Sintiendo la necesidad de tomar iniciativas menos tradicionales para la seguridad en el Internet, Google anuncia su próximo paso para dar su grano de arena.
Announcing Project Zero
Security is a top priority for Google. We’ve invested a lot in making our products secure, including strong SSL encryption by default for Search, Gmail and Drive, as well as encrypting data moving between our data centers. Beyond securing our own products, interested Googlers also spend some of their time on research that makes the Internet safer, leading to the discovery of bugs like Heartbleed.The success of that part-time research has led us to create a new, well-staffed team called Project Zero.You should be able to use the web without fear that a criminal or state-sponsored actor is exploiting software bugs to infect your computer, steal secrets or monitor your communications. Yet in sophisticated attacks, we see the use of “zero-day” vulnerabilities to target, for example, human rights activists or to conduct industrial espionage. This needs to stop. We think more can be done to tackle this problem.Project Zero is our contribution, to start the ball rolling. Our objective is to significantly reduce the number of people harmed by targeted attacks. We’re hiring the best practically-minded security researchers and contributing 100% of their time toward improving security across the Internet.We’re not placing any particular bounds on this project and will work to improve the security of any software depended upon by large numbers of people, paying careful attention to the techniques, targets and motivations of attackers. We’ll use standard approaches such as locating and reporting large numbers of vulnerabilities. In addition, we’ll be conducting new research into mitigations, exploitation, program analysis—and anything else that our researchers decide is a worthwhile investment.We commit to doing our work transparently. Every bug we discover will be filed in an external database. We will only report bugs to the software’s vendor—and no third parties. Once the bug report becomes public (typically once a patch is available), you’ll be able to monitor vendor time-to-fix performance, see any discussion about exploitability, and view historical exploits and crash traces. We also commit to sending bug reports to vendors in as close to real-time as possible, and to working with them to get fixes to users in a reasonable time.We’re hiring. We believe that most security researchers do what they do because they love what they do. What we offer that we think is new is a place to do what you love—but in the open and without distraction. We’ll also be looking at ways to involve the wider community, such as extensions of our popular reward initiatives and guest blog posts. As we find things that are particularly interesting, we’ll discuss them on our blog, which we hope you’ll follow.
En su creencia en la libertad de usar el Internet sin tener que estar en la preocupación por tu seguridad o que seas víctima de hackers, Google ha anunciado el establecimiento del Project Zero, como otro trabajo de la gigante de Internet.
El proyecto tiene como fin, buscar que el Internet sea más seguro a la vez de aplicar seguridad, no importa que plataforma o programa se utilice para estar en el Internet y aunque el proyecto como tal fue anunciado ahora, Google afirma que las actualizaciones a plataformas SSL y su motor de búsqueda fueron partes iniciales del proyecto y ahora con la contratación de expertos en el Internet, se espera que se apliquen más mejoras.
Entre de ellas, un canal donde se compilará cualquier sospecha de un usuario y esta será agregada a una base de datos donde Google podrá comunicarse con el responsable del software o productos, en otras palabras, Google sería una especie de Watchdog.
El proyecto se espera que sea dado en práctica y Google no espera que ya ninguna compañía de software se declare perdedora ya que parte de los controles de la base de dates es de no hacer pública la explotación reportada si el fabricante del software ya lo resolvió.
