Google Online Security Blog

Time 2021-11-25 00:28:58

Web Name: Google Online Security Blog

WebSite: http://googleonlinesecurity.blogspot.com

ID:249681

Keywords:

Online,Google,Blog,Security,

Description:

keywords:
description:
Security Blog The latest news and insights from Google on security and safety on the InternetClusterFuzzLite: Continuous fuzzing for all November 11, 2021 Google Trick

Starting today and for the next 3 months (until January 31 2022), we will pay 31,337 USD to security researchers that exploit privilege escalation in our lab environment with a patched vulnerability, and 50,337 USD to those that use a previously unpatched vulnerability, or a new exploit technique.

We are constantly investing in the security of the Linux Kernel because much of the internet, and Googlefrom the devices in our pockets, to the services running on Kubernetes in the clouddepend on the security of it. We research its vulnerabilities and attacks, as well as study and develop its defenses.

But we know that there is more work to do. Thats why we have decided to build on top of our kCTF VRP from last year and triple our previous reward amounts (for at least the next 3 months).

Our base rewards for each publicly patched vulnerability is 31,337 USD (at most one exploit per vulnerability), but the reward can go up to 50,337 USD in two cases:
If the vulnerability was otherwise unpatched in the Kernel (0day)If the exploit uses a new attack or technique, as determined by GoogleWe hope the new rewards will encourage the security community to explore new Kernel exploitation techniques to achieve privilege escalation and drive quicker fixes for these vulnerabilities. It is important to note, that the easiest exploitation primitives are not available in our lab environment due to the hardening done on Container-Optimized OS. Note this program complements Android's VRP rewards, so exploits that work on Android could also be eligible for up to 250,000 USD (that's in addition to this program).

The mechanics are:
Connect to the kCTF VRP cluster, obtain root and read the flag (read this writeup for how it was done before, and this threat model for inspiration), and then submit your flag and a checksum of your exploit in this form.(If applicable) report vulnerabilities to upstream.We strongly recommend including a patch since that could qualify for an additional reward from our Patch Reward Program, but please report vulnerabilities upstream promptly once you confirm they are exploitable.Report your finding to Google VRP once all patches are publicly available (we don't want to receive details of unpatched vulnerabilities ahead of the public.)Provide the exploit code and the algorithm used to calculate the hash checksum.A rough description of the exploit strategy is welcome.Reports will be triaged on a weekly basis. If anyone has problems with the lab environment (if it's unavailable, technical issues or other questions), contact us on Discord in #kctf. You can read more details about the program here. Happy hunting! Google Protecting your device information with Private Set MembershipOctober 28, 2021 Google Pixel 6: Setting a new standard for mobile securityOctober 27, 2021 Google Labels:android , android security , pixel , tensor , Titan M2Launching a collaborative minimum security baseline October 27, 2021 Google Google Protects Your Accounts Even When You No Longer Use ThemOctober 5, 2021 Google Introducing the Secure Open Source Pilot ProgramOctober 1, 2021 Google Labels:Open Source , Security , supply chainAnnouncing New Patch Reward Program for Tsunami Security ScannerSeptember 28, 2021 Google Distroless Builds Are Now SLSA 2 September 22, 2021 Google Labels:Open Source , Security , supply chain Labels #sharethemicincyber#supplychain #security #opensourceandroidandroid securityandroid trapp securitybig databiometricsblackhatC++chromechrome securityCTFdiversityencryptionfederated learningfuzzingGboardgoogle playgoogle play protectinteroperabilitykuberneteslinux kernelmemory safetyOpen Sourcepha family highlightspixelprivacyprivate compute coreRowhammerrustSecuritysigstorespywaresupply chaintargeted spywaretensorTitan M2vulnerabilities Archive 2021NovOctSepAugJulJunMayAprMarFebJan 2020DecNovOctSepAugJulJunMayAprMarFebJan 2019DecNovOctSepAugJulJunMayAprMarFebJan 2018DecNovOctSepAugJulJunMayAprMarFebJan 2017DecNovOctSepJulJunMayAprMarFebJan 2016DecNovOctSepAugJulJunMayAprMarFebJan 2015DecNovOctSepAugJulJunMayAprMarFebJan 2014DecNovOctSepAugJulJunAprMarFebJan 2013DecNovOctAugJunMayAprMarFebJan 2012DecSepAugJunMayAprMarFebJan 2011DecNovOctSepAugJulJunMayAprMarFeb 2010NovOctSepAugJulMayAprMar 2009NovOctAugJulJunMar 2008DecNovOctAugJulMayFeb 2007NovOctSepJulJunMayFeed Follow @google FollowGive us feedback in our Product Forums. Google Privacy Terms

TAGS:Online Google Blog Security 

<<< Thank you for your visit >>>

Hot Websites