FF Sandbox Escape
googleprojectzero.blogspot.com
FF Sandbox Escape
1–10 of 26 posts
Re: FF Sandbox Escape
#2Off topic but does project zero ever publish vulnerabilities on google products? More and more it seems like they mostly target google's competitors (Firefox, iOS, etc)
Re: FF Sandbox Escape
#3Off topic but does project zero ever publish vulnerabilities on google products? More and more it seems like they mostly target google's competitors (Firefox, iOS, etc)
Re: FF Sandbox Escape
#4Off topic but does project zero ever publish vulnerabilities on google products? More and more it seems like they mostly target google's competitors (Firefox, iOS, etc)
The very first sentence points to a PZ blog post about the Chrome sandbox.
Re: FF Sandbox Escape
#5Off topic but does project zero ever publish vulnerabilities on google products? More and more it seems like they mostly target google's competitors (Firefox, iOS, etc)
As siblings mentioned they do, I think part of the impression is a bit of a selection bias. Because Google puts itself into so many domains they have many many possible competitors. PZ tries to look at everything so they're bound to also look at google's competitors and find things. So even if they report on both themselves and on competitors, the numbers immediately look like they're reporting more on competitors because the number of companies involved is larger.
Re: FF Sandbox Escape
#6Off topic but does project zero ever publish vulnerabilities on google products? More and more it seems like they mostly target google's competitors (Firefox, iOS, etc)
The very first sentence points to a PZ blog post about the Chrome sandbox.
The very first sentence points to a PZ blog post about a Windows vulnerability that affects the Chrome sandbox, not an issue with their own code.
Re: FF Sandbox Escape
#7Earlier quoted context omitted.
The very first sentence points to a PZ blog post about the Chrome sandbox.
The very first sentence points to a PZ blog post about a Windows vulnerability that affects the Chrome sandbox, not an issue with their own code.
I suspect from the Chrome security team's perspective there is very little difference, which is why they take significant measures to reduce the Windows kernel attack surface.
Re: FF Sandbox Escape
#8Earlier quoted context omitted.
The very first sentence points to a PZ blog post about the Chrome sandbox.
The very first sentence points to a PZ blog post about a Windows vulnerability that affects the Chrome sandbox, not an issue with their own code.
Is the claim that PZ is some sort of PR attack on other companies?
Because as someone who is highly skeptical of Google's motives a lot of the time, that just seems like a batty take for anyone who is familiar with their work.
Re: FF Sandbox Escape
#9Off topic but does project zero ever publish vulnerabilities on google products? More and more it seems like they mostly target google's competitors (Firefox, iOS, etc)
Here's the post I put together when this same question was asked 6 days ago. All counts are rough numbers.
Project zero posts:
Google: 24
Apple: 28
Microsoft: 36
I was curious, so I poked around the project zero bug tracker to try to find ground truth about their bug reporting: https://bugs.chromium.org/p/project-zero/issues/list For all issues, including closed:
product=Android returns 81 results
product=iOS returns 58
vendor=Apple returns 380
vendor=Google returns 145 (bugs in Samsung's Android kernel,etc. are tracked separately)
vendor=Linux return 54
To be fair, a huge number of things make this not an even comparison, including the underlying bug rate, different products and downstream Android vendors being tracked separately. Also, # bugs found != which ones they choose to write about.
Re: FF Sandbox Escape
#10Earlier quoted context omitted.
The very first sentence points to a PZ blog post about a Windows vulnerability that affects the Chrome sandbox, not an issue with their own code.
Is the claim that PZ is some sort of PR attack on other companies? Because as someone who is highly skeptical of Google's motives a lot of the time, that just seems like a batty take for anyone who is familiar with their work.
That’s been the claim for as long as they existed, and one that Microsoft employees like to respond with in the media (and behind closed doors). It’s not true though. I have talked to some of the early PZ folks and they are unwavering in their devotion to sincerely held beliefs that they are making the internet safer. They feel strongly that their hard disclosure deadline is a critical component of this and they stick to those principles, even when it is unfavorable to Google.
The only reason that deadline exists is because many vendors have had a long history of taking advantage of researchers who agree to embargo details of their work while the vendors work on a fix. Bugs were going unfixed for years.
It has been my observation that this strategy only partially worked. The main thing that happened is that vendors now won’t sit on Google reported vulns, because they know Google are not bluffing, but they’re still generally happy to take their sweet time if the report comes from someone else. I know of some companies who put PZ bugs in a special queue to fast track them.
I think it has done a little bit in terms of setting norms for shorter disclosure timelines though.