News and updates from the Project Zero team at Google

Minimalist · Jan 19, 2021

The State of State Machines

On January 29, 2019, a serious vulnerability was discovered in Group FaceTime which allowed an attacker to call a target and force the call to connect without user interaction from the target, allowing the attacker to listen to the target’s surroundings without their knowledge or consent. The bug was remarkable in both its impact and mechanism. The ability to force a target device to transmit audio to an attacker device without gaining code execution was an unusual and possibly unprecedented impact of a vulnerability. Moreover, the vulnerability was a logic bug in the FaceTime calling state machine that could be exercised using only the user interface of the device. While this bug was soon fixed, the fact that such a serious and easy to reach vulnerability had occurred due to a logic bug in a calling state machine -- an attack scenario I had never seen considered on any platform -- made me wonder whether other state machines had similar vulnerabilities as well. This post describes my investigation into calling state machines of a number of messaging platforms, including Signal, JioChat, Mocha, Google Duo, and Facebook Messenger.
Click to expand...

https://googleprojectzero.blogspot.com/2021/01/the-state-of-state-machines.html

Minimalist · Jan 22, 2021

Windows Exploitation Tricks: Trapping Virtual Memory Access

This blog is a continuation of my series of Windows exploitation tricks. This one describes an exploitation trick I’ve been trying to develop for years, succeeding (mostly, more on that later) on the latest versions of Windows 10. It’s a trick to trap access to virtual memory, get feedback when it occurs and delay access indefinitely. The blog will go into some of the background for why this technique is useful, an overview of the research I did to find the trick as well as an overview of the types of vulnerabilities it can be used with.
Click to expand...

https://googleprojectzero.blogspot.com/2021/01/windows-exploitation-tricks-trapping.html

Minimalist · Jan 29, 2021

A Look at iMessage in iOS 14

On December 20, Citizenlab published “The Great iPwn”, detailing how “Journalists [were] Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit”. Of particular interest is the following note: “We do not believe that [the exploit] works against iOS 14 and above, which includes new security protections''. Given that it is also now almost exactly one year ago since we published the Remote iPhone Exploitation blog post series, in which we described how an iMessage 0-click exploit can work in practice and gave a number of suggestions on how similar attacks could be prevented in the future, now seemed like a great time to dig into the security improvements in iOS 14 in more detail and explore how Apple has hardened their platform against 0-click attacks.
Click to expand...

https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html

Minimalist · Feb 3, 2021

A Year in Review of 0-days Exploited In-The-Wild in 2020

2020 was a year full of 0-day exploits. Many of the Internet’s most popular browsers had their moment in the spotlight. Memory corruption is still the name of the game and how the vast majority of detected 0-days are getting in. While we tried new methods of 0-day detection with modest success, 2020 showed us that there is still a long way to go in detecting these 0-day exploits in-the-wild. But what may be the most notable fact is that 25% of the 0-days detected in 2020 are closely related to previously publicly disclosed vulnerabilities. In other words, 1 out of every 4 detected 0-day exploits could potentially have been avoided if a more thorough investigation and patching effort were explored. Across the industry, incomplete patches — patches that don’t correctly and comprehensively fix the root cause of a vulnerability — allow attackers to use 0-days against users with less effort.
Click to expand...

https://googleprojectzero.blogspot.com/2021/02/deja-vu-lnerability.html

Minimalist · Mar 18, 2021

In-the-Wild Series: October 2020 0-day discovery

In October 2020, Google Project Zero discovered seven 0-day exploits being actively used in-the-wild. These exploits were delivered via "watering hole" attacks in a handful of websites pointing to two exploit servers that hosted exploit chains for Android, Windows, and iOS devices. These attacks appear to be the next iteration of the campaign discovered in February 2020 and documented in this blog post series.

In this post we are summarizing the exploit chains we discovered in October 2020. We have already published the details of the seven 0-day vulnerabilities exploited in our root cause analysis (RCA) posts. This post aims to provide the context around these exploits.
Click to expand...

https://googleprojectzero.blogspot.com/2021/03/in-wild-series-october-2020-0-day.html

Minimalist · Apr 1, 2021

Who Contains the Containers?

This is a short blog post about a research project I conducted on Windows Server Containers that resulted in four privilege escalations which Microsoft fixed in March 2021. In the post, I describe what led to this research, my research process, and insights into what to look for if you’re researching this area.
Click to expand...

https://googleprojectzero.blogspot.com/2021/04/who-contains-containers.html

Minimalist · Apr 15, 2021

Policy and Disclosure: 2021 Edition

At Project Zero, we spend a lot of time discussing and evaluating vulnerability disclosure policies and their consequences for users, vendors, fellow security researchers, and software security norms of the broader industry. We aim to be a vulnerability research team that benefits everyone, working across the entire ecosystem to help make 0-day hard.

We remain committed to adapting our policies and practices to best achieve our mission, demonstrating this commitment at the beginning of last year with our 2020 Policy and Disclosure Trial.

