Google goes hunting for software flaws across the web
By M.G. | SAN FRANCISCO
IN OUR special report on cyber-security in this week’s issue of The Economist, we highlighted the threat posed by so-called “zero-day vulnerabilities” in software. Spooks and cyber-criminals love to get their hands on these flaws because they are not yet widely known and so no “patch”, or fix, is available for them. Nefarious types can exploit zero-days to spy on, or steal from, folk using the software in question until such flaws are discovered. Some firms even deliberately go looking for vulnerabilities and then sell this insight to intelligence agencies.
Google is fed up with this state of affairs. The company claims to have seen zero-days used to target human-rights activists and conduct industrial espionage. It has also been targeted by intelligence agencies keen to snoop on everything from web searches to e-mails. So its eagerness to crack down on zero-days is hardly surprising. On July 15th Google announced that it was setting up Project Zero, a team of security researchers dedicated to hunting down zero-days in popular software and bringing their existence to light.
The trickiness with unearthing zero-days is how to report their existence. If a flaw is revealed before a patch is available, then plenty of crooks and spooks alerted to its existence could try to exploit it. Project Zero’s team says it will send reports of flaws it discovers to software makers as fast as possible so that they have time to produce fixes before it posts information about the zero-days to a public database.
Quite how long that delay is will depend on whether the researchers think that a zero-day is already being actively used for espionage or theft. If it looks like bad guys are exploiting it, then Project Zero’s team will give a software company up to a week to get a fix in place; if it appears nobody is actively taking advantage of a zero-day, the software-makers will get longer to come up with a patch.
That Google would look for flaws in its own software is understandable. But why check other code too? The answer is that the safer the web is, the more people are likely to use it, which can only be a good thing for a company whose tentacles now spread into so many different areas of the internet. Google’s researchers have already been involved in the discovery of flaws such as the Heartbleed Bug, a vulnerability discovered earlier this year in a widely used open-source encryption toolkit. Now they look set to take on a broader role as the web’s policemen.
