Project Zero

Project Zero's exploit reporting is fantastically in-depth: https://googleprojectzero.blogspot.com

Google Project Zero has an excellent blog: https://googleprojectzero.blogspot.com/

This deal isn't about security, it's about data. Google already have one of the best security teams in the industry - Project Zero [0]. They don't need Wiz's "enterprise" expertise for security. This deal is about DATA. Wiz, as a cybersecurity vendor, have full remote access to their customers cloud compute storage (EC2 EBS volumes, etc) in the name of "security scanning" - this is actually part of their unique selling point - "agent-less scanning" which is unlike traditional security tools that require an agent installed in the OS. Instead, Wiz is able to just clone your full data volume and scan it locally in their cloud accounts/VPC. With this deal Google has bought a ton of confidential data from Wiz's customers without their explicit knowledge or approval, and they will use it to improve Google's AI models like Gemini and probably several other products. A year ago Google struck a $60M/yr deal with Reddit to exclusively license their content [1] for the same reason, and that data is probably much smaller and less valuable than the data Wiz has access to from their customers, which include companies like Morgan Stanley, DocuSign, Slack, Plaid, and others. [2] Sources: 0: https://googleprojectzero.blogspot.com 1: https://www.reuters.com/technology/reddit-ai-content-licensing-deal-wi… 2: https://www.wiz.io/customers

Regardless of the punishment of Bolsonaro, I think there's something more important to be discussed here. Brazil's Congress has passed laws determining that e-voting machines would have to print an anonymous proof of your vote, that is displayed to you behind a sealed acrylic viewport, so you can visually confirm it's casting your vote correctly, and then after you press CONFIRM one last time the paper is deposited in a sealead container attached to the voting machine for future inspection by all the political parties. Like this, we would have the best of both worlds: fast vote counting on election day due to e-voting, but an anonymous paper record that could be audited in the following months by all political parties. I used LAWS in plural for a reason; our CONGRESS has passed not one, but TWO laws imposing this measure: 1) Law 12034/2009 2) Law 13165/2015 If you don't believe me, just Google them. What is amazing is that these two laws were deemed inconstitucional by our Supreme Court (?!). See [2]. So, in a democratic country with a functioning congress, the people's representatives have spoken at least twice that they wanted the paper trail attached to our e-voting machines, for auditing purposes. Brazil's Congress is formed by 513 congressman + 81 senate members. Regardless of that, our Supreme Court (11 seats) has deemed that these laws should not be put into place. Twice. I find it also amazing that in 2009, the German Supreme Court decided the exact…

Some exploit authors love writing up their work. For example: https://googleprojectzero.blogspot.com/2016/12/chrome-os-exploit-one-b…

Don't post shallow dismissals. The same company runs Project Zero, which has a major positive security impact. [1]: https://googleprojectzero.blogspot.com/

And? It has a couple of posts a day on average. It's extremely high-level. It's not aggregating the probably hundreds of posts you'd get across the entire corporation. You'd never in a million years want content like this mixed in with that: https://googleprojectzero.blogspot.com/

This is amazing, but there are even wilder ways to run arbitrary code inside a PDF. How about stringing together several thousand segment commands in JBIG2 (one of the image codecs supported in PDF) to create a programmable virtual machine? https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-ze…

For pentesting, often the company hires people to test under an NDA, and keep everything secret because they dont want to be embarassed. There are sone public pentests out there. For example https://www.opentech.fund/impact/security-safety-audits/ If you want to read some really hard core security vuln hunting, see https://googleprojectzero.blogspot.com/

https://googleprojectzero.blogspot.com/ immediately comes to mind (though its not a good example of an anyone set of people)