As part of our annual year-end review, we evaluated our policy goals, solicited input from those that receive most of our reports, and adjusted our approach for 2021.
Click to expand...

https://googleprojectzero.blogspot.com/2021/04/policy-and-disclosure-2021-edition.html

Minimalist · Apr 22, 2021

Designing sockfuzzer, a network syscall fuzzer for XNU

When I started my 20% project – an initiative where employees are allocated twenty-percent of their paid work time to pursue personal projects – with Project Zero, I wanted to see if I could apply the techniques I had learned fuzzing Chrome to XNU, the kernel used in iOS and macOS. My interest was sparked after learning some prominent members of the iOS research community believed the kernel was “fuzzed to death,” and my understanding was that most of the top researchers used auditing for vulnerability research.
Click to expand...

https://googleprojectzero.blogspot.com/2021/04/designing-sockfuzzer-network-syscall.html

Minimalist · May 20, 2021

Fuzzing iOS code on macOS at native speed

This short post explains how code compiled for iOS can be run natively on Apple Silicon Macs.
Click to expand...

https://googleprojectzero.blogspot.com/2021/05/fuzzing-ios-code-on-macos-at-native.html

Minimalist · Aug 19, 2021

Understanding Network Access in Windows AppContainers

Recently I've been delving into the inner workings of the Windows Firewall. This is interesting to me as it's used to enforce various restrictions such as whether AppContainer sandboxed applications can access the network. Being able to bypass network restrictions in AppContainer sandboxes is interesting as it expands the attack surface available to the application, such as being able to access services on localhost, as well as granting access to intranet resources in an Enterprise.
Click to expand...

https://googleprojectzero.blogspot.com/2021/08/understanding-network-access-windows-app.html

Minimalist · Oct 21, 2021

How a simple Linux kernel memory corruption bug can lead to complete system compromise

This blog post describes a straightforward Linux kernel locking bug and how I exploited it against Debian Buster's 4.19.0-13-amd64 kernel. Based on that, it explores options for security mitigations that could prevent or hinder exploitation of issues similar to this one.
Click to expand...

https://googleprojectzero.blogspot.com/2021/10/how-simple-linux-kernel-memory.html

Minimalist · Oct 21, 2021

Using Kerberos for Authentication Relay Attacks

This blog post is a summary of some research I've been doing into relaying Kerberos authentication in Windows domain environments. To keep this blog shorter I am going to assume you have a working knowledge of Windows network authentication, and specifically Kerberos and NTLM.
Click to expand...

https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html

Minimalist · Oct 21, 2021

Windows Exploitation Tricks: Relaying DCOM Authentication

In my previous blog post I discussed the possibility of relaying Kerberos authentication from a DCOM connection. I was originally going to provide a more in-depth explanation of how that works, but as it's quite involved I thought it was worthy of its own blog post. This is primarily a technique to get relay authentication from another user on the same machine and forward that to a network service such as LDAP. You could use this to escalate privileges on a host using a technique similar to a blog post from Shenanigans Labs but removing the requirement for the WebDAV service. Let's get straight to it.
Click to expand...

https://googleprojectzero.blogspot.com/2021/10/windows-exploitation-tricks-relaying.html

Minimalist · Dec 2, 2021

This shouldn't have happened: A vulnerability postmortem

This is an unusual blog post. I normally write posts to highlight some hidden attack surface or interesting complex vulnerability class. This time, I want to talk about a vulnerability that is neither of those things. The striking thing about this vulnerability is just how simple it is. This should have been caught earlier, and I want to explore why that didn’t happen.
Click to expand...

https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html

Minimalist · Dec 15, 2021

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

Earlier this year, Citizen Lab managed to capture an NSO iMessage-based zero-click exploit being used to target a Saudi activist. In this two-part blog post series we will describe for the first time how an in-the-wild zero-click iMessage exploit works.

Based on our research and findings, we assess this to be one of the most technically sophisticated exploits we've ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.
Click to expand...

https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html

itman · Dec 15, 2021

Minimalist said: ↑

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
Click to expand...

Brings me back to my college computer science class days in logic gate programming:

AND, OR, XOR and XNOR logical operators you can in fact compute any computable function - the simplest proof being that you can create a logical NOT operator by XORing with 1 and then putting an AND gate in front of that to form a NAND gate
Click to expand...

When you get to programming at that level, anything is possible.

