How Google’s ‘Project Zero’ task force races hackers to snuff out bugs

Zero Day Exploits | Spectre, Meltdown | Programming team discussing ideas
Programmers test for bugs before their code enters the wild, but the errors that slip through can become dangerous ‘zero-day’ exploits for hackers.

Programmers test for bugs before their code enters the wild, but the errors that slip through can become

dangerous ‘zero-day’ exploits for hackers.

(in)Secure is a weekly column that dives into the rapidly escalating topic of cybersecurity.

In 2016, Yahoo confirmed it was the victim of a massive cyberattack that put the personal information of 500 million email users at risk. It was one of the biggest thefts of online personal information in the history of the internet. Yet the hack didn’t happen in 2016 — it happened in 2014.

Many of the largest, most sophisticated cyberattacks utilize zero-day exploits.

Upon further investigation, U.S. Senator Mark Warner insisted Yahoo executives knew about the problem before the company was sold to Verizon. History repeated itself with the monumental Equifax breach, where executives sold two million dollars in stock just days after learning of the hack. The question of who knew what — and when they knew it — is of the utmost importance.

Project Zero was created by Google for situations just like this. It’s a cybersecurity task force that acts behind the scenes with the stated goal to “significantly reduce the number of people harmed by attacks.” They don’t do interviews or comment on their work. Instead, the group keeps a low profile. Its findings and impact on the industry, however, are anything but quiet.

The search for zero-day bugs

The beginnings of the group can be traced back to 2014, when the circle of cybersecurity professionals was officially formed inside the halls of Google. According to the group’s manifesto post, the task force was first put together to secure its own products.

Spectre Meltdown

But in light of internet-wide security concerns like Heartbleed, and Edward Snowden’s government surveillance revelations, Google set a new target on zero-day vulnerabilities across the entire industry.

You may not have heard of a “zero-day” vulnerability, but the consequences of them make headlines. It’s a term used in the computer security industry about a bug or vulnerability that’s unknown to the maker of the software. Many of the largest cyberattacks fall into this category of zero-day exploits, often leaving companies, and those who use their products, blind-sided.

When a company finds a vulnerability that moment is known as “day zero” – and for the next 90 days, it’s a ticking time bomb.

This was Intel in July of 2017, when it was alerted of 20-year old bugs in x86 and ARM-based hardware that impact nearly every CPU in circulation. As told by Wired, it was first discovered by Project Zero’s 22-year old hacker, Jann Horn, while diving deep into Intel’s own documentation on its processors. The flaw wasn’t introduced in the company’s latest hardware. It’d been around for years, but no one had noticed – or, at least, no one willing to disclose the flaw publicly instead of using it to their advantage.

Google’s crack team of hackers aren’t the only ones on the hunt for zero-day vulnerabilities. An entire market is built around discovering them, including bug bounty programs implemented by large corporations — and the black-market buying and selling of zero-day vulnerabilities. Even the NSA has been criticized for participating in purchasing zero-day vulnerabilities and stockpiling them for the development of cyberweapons. That’s why Project Zero’s approach to ethics is as important as its ability to spot bugs.

The day-zero countdown clock

Project Zero follows “responsible disclosure,” which has become an industry standard for keeping the public safe from zero-day bugs. After all, releasing vulnerabilities to the public would only help cybercriminals exploit them. Project Zero’s way of side-stepping this is to report the vulnerabilities to manufacturers privately, giving them 90 days to address the bug before it’s made public. The day a company finds out about a vulnerability is known as “day zero” – and for the next 90 days, it’s a ticking time bomb.

The countdown-clock nature of responsible disclosure pushes companies to quickly and effectively deal with the problem before things go public. It’s the reason Intel is being questioned for the way it reacted to the Spectre and Meltdown discoveries. The company never released information to its industry partners or federal government, making its public disclosure in January that much more painful. What if Intel wasn’t on the clock? When would it disclose the problem? Would it ever? We’ll never know for sure, but the company’s delay wasn’t a good look.

Meltdown and Spectre exploit critical vulnerabilities in modern processors. Programs can utilize the exploit to

retrieve valuable sensitive data being processed by the computer. The above gif shows an example of Meltdown stealing data via memory dump.

