Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home CRM Systems Customer Service Contact Centers Business Intelligence More Topics...
GET RECOGNIZED.
Let an ISACA® certification
elevate your career.

Register today and save
Computing
Cisco UCS Invicta Series flash memory systems
Average Rating:
Rate this article:  
Can Google Put an End to Zero Day Flaws?
Can Google Put an End to Zero Day Flaws?

By Jennifer LeClaire
July 16, 2014 11:37AM

Bookmark and Share
Project Zero is Google's attempt to cut the number people harmed by targeted cyberattacks. "If there is one thing I'd love to see Google wrap into this Project Zero it would be to put more pressure on and to make it easier for its own Android partners to ship security updates to end users," said Paul Ducklin, senior security advisor at Sophos.
 



Google wants the Internet-using world to know that security is a top priority. That’s the message behind the launch of Project Zero, a team of researchers on the prowl for cyber threats and vulnerabilities.

“Beyond securing our own products, interested Googlers also spend some of their time on research that makes the Internet safer, leading to the discovery of bugs like Heartbleed,” Chris Evans, research herder at Google, wrote in a blog post. “The success of that part-time research has led us to create a new, well-staffed team called Project Zero.”

This Needs to Stop

As Evans sees it, you should be able to use the Web without fear that a criminal or state-sponsored actor is exploiting software bugs to infect your computer, steal secrets or monitor your communications. Yet in sophisticated attacks, he noted, Google’s security team see the use of "zero-day" vulnerabilities that do everything from targeting human rights activists to conducting industrial espionage.

“This needs to stop. We think more can be done to tackle this problem,” Evans said. “Project Zero is our contribution, to start the ball rolling. Our objective is to significantly reduce the number of people harmed by targeted attacks. We're hiring the best practically-minded security researchers and contributing 100 percent of their time toward improving security across the Internet.”

Google is promising not to place any particular bounds on the project. The company also vowed to work toward improving the security on any software that large numbers of people depend on. That, Evans said, means paying careful attention to the techniques, targets and motivations of attackers.

“We'll use standard approaches such as locating and reporting large numbers of vulnerabilities,” he said. “In addition, we'll be conducting new research into mitigations, exploitation, program analysis -- and anything else that our researchers decide is a worthwhile investment.”

Google Hiring Security Gurus

Evans also committed to working transparently. That means every bug Project Zero discovers will be filed in an external database. Google will only report bugs to the software’s vendor in as close to real-time as possible, not to third parties. And once a bug report makes its way to the public, which typically happens after a patch is available, you can monitor vendor time-to-fix performance, review discussions about exploitability, and see historical exploits and crash traces.

And with that, Evans made another announcement: Google is hiring.

“We believe that most security researchers do what they do because they love what they do. What we offer that we think is new is a place to do what you love -- but in the open and without distraction. We'll also be looking at ways to involve the wider community, such as extensions of our popular reward initiatives and guest blog posts," he said.

We caught up with Paul Ducklin, senior security advisor at Sophos, to get this thoughts on Project Zero. He told us security-minded individuals and companies like Sophos all try to do their best to go the "extra mile" to give back to the community. Sophos, for example, partnered with the Queensland Police in Australia on a security project.

“If there is one thing I'd love to see Google wrap into this Project Zero it would be to put more pressure on,” Ducklin said, “and to make it easier for its own Android partners to ship security updates to end users."
 

Tell Us What You Think
Comment:

Name:

Bobby Roper:

Posted: 2014-07-17 @ 3:57am PT
How about instead of using google, give a non tracking leave me alone search engine called http://LookSeek.com I will sacrifice a little to get a lot.



Get Powerful App Acceleration with Cisco. In a world where time is money, you need to accelerate the speed at which data moves through your data center. Cisco UCS Invicta delivers powerful, easy-to-manage application acceleration for data-intensive workloads. So you can make decisions faster and outpace the competition. Learn More.


 Computing
1.   Retailers Hacked by New Malware
2.   Oracle To Buy TOA Technologies
3.   IBM Beefs Up Identity Intelligence
4.   USB Security Flaw Uncovered
5.   Tor Internet Privacy Service Breached


advertisement
Amazon Intros Zocalo Storage Service
Online storage and sharing for business.
Average Rating:
IBM Beefs Up Identity Intelligence
To offer biz better security products.
Average Rating:
Tor Internet Privacy Service Breached
Users should assume they're affected.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
New 'Backoff' Malware Slips Undetected into Retail Systems
'Malicious actors' are using a new variety of malware to access consumer payment data remotely through point-of-sale systems, according to a report from the Department of Homeland Security.
 
IBM Beefs Up Identity Intelligence Security Solutions
Big Blue is betting big on identity intelligence. IBM just acquired a private firm with security software to govern user access to apps and data across cloud and on-premise environments.
 
USB Security Flaw Lets Hackers Hijack PCs
Hackers can use the firmware that controls USB functions to take control of computers, say security experts. That means there may be a new class of attack for which there are no defenses.
 

Enterprise Hardware Spotlight
AMD's ARM-Based Opteron Out in $3K Dev Kit
It's dubbed "Seattle" and it's AMD's first 64-bit ARM-based Opteron processor. The low-power chip is being released as part of AMD’s Opteron A1100-series developer kit, and aimed at high-end data center needs.
 
Apple Updates MacBook Pros, Cuts Prices Up to $100
The popular MacBook Pro laptop line just got an update and a price cut of as much as $100. The MacBook Pro with Retina display now includes faster processors and double the memory.
 
Dell, BlackBerry Not Sweating Apple-IBM Alliance
IBM's recent move to partner with Apple to sell iPhones and iPads loaded with corporate applications has excited investors in both companies, but two rivals say they are unperturbed for now.
 

Mobile Technology Spotlight
BlackBerry Messenger Now Available on Windows Phone
BlackBerry's free Messenger chatting and voice app is out of beta and widely available for Windows Phone users, the company said. BBM offers secure messaging, Groups, Voice, Channels and more.
 
Virgin Mobile Offers Custom Smartphone Plans
As the wireless carrier wars continue heating up, Virgin Mobile just threw the customization coal onto the fire. The firm has debuted a no-annual-contract plan with rates based on individual use.
 
Collaboration Provider Asana Revamps Mobile App
Asana, a collaboration software provider started by a Facebook founder, is now out with a rebuilt native iOS mobile app. It replaces one that even the company admits was not up to par.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Contact Centers | Business Intelligence | Sales & Marketing | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.