Google says Apple employee found a zero-day but did not report it
techcrunch.com
techcrunch.com
There's no "obligation" to report, other than ethics and integrity. That's it. Further, there still exists no obligation for companies to report vulnerabilities as CVEs.
project zero researches vulns in their competitors and responsibly reports them.
So why is Apple not reporting vulns to others when others are reporting to them?
The article includes an explanation. It seems plausible.
Meanwhile another person reported in a timely manner.
plausible versus reasonable?
Obviously they think their silos of secrecy are a net positive, but really I wonder. I do consider them the greatest, or one of the greatest execution machines in business, but I also think that's despite themselves.
> project zero researches vulns in their competitors and responsibly reports them.
I agree. Project Zero is a talented group.
The best you can do is say Google says "this issue was reported by sisu from CTF team HXP and discovered by a member of Apple Security Engineering and Architecture (SEAR) during HXP CTF 2022, which will be acknowledged in the security fix notes for the appropriate Stable channel release at the time they are updated" [1] which really is a nothingburger.
[1]: https://bugs.chromium.org/p/chromium/issues/detail?id=142786...
Or even, that they will discover all zero days that will be discovered before anyone else discovers them?
That's Project Zero: https://googleprojectzero.blogspot.com/
That's exactly what Google did. They paid the person who reported it and not discovered it. You can just follow the issue comments to get all your answers.
> So why is Google pushing a presser about Apple "not reporting a zero day"
Google did not release any "presser", they clarified the situation because there was some confusion about who discovered/reported it - and it didn't even mention Apple: https://bugs.chromium.org/p/chromium/issues/detail?id=142786...
In fact, Google is still going to credit the Apple employee for finding it, because they reported it (1451211) after it was fixed: https://bugs.chromium.org/p/chromium/issues/detail?id=142786...
looks like a pretty powerful primitive for only a $10K bounty. what would it go for on Zerodium?
curl https://chromereleases.googleblog.com/search/label/Stable%20updates \
| grep -i "type confusion in v8"
It is not like paying more and getting more reports improves lacking quality or decreases your defect rate. You can not buy your way to fixing a insecure design all you can do is paper over it.
If they paid more then all that would mean is that people would report more of the expected defects. You have to fix reported defects, so you would then need to deploy more engineering resources to fix them even though it will not make a meaningful dent in the number of defects.
So, all increasing the payout would do is increase direct costs, increase the number of defects you know about, and increase the number of engineers you need fixing, now known, defects slowing your feature velocity.
Zerodium pays out up to $200k for a Chrome RCE without sandbox escape. 20x more! that's insanely tempting.
They would be forced to reallocate feature development engineers and resources to fixing the security defects in Chrome. How will they get promotions if all they do is fix defects instead of shipping new features?
To be less sarcastic, it would also not help. As I said earlier, a bug bounty does not cause quality improvements; you can not buy your way to low defect rates. What a high bug bounty does is provide incentive for high quality (otherwise you have to keep paying), third party validation (same as above), and a low-hanging net (to catch actual low cost flukes). Put another way, a bug bounty is a externally visible metric. It merely indicates and measures, it does not cause.
That's not what happened. The TechCrunch article has a statement from the Apple employee: "It was reported on June 5th, through my company. Yes it was late, there are multiple reasons for that. I first had to find the person responsible, the report had to be signed off by people and then the person responsible was OOO."
The alleged "dox" occurred on July 7, long after the June 5 bug report to Google from Apple.
> What makes the story of this bug interesting is that it was apparently found by an Apple employee in a Google product, and — for some reason — that Apple employee decided not to report the bug.
Funny to see output of years of promoting politics inside a company.
I understand a 14 years old kid new to security doing this. But this guy is a pro, he knows the rules of responsible disclosure.
Why help Google? Because Google routinely reports 0days to apple, making their platform more secure for everyone.
Is it because they can then publicize their discoveries and make themselves look good (while possibly making their competitors look bad)?
Google has many issues, this is not one of them.
To be clear, I'm not complaining, obviously I'm grateful for their work. I'm just trying to understand their motivation.
As you can probably realize, it's highly unusual behavior for a company to employ an entire team to do what they're doing, without any obvious benefit to the company itself (except perhaps PR value?).
My take:
- Project Zero is a public demonstration of their commitment to security. CTOs may be slightly warmer to them as a result.
- It's advertising for IT professionals Google needs to recruit into their own infosec teams. "Come work on internal vuln scanners and PCI compliance and maybe someday you can join the all star analyst team."
- And for the stars, maybe "spend 90 percent of your day Fixing Internet Security, and we'll come to you for expert troubleshooting on our own stuff the other 10 percent of the time" is a compelling recruitment pitch. Notably, the blog post announcing Project Zero concludes with a "we're hiring" paragraph.
- Fixing bugs in Apple products makes their own services more secure in the sense that their most valuable customers come to them through Apple platforms.
- Fixing bugs in open source tech protects their supply chain of crawling the web, making the resulting index available to consumers for search, and pairing searches with real time auctioned ads
- Publicly committing to ethical disclosure and other practices pressures the other 99 percent to match behavior.
- Turning the screws on competitors whose ads touting privacy don't quite match engineering outcomes.
Thank you!