News and updates from the Project Zero team at Google

Minimalist · Apr 2, 2020

TFW you-get-really-excited-you-patch-diffed-a-0day-used-in-the-wild-but-then-find-out-it-is-the-wrong-vuln

I’m really interested in 0-days exploited in the wild and what we, the security community, can learn about them to make 0-day hard. I explained some of Project Zero’s ideas and goals around in-the-wild 0-days in a November blog post.

On December’s Patch Tuesday, I was immediately intrigued by CVE-2019-1458, a Win32k Escalation of Privilege (EoP), said to be exploited in the wild and discovered by Anton Ivanov and Alexey Kulaev of Kaspersky Lab. Later that day, Kaspersky published a blog post on the exploit. The blog post included details about the exploit, but only included partial details on the vulnerability. My end goal was to do variant analysis on the vulnerability, but without full and accurate details about the vulnerability, I needed to do a root cause analysis first. I tried to get my hands on the exploit sample, but I wasn't able to source a copy.
Click to expand...

https://googleprojectzero.blogspot.com/2020/04/tfw-you-get-really-excited-you-patch.html

Minimalist · Apr 21, 2020

You Won't Believe what this One Line Change Did to the Chrome Sandbox

The Chromium sandbox on Windows has stood the test of time. It’s considered one of the better sandboxing mechanisms deployed at scale without requiring elevated privileges to function. For all the good, it does have its weaknesses. The main one being the sandbox’s implementation is reliant on the security of the Windows OS. Changing the behavior of Windows is out of the control of the Chromium development team. If a bug is found in the security enforcement mechanisms of Windows then the sandbox can break.
Click to expand...

https://googleprojectzero.blogspot.com/2020/04/you-wont-believe-what-this-one-line.html

Minimalist · Apr 29, 2020

Fuzzing ImageIO

This blog post discusses an old type of issue, vulnerabilities in image format parsers, in a new(er) context: on interactionless code paths in popular messenger apps. This research was focused on the Apple ecosystem and the image parsing API provided by it: the ImageIO framework. Multiple vulnerabilities in image parsing code were found, reported to Apple or the respective open source image library maintainers, and subsequently fixed. During this research, a lightweight and low-overhead guided fuzzing approach for closed source binaries was implemented and is released alongside this blogpost.
Click to expand...

https://googleprojectzero.blogspot.com/2020/04/fuzzing-imageio.html

Minimalist · Jun 11, 2020

A survey of recent iOS kernel exploits

I recently found myself wishing for a single online reference providing a brief summary of the high-level exploit flow of every public iOS kernel exploit in recent years; since no such document existed, I decided to create it here.
Click to expand...

https://googleprojectzero.blogspot.com/2020/06/a-survey-of-recent-ios-kernel-exploits.html

Minimalist · Jun 17, 2020

FF Sandbox Escape (CVE-2020-12388)

In my previous blog post I discussed an issue with the Windows Kernel’s handling of Restricted Tokens which allowed me to escape the Chrome GPU sandbox. Originally I’d planned to use Firefox for the proof-of-concept as Firefox uses the same effective sandbox level as the Chrome GPU process for its content renderers. That means a FF content RCE would give code execution in a sandbox where you could abuse the Windows Kernel Restricted Tokens issue, making it much more serious.
Click to expand...

https://googleprojectzero.blogspot.com/2020/06/ff-sandbox-escape-cve-2020-12388.html

Minimalist · Jul 9, 2020

How to unc0ver a 0-day in 4 hours or less

At 3 PM PDT on May 23, 2020, the unc0ver jailbreak was released for iOS 13.5 (the latest signed version at the time of release) using a zero-day vulnerability and heavy obfuscation. By 7 PM, I had identified the vulnerability and informed Apple. By 1 AM, I had sent Apple a POC and my analysis. This post takes you along that journey.
Click to expand...

https://googleprojectzero.blogspot.com/2020/07/how-to-unc0ver-0-day-in-4-hours-or-less.html

Minimalist · Jul 29, 2020

MMS Exploit Part 3: Constructing the Memory Corruption Primitives

This post is the third of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published as they are completed and will be linked here when complete.

MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface

MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec

[this post]

Click to expand...

https://googleprojectzero.blogspot.com/2020/07/mms-exploit-part-3-constructing-primitives.html

Minimalist · Jul 29, 2020

Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019

In May 2019, Project Zero released our tracking spreadsheet for 0-days used “in the wild” and we started a more focused effort on analyzing and learning from these exploits. This is another way Project Zero is trying to make zero-day hard. This blog post synthesizes many of our efforts and what we’ve seen over the last year. We provide a review of what we can learn from 0-day exploits detected as used in the wild in 2019. In conjunction with this blog post, we are also publishing another blog post today about our root cause analysis work that informed the conclusions in this Year in Review. We are also releasing 8 root cause analyses that we have done for in-the-wild 0-days from 2019.
Click to expand...

https://googleprojectzero.blogspot.com/2020/07/detection-deficit-year-in-review-of-0.html

Minimalist · Jul 29, 2020

Root Cause Analyses for 0-day In-the-Wild Exploits

When a 0-day is exploited in the wild AND it is detected, we need to use that as an opportunity to learn as much as possible about the vulnerability and the exploit if we hope to make 0-day hard. One of the main methods to do that is to perform a root cause analysis (RCA) on the 0-day.
Click to expand...

https://googleprojectzero.blogspot.com/2020/07/root-cause-analyses-for-0-day-in-wild.html

Minimalist · Jul 30, 2020

One Byte to rule them all

For the last several years, nearly all iOS kernel exploits have followed the same high-level flow: memory corruption and fake Mach ports are used to gain access to the kernel task port, which provides an ideal kernel read/write primitive to userspace. Recent iOS kernel exploit mitigations like PAC and zone_require seem geared towards breaking the canonical techniques seen over and over again to achieve this exploit flow. But the fact that so many iOS kernel exploits look identical from a high level begs questions: Is targeting the kernel task port really the best exploit flow? Or has the convergence on this strategy obscured other, perhaps more interesting, techniques? And are existing iOS kernel mitigations equally effective against other, previously unseen exploit flows?
Click to expand...

https://googleprojectzero.blogspot.com/2020/07/one-byte-to-rule-them-all.html

Minimalist · Aug 1, 2020

The core of Apple is PPL: Breaking the XNU kernel's kernel

While doing research for the one-byte exploit technique, I considered several ways it might be possible to bypass Apple's Page Protection Layer (PPL) using just a physical address mapping primitive, that is, before obtaining kernel read/write or defeating PAC. Given that PPL is even more privileged than the rest of the XNU kernel, the idea of compromising PPL "before" XNU was appealing. In the end, though, I wasn't able to think of a way to break PPL using the physical mapping primitive alone.
Click to expand...

https://googleprojectzero.blogspot.com/2020/07/the-core-of-apple-is-ppl-breaking-xnu.html

Minimalist · Aug 3, 2020

Exploiting Android Messengers with WebRTC: Part 1

This is a three-part series on exploiting messenger applications using vulnerabilities in WebRTC. This series highlights what can go wrong when applications don't apply WebRTC patches and when the communication and notification of security issues breaks down.
Click to expand...

https://googleprojectzero.blogspot.com/2020/08/exploiting-android-messengers-part-1.html

Minimalist · Aug 5, 2020

MMS Exploit Part 4: MMS Primer, Completing the ASLR Oracle

This post is the fourth of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published as they are completed and will be linked here when complete.

MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface

MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec

MMS Exploit Part 3: Constructing the Memory Corruption Primitives

[this post]

Click to expand...

https://googleprojectzero.blogspot.com/2020/08/mms-exploit-part-4-completing-aslr-oracle.html

Minimalist · Aug 6, 2020

Exploiting Android Messengers with WebRTC: Part 2

This is a three-part series on exploiting messenger applications using vulnerabilities in WebRTC. This series highlights what can go wrong when applications don't apply WebRTC patches and when the communication and notification of security issues breaks down.
Click to expand...

https://googleprojectzero.blogspot.com/2020/08/exploiting-android-messengers-part-2.html

Minimalist · Aug 6, 2020

Exploiting Android Messengers with WebRTC: Part 3

This is a three-part series on exploiting messenger applications using vulnerabilities in WebRTC. CVE-2020-6514 discussed in the blog post was fixed on July 14 with these CLs.This series highlights what can go wrong when applications don't apply WebRTC patches and when the communication and notification of security issues breaks down.
Click to expand...

https://googleprojectzero.blogspot.com/2020/08/exploiting-android-messengers-part-3.html

Minimalist · Aug 14, 2020

MMS Exploit Part 5: Defeating Android ASLR, Getting RCE

This post is the fifth and final of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices.
Click to expand...

https://googleprojectzero.blogspot.com/2020/08/mms-exploit-part-5-defeating-aslr-getting-rce.html

Minimalist · Sep 4, 2020

JITSploitation I: A JIT Bug

This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed in iOS 13.5, while two of the mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6.
Click to expand...

https://googleprojectzero.blogspot.com/2020/09/jitsploitation-one.html

JITSploitation II: Getting Read/Write
https://googleprojectzero.blogspot.com/2020/09/jitsploitation-two.html

JITSploitation III: Subverting Control Flow
https://googleprojectzero.blogspot.com/2020/09/jitsploitation-three.html

Minimalist · Sep 12, 2020

Attacking the Qualcomm Adreno GPU

When writing an Android exploit, breaking out of the application sandbox is often a key step. There are a wide range of remote attacks that give you code execution with the privileges of an application (like the browser or a messaging application), but a sandbox escape is still required to gain full system access.