Everyone has their coordinated disclosure policies, but not all of them are as harsh as Rapid7's. You mentioned Project Zero, it's a great example: >Project Zero follows a 90+30 disclosure deadline policy, which means that a vendor has 90 days after Project Zero notifies them about a security vulnerability to make a patch available to users. If they make a patch available within 90 days, Project Zero will publicly disclose details of the vulnerability 30 days after the patch has been made available to users. https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-poli… Giving vendors 30 days after a fix is a much more user-friendly thing to do then releasing ready-made exploits simultaneously with a patch, isn't it?

plenty. here's one of my favorites: https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhamm… fyi linux being linux is more of an umbrella term for a collection of operating systems, with usually basic linux kernel + additional kernel features + user mode & desktop stuff. many times it isn't a generic linux vuln but something more specific (comparable example is a Samsung-specific vuln which is subtype of Android) unless it's really core linux bug.

Then they'll exploit the webview followed by the sandbox. [1] As of iOS 14, incoming messages are parsed in a tight sandbox [2]. It'll be interesting to hear how this attack got around that. [1] https://en.wikipedia.org/wiki/JailbreakMe [2] https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-i…

https://googleprojectzero.blogspot.com is a good place to start.

I don’t know if I 100% follow or agree with the comparison of iMessage and GitHub actions. But iMessage has had a number of interesting security vulnerabilities over the years in image parsing and deserialization. One example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-ze… Or a story from today: https://news.ycombinator.com/item?id=37425007 So perhaps the similarity between iMessage and GutHub actions is there are a lot of things that could go wrong. In iMessage it’s a pile of memory unsafe code that was not originally designed to withstand attack. In GutHub actions there is a lot of trust in their parties that could potentially be exploited.

How about Google hires talent that actively tests, discovers and mitigates vulnerabilities That's Project Zero: https://googleprojectzero.blogspot.com/ https://en.wikipedia.org/wiki/Project_Zero

My favorite RCE, FORCEDENTRY[0], also involved PDFs. It was the first time I was truly in awe of an exploit. Through a combination of (1) an integer overflow in an open-source PDF compression library, (2) a Turing-complete compression codec, and (3) CoreGraphics noticing that the "gif" in your iMessage is actually a PDF and helpfully decoding it for you, NSO was able to bootstrap a purpose-built virtual machine, upon which they ran their sandbox-escape. I highly recommend reading this post[1] by Project Zero if you haven't already. [0]https://en.wikipedia.org/wiki/FORCEDENTRY [1]https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-ze…

https://maxwelldulin.com/Resources - short summaries of highly technical security posts (4/wk) https://portswigger.net/research - web security research from the geniuses at portswigger (1/wk) https://googleprojectzero.blogspot.com/ - project zero's research (1/mo) https://hn.invades.space/hn_gems_rss.xml - top links extracted from comments on top hn posts (85/wk) https://kevinlynagh.com/ - posts regularly contain a great selection of links (1/mo) http://www.paulgraham.com/ - classics (1/mo) https://www.bellingcat.com/ - open source research (1/mo) https://pudding.cool/ - art using web technology (1/wk) https://www.experimental-history.com/ - psychology (1/wk)

Don't have to look far as to why indeed. Reading Pegasus[0] about Nso groups 0 click exploits used against any dissident journalists in regimes like Morocco, saudi arabia, (was on khashoggi and his partners phones), mexico, france, everywhere. the only thing protecting any of us is those with enough money to purchase software like pegasus don't deem us worthy of the license fee. Soon as anyone rises above that fee your phone is basically live reporting to anyone with enough money. Doesn't lead to a restful nights sleep that book. They fricken built a turing machine out of pdf interpreter components to escape the encapsulation/vm for incoming files.[1] [0] https://www.goodreads.com/book/show/59808055 [1] https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-ze…

> implements a turing machine Just searched for some details, it's amazing, all this inside of a JBIG2 image: "Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations." https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-ze…

Here is an excellent article about Paths on Win32: https://googleprojectzero.blogspot.com/2016/02/the-definitive-guide-on…

