“Project Zero”的意思、由来-开放百科全书

After finding a number of flaws in software used by many end-users while researching other problems, such as the critical "Heartbleed" vulnerability, Google decided to form a full-time team dedicated to finding such vulnerabilities, not only in Google software but any software used by its users. The new project was announced on 15 July 2014 on Google's security blog.^[2]

While the idea for Project Zero can be traced back to 2010, its establishment fits into the larger trend of Google's counter-surveillance initiatives in the wake of the 2013 global surveillance disclosures by Edward Snowden. The team was formerly headed by Chris Evans, previously head of Google's Chrome security team, who subsequently joined Tesla Motors.^[3] Other notable members include security researchers, such as Ben Hawkes, Ian Beer and Tavis Ormandy.^[5] Hawkes eventually became the team's manager.

Bug finding and reporting

Bugs found by the Project Zero team are reported to the manufacturer and only made publicly visible once a patch has been released^[2] or if 90 days have passed without a patch being released.^[7] The 90-day-deadline is Google's way of implementing responsible disclosure, giving software companies 90 days to fix a problem before informing the public so that users themselves can take necessary steps to avoid attacks.^[7] There are cases when the team discloses flaws even before updates and fixes could be released, leaving users of the compromised system vulnerable.^[4]

Notable members

Past members

Notable discoveries

One of the first Project Zero reports that attracted attention involved a flaw that allowed hackers to take control of software running the Safari browser.^[8] For its efforts, the team, specifically, Beer, was cited in Apple's brief note of thanks.

On 30 September 2014 Google detected a security flaw within Windows 8.1's system call "NtApphelpCacheControl", which allows a normal user to gain administrative access.^[9] Microsoft was notified of the problem immediately but did not fix the problem within 90 days, which meant information about the bug was made publicly available on 29 December 2014.^[7] Releasing the bug to the public elicited a response from Microsoft that they are working on the problem.^[10]

On 19 February 2017 Google discovered a flaw within Cloudflare's reverse proxies,^[11] which caused their edge servers to run past the end of a buffer and return memory that contained private information such as HTTP cookies, authentication tokens, HTTP POST bodies, and other sensitive data. Some of this data was cached by search engines.^[12] A member of the Project Zero team referred to this flaw as Cloudbleed.^[11]

On 27 March 2017 Tavis Ormandy of Project Zero discovered a vulnerability in the popular password manager LastPass.^[13] On 31 March 2017, LastPass announced they had fixed the problem.^[14]

Project Zero was involved in discovering the Meltdown and Spectre vulnerabilities affecting many modern CPUs, which were discovered in mid-2017 and disclosed in early January 2018.^[15] The issue was discovered by Jann Horn independently from the other researchers who reported the security flaw and was scheduled to be published on 9 January 2018 before moving the date up because of growing speculation.^[16]

