A couple of notes: * This was not a MITM attempt * When traveling laptops, it's more secure to use DNSSEC + Unbound * The author trusts Google with his data, which uses DNSSEC[1], but not DNSSEC because @tptacek said so - fair enough, I trust Dr Bernstein even more than tptacek - but it's a bit contradictory. He should be using OpenDNS which is the only major DNS provider of DNSCurve[2], instead of Google (8.8.8.8 and 8.8.8.4). Also, note, all major DNS providers are collecting data: OpenDNS (also adds a few suspicious redirects when the URL doesn't exist), Google is the leader of world-data mining, etc. The most trustworthy DNS, according to the a research I did some time ago, was/is OpenNIC. At home I run a dnsmasq + unbound (DNSSEC) + OpenNIC DNS's. On my laptop I have a similar configuration which uses by default a local unbound installation when joins every other network except mine. [1] http://googleonlinesecurity.blogspot.cz/2013/03/google-public-dns-now-… [2] http://en.wikipedia.org/wiki/DNSCurve#Deployment [3] http://www.opennicproject.org/

The technique they'd be using to do that would be new to science. Here it is worth pointing out that Google did something awhile ago to make NSA's job much harder (if their goal is to read everyone's mail): they became aggressive advocates for TLS forward secrecy. http://googleonlinesecurity.blogspot.com/2011/11/protecting-data-for-l… TLS forward secrecy involves the ephemeral Diffie Hellman ciphersuites (which your browser supports). Instead of deriving a session key and using the server's RSA key to convey it, the DHE ciphersuites run the DH protocol to derive a session key between the client and the server, and then use the RSA key to sign the exchange ("breaking the tie" if there was a MITM). The RSA key is never used to convey a session key; if you got all of Google's TLS keys, you would not be able to go back in time and decrypt old sessions that used a DHE ciphersuite. It is also worth pointing out that some of the hardest people working in security show business, including Adam Langley and Michal Zalewski and Justin Schuh, people with unimpeachable reputations in my field, work for Google on these problems.

The problem I see with this blog post is something I haven't seen mentioned in the comments. It's not GitHub's place to set policy on what kind of disclosure is or isn't "responsible". Egor Homakov's responsibility is not to GitHub; his responsibility is to other users. His moral duty upon finding a security vulnerability is to act in such a way that other users will be minimally hurt. It appears that he has fulfilled that responsibility spectacularly in this case. GitHub has no business demanding his, or your, agreement to a legal contract that prohibits you from exercising your best judgment in such a case. Furthermore, "responsible disclosure" is a propaganda euphemism for "allowing irresponsible vendors to cover their asses, possibly at the expense of their users". Terms like "responsible disclosure" have no place in a serious discussion. Please see the blog post by the Google security team at http://googleonlinesecurity.blogspot.com/2010/07/rebooting-responsible… for further details.

Google did this just recently: http://googleonlinesecurity.blogspot.com/2011/08/fuzzing-at-scale.html One of the exciting things about working on security at Google is that you have a lot of compute horsepower available if you need it. This is very useful if you’re looking to fuzz something, and especially if you’re going to use modern fuzzing techniques. ... We recently decided to apply the same techniques to fuzz Adobe’s Flash Player, which we include with Chrome in partnership with Adobe. we cranked through 20 terabytes of SWF file downloads followed by 1 week of run time on 2,000 CPU cores to calculate the minimal set of about 20,000 files. Finally, those same 2,000 cores plus 3 more weeks of runtime were put to good work mutating the files in the minimal set (bitflipping, etc.) and generating crash cases. These crash cases included an interesting range of vulnerability categories, including buffer overflows, integer overflows, use-after-frees and object type confusions.

some times ago: http://googleonlinesecurity.blogspot.it/2015/03/maintaining-digital-ce… something scary happening in the background..