The one where they altered a gif to invoke legacy pdf compatibility libraries that was somehow turing complete and used it to bootstrap a VM that performed memory analysis to escape a sandbox was likely the most impressive feat of engineering I have read...ever. I would love to read an entire book about how this was discovered, productized and deployed. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-ze…

Compartmentalization might make chaining the exploit more difficult, but it's certainly not unheard of. There have been exploit chains in the past that manage to jump from the baseband to the main CPU, for example. One of my favorite exploits [0] was from Project Zero where the chain began with a vulnerability in the Apple wireless stack (Broadcom? maybe, but that might be a different exploit I'm thinking of), and ended in arbitrary kernel RCE. In other words, it was "a wormable radio-proximity exploit which allows me to gain complete control over any iPhone in my vicinity." More relevantly to your question, here's a writeup about exploiting a GPU. [1] [0] https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio… [1] https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adre…

There are many comments about potential abuse. I would be curious to know if your team have ever challenged each other to look like a real person accessing a site and the other part of the team tries to detect and block them? If there is anyone that could do this it would be the creators of Headless. Why go through the exercise, one may ask? I believe it would be a critical thinking exercise to improve Headless even more while giving website maintainers a way to opt out of receiving traffic from it. If not your team, have you reached out to see if people from project zero would take on that challenge in their abundance of spare time? [1] [1] - https://googleprojectzero.blogspot.com/

Do you use a modern browser? If so, you use a piece of software that has been exploited many times by attacks in the wild. Those attacks were mostly targeting either a phone OS or Windows or macOS - not because there is anything in desktop Linux that would defend against those attacks, but because it is less popular. Perhaps some attacks did target desktop Linux; it’s hard to tell because few in-the-wild attacks are publicly documented in detail (although Project Zero has a spreadsheet of bugs known to have been exploited in the wild [1]). Regardless, at best you are relying on security by obscurity. And that’s despite the fact that modern browsers already have built-in sandboxing; without it the situation is worse. [1] https://googleprojectzero.blogspot.com/p/0day.html?m=1

This is worth a read if you haven't seen it: pt 1: https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-bro… pt 2: https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-bro… TLDR: Google research exploits wifi firmware of broadcom chip in iphone, then uses that to exploit a driver bug, and manages to root the iphone. All without even connecting it to a specific AP, just from broadcast packets.

Last year we had a great public example of why eliminating attack surface should always be prioritized over legacy support. Support for a compression format specific to fax machines was used by a government to hack the cell phones of activists. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-ze…

Privileged is the wrong word, but GP is not entirely wrong. What you linked to is only the first part of the exploit and analysis. From the conclusion of the second post, which analyses the sandbox escape: > Perhaps the most striking takeaway is the depth of the attack surface reachable from what would hopefully be a fairly constrained sandbox. [...] The expressive power of NSXPC just seems fundamentally ill-suited for use across sandbox boundaries, even though it was designed with exactly that in mind. [...] (The above is severely cut down, reading at least the entire conclusion or even the whole post is worth it) https://googleprojectzero.blogspot.com/2022/03/forcedentry-sandbox-esc…

No, they use zero-day exploits in common media formats. The spy sends you a message containing an image or pdf, your device parses it, is exploited, and then removes the message, before there ever is a notification about it. You will never know that it ever happened. For example, see FORCEDENTRY, which is one of theirs, and the technical deep dive of it is about the most amazing piece of technical writing released last year: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-ze…

C is a subset of C++. The key point is that both languages suffer from the same problems, e.g. memory safety issues, undefined behavior, data races. The software industry has been dealing with the fallout of these issues for the past three decades. It's about time we moved the bar higher. By the way, the main data structure of my first large Rust program was simply a vector of a custom struct, optimized for memory footprint. Just like in C, with the same low overhead serialization. With C, you always have to be careful to not overrun a buffer. The recent NSS vulnerability is a great example of this: https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happ… Even though this code was heavily fuzzed and tested, the problem slipped through. Not possible in Rust. Also, with Rust you can throw away all your sanitizer infrastructure and save all the associated costs.