Google Hacks Samsung Galaxy S6 During Internal Competition

During an internal competition at the offices of Google are employees of the Internet giant has managed to hack a Samsung Galaxy S6 Edge, which ultimately resulted in 11 serious vulnerabilities. Google has a team of hackers called Project Zero.

The team looks for vulnerabilities in popular software. This time, the hackers also decided to look at a handset from Samsung. Most Android devices are namely not created by Google, but by external parties, known as Original Equipment Manufacturers (OEMs). These manufacturers use the Android Open Source Project (AOSP) as the basis for their devices.According to Google, OEMs are an important area for Android screening.

Namely manufacturers add all kinds of code and applications increasing, which can introduce new vulnerabilities. The manufacturers decide if and when they deploy updates. After previously having been created by a Google Nexus device examined Project Zero now decided to look at the safety of an OEM device. In addition to finding vulnerabilities, the researchers were also curious to see how quickly they were resolved. It was ultimately for the Samsung Galaxy S6 Edge chosen because a high-end device with many users.

Competition

It was then decided to organize a match between the North American members of Project Zero and the European section. The teams were given a week's time for the challenge. Eventually there were 11 vulnerabilities discovered and reported to Samsung. Eight of the leaks were patched by Samsung during patch cycle of October. The remaining three will be resolved this month. Who the match between the two teams eventually won, Google has not disclosed.

Google Finds Critical Vulnerability In Virus ESET

A researcher from Google alone in a few days a critical vulnerability in the virus scanners and security of the Slovak anti-virus company ESET discovered which allows remote attackers computers and systems can completely take over, without any user interaction is required. The vulnerability would therefore be ideal for a worm which business networks that use ESET software can be completely infected.

ESET software uses a mini-filter to intercept all input and output (I / O) to the hard disk, analyze and then emulate in case it comes to executable code. Through emulation, a file can be carried out partially before the virus signatures are used to determine whether the file is malicious or not.

Through the browser, email client, instant messaging, file sharing, network, USB and many other ways an attacker disk I / O and so cause execute the attack. The problem is in fact caused by the emulation performing ESET. The emulator does not appear to be robust and easy to compromise, says researcher Tavis Ormandy of Google. They may run malicious code with root privileges.

The problem is at all ESET products, including virus scanners for Linux, Mac OS X and Windows. As proof Ormandy developed a working exploit which systems to attack from a distance. Last Friday warned Google ESET, where the results were discussed in person with the company. Three days later, on Monday, the Slovak virus fighter came with an update to resolve the issue.

Risk

According to Ormandy, however whether users are the risks and benefits of security weigh. In the past, even though Ormandy revealed major problems in the anti-virus software from Sophos , and this week it was announced that the NSA and GCHQ to vulnerabilities have sought in anti-virus programs. Attacking users through their virus is therefore not a theoretical risk, according to Ormandy.

Google Relaxes Deadline For Revealing Leaks

Google has the deadline that applies to vulnerabilities to reveal something more flexible in the products of other software companies. Since last year, the search giant puts a team of hackers called Project Zero that is actively looking for vulnerabilities in widely used programs.

Once a vulnerability is found getting the informed supplier 90 days to come up with a patch, otherwise Google will automatically reveal the details. Much to the annoyance of Microsoft, which in one case after 92 days came with an update.The software giant Google had asked for the details after the release of the update to disclose, but no reply was given.Therefore users would have run unnecessary risks.

Now, Google announced that it will somewhat lenient policy. If a deadline expires on a weekend or US holidays, the deadline for the next working day will be postponed. In addition, there is a grace period of 14 days. If the deadline of 90 days expires but the supplier in the next 14 days say they come with an update, the details will appear only after the release of the patch.

"The publication of a non-issue patches will now only take place if the deadline is missed more than two weeks," said Chris Evans of the Project Zero team. The new rules apply not only to the research team at Google, but for all the parts and members of the search giant who discover vulnerabilities in software from other parties.

Despite criticism from some parties that the deadline is certainly successful, suggests Evans. Most vulnerabilities Project Zero discovered were found in Adobe Flash Player. All 37 reported vulnerabilities in Adobe were patched within the deadline of 90 days. In total discovered Project Zero 154 vulnerabilities, of which 85% were resolved within the deadline.

In the case of the 73 leaks that were reported to suppliers after October 1, 2014 even it comes to 95%. And as it looks now, there will be no missed deadlines in February. "Deadlines seem to work to improve the patch time and safety for users, especially if they are consistently maintained," Evans says.

Google Pays Researchers 4 Million For Bug Reports

Since Google in 2010 with a program in which the researchers began paying for reporting vulnerabilities and other security issues in their own software has more than 4 million dollars paid to rewards. Last year, more than $ 1.5 million to more than 200 different researchers made. The highest reward was an amount of $ 150,000 , for the well-known hacker George Hotz. Hotz was then invited to walk in the Project Zero Team Google internship that is actively looking for leaks in many popular programs.

Through the rewards Google hopes to find vulnerabilities that might otherwise be missed. Last year more than 500 bugs were discovered in this way and rewarded. This year, Google continues to expand the reward program, as the search giant announced . There is also monetize vulnerabilities in Google applications on Android and iOS and come and scholarships for security researchers. In this case, Google will pay the investigator for his research, even if no vulnerabilities found.

The reward programs would ensure that it is becoming increasingly difficult to find vulnerabilities, which can discourage researchers to invest their time. Therefore now started this experimental program in which researchers already before they have examined a scholarship one line of code, with a maximum amount of $ 3113.70. Research fellows will also find that leak still qualify for the applicable bugbeloning.

Vulnerabiltiy: Google Reveals Adobe Reader Leak for Mac OS X

Google has unveiled a vulnerability in Adobe Reader in the Windows version of the PDF reader would be patched, but the Mac version is still present. The vulnerability was reported to Adobe in October last year.In December there was an update for the Windows version appeared, but Adobe had to Google that it had failed to deliver a solution for the Mac version.

This week, however, went the deadline had asked Google. "Project Zero Team" of the search giant is looking specifically for vulnerabilities in commonly used software. Once a leak is found will the supplier 90 days to come up with an update, other details are the vulnerability automatically made ​​public. Adobe was warned by Google that it would reveal the details.

Via the leak, it is possible to let the application crash, which is possible up to a "heap-based buffer overflow" can cause.Noteworthy is the way that Adobe to Google said to have patched the flaw in the Windows version. The leak in question, known as CVE-2014-9160, however, does not appear in the list of Adobe Reader update.

Google Reveals Unpatched Vulnerabilities In Mac OS X

After several have leaks in Windows unveiled at a time that no security updates, Google has the same now done with Mac OS X. In total there are three vulnerabilities, allowing an attacker commands as a "system daemon" execute through ' kernel code execution 'root privileges can get or through a Bluetooth device memory corruption can cause.

One of the vulnerabilities has been tested on Mac OS X 10.9.5, while another only at Yosemite is confirmed. Leaks are detected by the "Project Zero Team" of Google, which is looking specifically for vulnerabilities in commonly used software.Once a leak is found will the supplier 90 days to come up with an update, otherwise the details of the vulnerability are automatically made ​​public. Much to the dissatisfaction of Microsoft, which Google called to work better together. Apple has not yet responded to the leak revealed.