When the timeline expires, Project Zero publishes the vulnerability as promised, even if it’s not fixed. The task force has found multiple, hackable problems within the Edge web browser, and Microsoft has been slow to act. Thanks to Project Zero’s approach to responsible disclosure, we know about those vulnerabilities now. Microsoft’s security flaws are out in public, for everyone to see – and those read about it may choose to avoid Edge. That kind of public pressure encourages companies to make cybersecurity, and the privacy of its users, a priority.

Project Zero can’t solve malware on its own, of course. This is only Google’s way of “getting the ball rolling” and “doing their part.” There will always be more vulnerabilities, as well as institutions and criminals looking to exploit them for their own agenda. Still, it’s nice to know that as this issue becomes more public, someone is out there hunting for bugs with our security in mind.

Mobile

Think iPhones can’t get viruses? Our expert explains why it could happen

If your iPhone has been acting strangely, then you may be concerned about the possibility it is infected with a virus or some malware. We take a look at just how likely that is and explain why iOS is considered relatively safe.
Home Theater

Here’s what’s new on Hulu and what’s leaving in April 2019

Our complete list of what's new on Hulu for April 2019, our personal favorites, and which titles will be removed will help you catch up on all the site has to offer -- and ensure you don't miss any titles heading into the streaming ether.
Emerging Tech

Don’t get burned! How to back crowdfunding projects the smart way

In the world of crowdfunding, there’s no such thing as a sure thing. There's a million reasons why a project might fail. But with this handy guide, you'll be able to spot the signs of a sketchy project and decrease your chances of getting…
Smart Home

Who should fix Internet of Things cybersecurity? Congress takes a crack at it

The Internet of Things (IoT) continues to be a murky world of networked gizmos, but Congress is trying to highlight the issue with new legislation that would set cybersecurity standards for these devices.
Computing

Is 14 inches the perfect size for a laptop? These 4 laptops might convince you

If you're looking for the best 14-inch laptops, there are a number of factors to consider. You want good battery life, an attractive screen, solid performance, and a good build. Our favorites that do all that and more.
Gaming

Get Corsair’s best mechanical keyboard at a decent discount

From March 17 to 23, you can get one of the best mechanical keyboards around at a great price. The Corsair K95 RGB Platinum is normally $200, but this week you can pick one up from Amazon for $160.
Emerging Tech

Awesome Tech You Can’t Buy Yet: Write music with your voice, make homemade cheese

Check out our roundup of the best new crowdfunding projects and product announcements that hit the web this week. You may not be able to buy this stuff yet, but it sure is fun to gawk!
Computing

Need more from your conference white board? The Surface Hub 2 should have it

The Surface Hub 2 could be the most expensive whiteboard ever made, but it should be a powerful and capable one. With the ability to connect several of the 50-inch displays together, the picture at least, should be gorgeous.
Computing

Teens using Google Docs as the modern version of passing notes in class

Google Docs is reportedly being used by teens as a secret communications app. Instead of passing notes, students are now using the software's live chat function or comment boxes to talk with their friends while in the middle of classes.
Emerging Tech

A.I.-generated text is supercharging fake news. This is how we fight back

A new A.I. tool is reportedly able to spot passages of text written by algorithm. Here's why similar systems might prove essential in a world of fake news created by smart machines.
Computing

Windows updates shouldn't cause problems, but if they do, here's how to fix them

Windows update not working? It's a more common problem than you might think. Fortunately, there are a few steps you can take to troubleshoot it and in this guide we'll break them down for you step by step.
Computing

Here’s how you can watch today’s Nvidia GTC 2019 keynote live

Nvidia's rumored 7nm Ampere graphics could debut soon. The company will be kicking off its GPU Technology conference at 2 p.m. PT today, Monday, March 18, and you can watch the opening keynote here.
Computing

After fourth attack, hacker puts personal records of 26M people up for sale

A serial hacker going by the name of Gnosticplayers is selling the personal data of 26 million people who have been using the services of six different companies from across the world.
Computing

HP’s Omen Mindframe headset keeps your ears chill, but might leave you lukewarm

The Omen Mindframe headset uses HP's FrostCap technology to keep ears cool during long gaming sections. While it delivers on keeping ears cool, it forgets some of the essentials of a quality gaming headset.