Minimalist · Jan 18, 2022

Zooming in on Zero-click Exploits

Zoom is a video conferencing platform that has gained popularity throughout the pandemic. Unlike other video conferencing systems that I have investigated, where one user initiates a call that other users must immediately accept or reject, Zoom calls are typically scheduled in advance and joined via an email invitation. In the past, I hadn’t prioritized reviewing Zoom because I believed that any attack against a Zoom client would require multiple clicks from a user. However, a zero-click attack against the Windows Zoom client was recently revealed at Pwn2Own, showing that it does indeed have a fully remote attack surface. The following post details my investigation into Zoom.
Click to expand...

https://googleprojectzero.blogspot.com/2022/01/zooming-in-on-zero-click-exploits.html

Minimalist · Feb 10, 2022

A walk through Project Zero metrics

For nearly ten years, Google’s Project Zero has been working to make it more difficult for bad actors to find and exploit security vulnerabilities, significantly improving the security of the Internet for everyone. In that time, we have partnered with folks across industry to transform the way organizations prioritize and approach fixing security vulnerabilities and updating people’s software.
Click to expand...

https://googleprojectzero.blogspot.com/2022/02/a-walk-through-project-zero-metrics.html

Minimalist · Mar 24, 2022

Racing against the clock -- hitting a tiny kernel race window

How to make a tiny kernel race window really large even on kernels without CONFIG_PREEMPT:

use a cache miss to widen the race window a little bit

make a timerfd expire in that window (which will run in an interrupt handler - in other words, in hardirq context)

make sure that the wakeup triggered by the timerfd has to churn through 50000 waitqueue items created by epoll

Racing one thread against a timer also avoids accumulating timing variations from two threads in each race attempt - hence the title. On the other hand, it also means you now have to deal with how hardware timers actually work, which introduces its own flavors of weird timing variations.
Click to expand...

https://googleprojectzero.blogspot.com/2022/03/racing-against-clock-hitting-tiny.html

Minimalist · Mar 31, 2022

FORCEDENTRY: Sandbox Escape

Late last year we published a writeup of the initial remote code execution stage of FORCEDENTRY, the zero-click iMessage exploit attributed by Citizen Lab to NSO. By sending a .gif iMessage attachment (which was really a PDF) NSO were able to remotely trigger a heap buffer overflow in the ImageIO JBIG2 decoder. They used that vulnerability to bootstrap a powerful weird machine capable of loading the next stage in the infection process: the sandbox escape.
Click to expand...

https://googleprojectzero.blogspot.com/2022/03/forcedentry-sandbox-escape.html

Minimalist · Apr 7, 2022

CVE-2021-30737, @xerub's 2021 iOS ASN.1 Vulnerability

As well as doing my own vulnerability research I also spend time trying as best as I can to keep up with the public state-of-the-art, especially when details of a particularly interesting vulnerability are announced or a new in-the-wild exploit is caught. Originally this post was just a series of notes I took last year as I was trying to understand this bug. But the bug itself and the narrative around it are so fascinating that I thought it would be worth writing up these notes into a more coherent form to share with the community.
Click to expand...

https://googleprojectzero.blogspot.com/2022/04/cve-2021-30737-xerubs-2021-ios-asn1.html

Minimalist · Apr 14, 2022

CVE-2021-1782, an iOS in-the-wild vulnerability in vouchers

This blog post is my analysis of a vulnerability exploited in the wild and patched in early 2021. Like the writeup published last week looking at an ASN.1 parser bug, this blog post is based on the notes I took as I was analyzing the patch and trying to understand the XNU vouchers subsystem. I hope that this writeup serves as the missing documentation for how some of the internals of the voucher subsystem works and its quirks which lead to this vulnerability.
Click to expand...

https://googleprojectzero.blogspot.com/2022/04/cve-2021-1782-ios-in-wild-vulnerability.html

Minimalist · Apr 19, 2022

The More You Know, The More You Know You Don’t Know

This is our third annual year in review of 0-days exploited in-the-wild [2020, 2019]. Each year we’ve looked back at all of the detected and disclosed in-the-wild 0-days as a group and synthesized what we think the trends and takeaways are. The goal of this report is not to detail each individual exploit, but instead to analyze the exploits from the year as a group, looking for trends, gaps, lessons learned, successes, etc. If you’re interested in the analysis of individual exploits, please check out our root cause analysis repository.
Click to expand...

https://googleprojectzero.blogspot.com/2022/04/the-more-you-know-more-you-know-you.html

Rasheed187 · Apr 24, 2022

Minimalist said: ↑

The More You Know, The More You Know You Don’t Know

https://googleprojectzero.blogspot.com/2022/04/the-more-you-know-more-you-know-you.html
Click to expand...

Interesting stuff, so there are plenty of zero days in Chromium, Safari, Android, iOS and Windows. Not that many in macOS so it seems. Too bad that they don't talk about mitigation tools.

Minimalist · May 11, 2022

Release of Technical Report into the AMD Security Processor

Today, members of Project Zero and the Google Cloud security team are releasing a technical report on a security review of AMD Secure Processor (ASP). The ASP is an isolated core in AMD EPYC CPUs that adds a root of trust and controls secure system initialization. As it's a generic processor AMD can add additional security features to the firmware, but like with all complex systems it's possible these features might have security issues which could compromise the security of everything under the ASP's management.
Click to expand...

https://googleprojectzero.blogspot.com/2022/05/release-of-technical-report-into-amd.html

Log in or Sign up

News and updates from the Project Zero team at Google

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

itman Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Rasheed187 Registered Member

Minimalist Registered Member

Log in or Sign up

News and updates from the Project Zero team at Google

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

itman Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Rasheed187 Registered Member

Minimalist Registered Member

Useful Searches