Re:How to unc0ver a 0-day in 4 hours or less
by londons_explore on Thursday July 09, 2020 @04:01PM
(#23784449)
Project Zero has uncovered 2033 issues... The majority of those could be used alone to ruin your life. The rest might require 2 (Eg. one for the sandbox, one for the kernel).
Thats a team of ~10 security researchers over many years...
Considering how many are being discovered each day/month/year, chances are that there are at least hundreds undiscovered...
If it only takes one to ruin your life, and a good security researcher can find one in a few weeks, or months at most, the barrier to someone evil is really really low...
Re:How to unc0ver a 0-day in 4 hours or less
by Avamander on Thursday July 09, 2020 @05:21PM
(#23785375)
> good security researcher can find one in a few weeks
s/good/extremely good/
This doesn't change the fact that someone evil will still probably find one.
Re:How to unc0ver a 0-day in 4 hours or less
by londons_explore on Thursday July 09, 2020 @04:58PM
(#23785143)
Most experts have expertise on only one or two different OS's or bits of software.
The found issues will strongly depend who happens to be on the Google Project Zero team at the moment.
Re:How to unc0ver a 0-day in 4 hours or less
by albntomat0 on Thursday July 09, 2020 @05:59PM
(#23785733)
I generally agree, although I think from what I’ve seen, their researchers are pretty flexible.
My post was to counter folks thinking P0 is a Google hit job, which seems to come up frequently on HN.
Re:How to unc0ver a 0-day in 4 hours or less
by empath75 on Friday July 10, 2020 @10:01AM
(#23791520)
Even if Project Zero exclusively focused on competitors, they'd still be providing a valuable service. Maybe Microsoft and Apple should have the same sort of project. If they're all competing at who can break each other's code the worst, that'll end up with better products from all of them.
All counts are rough numbers. Project zero posts:
Google: 24
Apple: 28
Microsoft: 36
I was curious, so I poked around the project zero bug tracker to try to find ground truth about their bug reporting: https://bugs.chromium.org/p/project-zero/issues/list For all issues, including closed:
product=Android returns 81 results
product=iOS returns 58
vendor=Apple returns 380
vendor=Google returns 145 (bugs in Samsung's Android kernel,etc. are tracked separately)
vendor=Linux return 54
To be fair, a huge number of things make this not an even comparison, including the underlying bug rate, different products and downstream Android vendors being tracked separately. Also, # bugs found != which ones they choose to write about.