This blog post focuses on an interesting attack surface that is accessible from the Android application sandbox: the graphics processing unit (GPU) hardware. We describe an unusual vulnerability in Qualcomm's Adreno GPU, and how it could be used to achieve kernel code execution from within the Android application sandbox.
Click to expand...

https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html

Minimalist · Oct 1, 2020

Announcing the Fuzzilli Research Grant Program

Project Zero’s mission is to make 0-day hard in order to improve end-user security. We attack this problem in different ways, including supporting other security researchers. While Google currently offers research grants, they are limited to academics and those affiliated with universities.

Today we are announcing a new USD $50,000 pilot program to foster research into JavaScript engine fuzzing through Google Compute Engine (GCE) credit grants.
Click to expand...

https://googleprojectzero.blogspot.com/2020/10/announcing-fuzzilli-research-grant.html

Minimalist · Oct 6, 2020

Enter the Vault: Authentication Issues in HashiCorp Vault

In this blog post I'll discuss two vulnerabilities in HashiCorp Vault and its integration with Amazon Web Services (AWS) and Google Cloud Platform (GCP). These issues can lead to an authentication bypass in configurations that use the aws and gcp auth methods, and demonstrate the type of issues you can find in modern “cloud-native” software. Both vulnerabilities (CVE-2020-16250/16251) were addressed by HashiCorp and are fixed in Vault versions 1.2.5, 1.3.8, 1.4.4 and 1.5.1 released in August.
Click to expand...

https://googleprojectzero.blogspot.com/2020/10/enter-the-vault-auth-issues-hashicorp-vault.html

Minimalist · Nov 13, 2020

Oops, I missed it again!

This is a quick anecdotal post describing one of the more frustrating aspects of vulnerability research: realizing that you missed a bug that was staring you in the face only once you see the patched version!
Click to expand...

https://googleprojectzero.blogspot.com/2020/11/oops-i-missed-it-again.html

Minimalist · Dec 2, 2020

An iOS zero-click radio proximity exploit odyssey

For 6 months of 2020, while locked down in the corner of my bedroom surrounded by my lovely, screaming children, I've been working on a magic spell of my own. No, sadly not an incantation to convince the kids to sleep in until 9am every morning, but instead a wormable radio-proximity exploit which allows me to gain complete control over any iPhone in my vicinity. View all the photos, read all the email, copy all the private messages and monitor everything which happens on there in real-time.
Click to expand...

https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html

Minimalist · Dec 21, 2020

An iOS hacker tries Android

One of the amazing aspects of working at Project Zero is having the flexibility to direct my own research agenda. My prior work has almost exclusively focused on iOS exploitation, but back in August, I thought it could be interesting to try writing a kernel exploit for Android to see how it compares. I have two aims for this blog post: First, I will walk you through my full journey from bug description to kernel read/write/execute on the Samsung Galaxy S10, starting from the perspective of a pure-iOS security researcher. Second, I will try to emphasize some of the major security/exploitation differences between the two platforms that I have observed.
Click to expand...

https://googleprojectzero.blogspot.com/2020/12/an-ios-hacker-tries-android.html

Minimalist · Jan 12, 2021

Introducing the In-the-Wild Series

This is part 1 of a 6-part series detailing a set of vulnerabilities found by Project Zero being exploited in the wild. To read the other parts of the series, head to the bottom of this post.
Click to expand...

https://googleprojectzero.blogspot.com/2021/01/introducing-in-wild-series.html

Minimalist · Jan 14, 2021

Hunting for Bugs in Windows Mini-Filter Drivers

In December Microsoft fixed 4 issues in Windows in the Cloud Filter and Windows Overlay Filter (WOF) drivers (CVE-2020-17103, CVE-2020-17134, CVE-2020-17136, CVE-2020-17139). These 4 issues were 3 local privilege escalations and a security feature bypass, and they were all present in Windows file system filter drivers. I’ve found a number of issues in filter drivers previously, including 6 in the LUAFV driver which implements UAC file virtualization.
Click to expand...

https://googleprojectzero.blogspot.com/2021/01/hunting-for-bugs-in-windows-mini-filter.html

Log in or Sign up

News and updates from the Project Zero team at Google

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

News and updates from the Project Zero team at Google

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Useful Searches