See https://labs.ripe.net/Members/stephane_bortzmeyer/dns-censorship-dns-l… Some DNS servers will show you a page about copyright infringement instead of TPB. Years ago, some German DNS servers were null-routing Nazi stuff. The FBI sometimes takes down sites through DNS spoofing aka cache poisoning. But normally, they go after root nameservers. In 2014, the Turkish government banned Twitter and YouTube through DNS cache poisoning: http://googleonlinesecurity.blogspot.com/2014/03/googles-public-dns-in…

Google Security blog post: https://googleonlinesecurity.blogspot.ch/2016/02/cve-2015-7547-glibc-g…

What I call MITMing is decrypting the payload by impersonating the server (or the client if needed) often with the help of a corporate browser that have been instructed to trust this lie. Most of network security appliances do not work like that, and merely listen the traffic (usually mirrored, no need to be in the middle). Pretending that this is OK is like pretending that it is OK to send passwords in plain text because "only a bunch of competent professionals could intercept them". Anyway, Google have proven that this practice can be detected on the server and I'm confident HSTS+such server side detection will make this practice nothing but a waste of money within a few years . (https://googleonlinesecurity.blogspot.nl/2013/12/further-improving-dig…

Distorted text isn't even used in reCAPTCHA all that much anymore -- Google used a Deep Convolutional Neural Network and got over 90% accuracy in reading street numbers in Street View, and 99.8% accuracy in solving distorted text reCAPTCHA (http://arxiv.org/abs/1312.6082). Most users will just check a "I'm not a robot" box now; and if you do get a test, it will likely be a computer vision / image labeling problem: https://googleonlinesecurity.blogspot.com/2014/12/are-you-robot-introd…

They've been working on a browser extension for it: https://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-en… https://github.com/google/end-to-end I don't know what they might do in the future to encourage people to use this, or if they feel that there's a point at which it would be sensible or useful to actively promote it.

Because there is a broadly available patch. See eg https://googleonlinesecurity.blogspot.com/2015/02/feedback-and-data-dr…

yes, but the fallback is a more traditional, image tagging captcha. see https://googleonlinesecurity.blogspot.com/2014/12/are-you-robot-introd…

> Isn't that how most every exploit and virus seen on Android work? Actually, no. Stagefright was about exploiting holes in the parsing of malformed media files (no installation required). Tons of other vulnerabilities were of the form "thing that shouldn't be accessible via JavaScript in the browser/WebView is". Not that there isn't malware that spreads via installation, but Google's "Verify Apps" service (for sideloaded apps) has been quite effective: http://googleonlinesecurity.blogspot.com/2015/04/android-security-stat…

Google's Online Security Blog posted earlier today regarding improving email security including "opportunistic TLS"[1] through the M3AAWG association, which does list the above companies as either sponsors or members[2] 1: https://googleonlinesecurity.blogspot.com/2015/11/new-research-encoura… 2: https://www.m3aawg.org/about/roster

What ever happened to Google's "End-To-End" Chrome extension? https://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-en…

Google recently did something similar with Chrome: https://googleonlinesecurity.blogspot.com/2015/10/simplifying-page-sec… https://news.ycombinator.com/item?id=10381705

Google has done a lot of work [1] with respect to fuzzing ffmpeg because it's included in Chrome. [1] https://googleonlinesecurity.blogspot.com/2014/01/ffmpeg-and-thousand-…

Linked article gives background to [1] which is discussed at [2]. [1] https://googleonlinesecurity.blogspot.com/2015/10/sustaining-digital-c… [2] https://news.ycombinator.com/item?id=10467452

New wannabe CA Entity B can approach an established CA entity A, convince A to sign B's root or intermediate cert, and then B can forge browser-trusted certs for every SSL website on the net that's not pinned. In this case, B is LetsEncrypt and is (hopefully) pretty solid, but that isn't always the case. Earlier this year, it became known that CNNIC had issued a CA cert to MCS Holdings (of Egypt), which then did bad things.[1] The news that everyone is suddenly trusting a new entity B, whether it's some Egyptian IT firm, or LetsEncrypt, comes out of nowhere. Neither cooperation nor even awareness is needed of the major browsers' dev teams. [1] https://googleonlinesecurity.blogspot.com/2015/03/maintaining-digital-…

Some browsers do restrict CAs, see e.g. http://googleonlinesecurity.blogspot.ca/2013/12/further-improving-digi…