See also

References

1. ^{{Cite news|url=https://www.wired.com/2014/07/google-project-zero/|title=Meet 'Project Zero,' Google's Secret Team of Bug-Hunting Hackers|last=Greenberg|first=Andy|date=2014-07-15|work=Wired|access-date=2019-03-06|issn=1059-1028}}
2. ^¹²{{cite web|url=http://googleonlinesecurity.blogspot.de/2014/07/announcing-project-zero.html|title= Announcing Project Zero |last=Evans|first=Chris|date=15 July 2014|publisher=Google Online Security Blog|accessdate=4 January 2015}}
3. ^{{Cite web|title = Chris Evans on Twitter|url = https://twitter.com/scarybeasts/status/628980384471105536|accessdate = 2015-09-22}}
4. ^{{Cite web|url=https://www.engadget.com/2019/03/04/google-discloses-high-severity-mac-security-flaw/|title=Google discloses 'high severity' Mac security flaw ahead of patch|last=Fingas|first=John|date=March 4, 2019|website=Engadget|language=en|archive-url=|archive-date=|dead-url=|access-date=2019-03-06}}
5. ^¹²³⁴⁵{{cite web|url=https://www.wired.com/2014/07/google-project-zero/|title=Meet ‘Project Zero,’ Google's Secret Team of Bug-Hunting Hackers|last=Greenberg|first=Andy|date=15 July 2014|publisher=Wired.com|accessdate=4 January 2015}}
6. ^{{cite web|url=https://www.lawfareblog.com/contributors/mtait|title=Lawfareblog Hard National Security Choices Matt Tait|accessdate=9 March 2017}}
7. ^{{cite web|url=https://googleprojectzero.blogspot.com/2017/12/apacolypse-now-exploiting-windows-10-in_18.html|accessdate=18 December 2017|title=aPAColypse now: Exploiting Windows 10 in a Local Network with WPAD/PAC and JScript}}
8. ^{{Cite book|url=https://books.google.com.ph/books?id=8iNIDwAAQBAJ&pg=PT80&dq=Ben+Hawkes+google&hl=en&sa=X&ved=0ahUKEwj1go2P0-7gAhUZ7WEKHWVqCOoQ6AEIOzAD#v=onepage&q=Ben%20Hawkes%20google&f=false|title=TIME Cybersecurity: Hacking, the Dark Web and You|last=TIME|first=The Editors of|date=2018-01-19|publisher=Time Inc. Books|isbn=9781547842414|language=en}}
9. ^{{cite web|url=https://code.google.com/p/google-security-research/issues/detail?id=118|title=Issue 118: Windows: Elevation of Privilege in ahcache.sys/NtApphelpCacheControl |date=30 September 2014|publisher=google-security-research group on code.google.com|accessdate=4 January 2015}}
10. ^¹²³{{cite web|url=https://www.engadget.com/2015/01/02/google-posts-unpatched-microsoft-bug/|title=Google posts Windows 8.1 vulnerability before Microsoft can patch it|last=Dent|first=Steven|date=2 January 2015|publisher=Engadget|accessdate=4 January 2015}}
11. ^¹{{cite web|url=https://bugs.chromium.org/p/project-zero/issues/detail?id=1139|title=Issue 1139: cloudflare: Cloudflare Reverse Proxies are Dumping Uninitialized Memory |date=19 February 2017|publisher=google-security-research group on code.google.com|accessdate=24 February 2017}}
12. ^{{cite web|url=https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/|title=Incident report on memory leak caused by Cloudflare parser bug|date=23 February 2017|publisher=Cloudflare|accessdate=24 February 2017}}
13. ^{{Cite web|url=https://nakedsecurity.sophos.com/2017/03/29/another-hole-opens-up-in-lastpass-that-could-take-weeks-to-fix/|title=Another hole opens up in LastPass that could take weeks to fix|date=2017-03-29|website=Naked Security|access-date=2017-03-29}}
14. ^{{cite web|last1=Siegrist|first1=Joe|title=Security Update for the LastPass Extension|url=https://blog.lastpass.com/2017/03/security-update-for-the-lastpass-extension.html/|website=LastPass Blog|accessdate=2 May 2017|date=31 March 2017}}
15. ^{{Cite news|url=https://www.wired.com/story/critical-intel-flaw-breaks-basic-security-for-most-computers/|title=A Critical Intel Flaw Breaks Basic Security for Most Computers|last=Greenberg|first=Andy|date=2018-01-03|work=WIRED|access-date=2018-01-04|archive-url=|archive-date=|dead-url=|language=en-US}}
16. ^¹{{Cite news|url=https://www.slashgear.com/google-reveals-cpu-security-flaw-meltdown-and-spectre-details-03513512/|title=Google reveals CPU security flaw Meltdown and Spectre details|last=Davies|first=Chris|date=2018-01-03|work=SlashGear|access-date=2018-01-04|archive-url=|archive-date=|dead-url=|language=en-US}}