/
Navigation
C
Chronicles
Browse all articles
C
E
Explore
Semantic exploration
E
R
Research
Entity momentum
R
N
Nexus
Correlations & relationships
N
~
Story Arc
Topic evolution
S
Drift Map
Semantic trajectory animation
D
P
Posts
Analysis & commentary
P
Browse
@
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
?
Concept Search
Semantic similarity search
!
High Impact Stories
Top coverage by position
+
Sentiment Analysis
Positive/negative coverage
*
Anomaly Detection
Unusual coverage patterns
Analysis
vs
Rivalry Report
Compare two entities head-to-head
/\
Semantic Pivots
Narrative discontinuities
!!
Crisis Response
Event recovery patterns
Connected
Nav: C E R N
Search: /
Command: ⌘K
Embeddings: large
VOICE ARCHIVE

Tim Willis

@itswillis
12 posts
2023-03-18
What happens when you get @natashenka, @ifsecure, @_fel1x, @i41nbeer and @tehjh working collaboratively on a new attack surface for the team? This: https://googleprojectzero.blogspot.com/ ... The blogpost also includes actions that users can take to protect themselves while waiting for patches.
2023-03-18 View on X
TechCrunch

Google's Project Zero finds 18 zero-day vulnerabilities in Exynos modems, affecting some Samsung, Vivo, and Google phones as well as wearables and vehicles

do this before you're next Maria Deutscher / SiliconANGLE : Google discovers 18 vulnerabilities in multiple Samsung chips Pierluigi Paganini / Security Affairs : Baseband RCE flaws...

2023-03-17
What happens when you get @natashenka, @ifsecure, @_fel1x, @i41nbeer and @tehjh working collaboratively on a new attack surface for the team? This: https://googleprojectzero.blogspot.com/ ... The blogpost also includes actions that users can take to protect themselves while waiting for patches.
2023-03-17 View on X
TechCrunch

Google's Project Zero finds 18 zero-day vulnerabilities, including four top-severity flaws, affecting some Samsung phones and other devices with Exynos chipsets

Google's security research unit is sounding the alarm on a set of vulnerabilities it found in certain Samsung chips included …

2022-06-25
Nice to see a “short” 25-pager from @i41nbeer on a novel iOS exploit found in the wild. While both @Lookout and Google TAG weren't able to capture the exploits used for the Android version, a reminder that if you've found Android in the wild 0-day, we'd love to write about it! https://twitter.com/...
2022-06-25 View on X
TechCrunch

Google details the commercial spyware Hermit, used in Kazakhstan and Italy, targeting Android and iOS; the iOS version has six exploits, including two zero-days

Saturday, June 25, 2022 // (IG): BB //Weekly Sponsor: Dataminr Deeba Ahmed / HackRead : ISPs Helping Attackers Install Hermit Spyware on Smartphones- Google Sergiu Gatlan / Bleepin...

2022-06-24
Nice to see a “short” 25-pager from @i41nbeer on a novel iOS exploit found in the wild. While both @Lookout and Google TAG weren't able to capture the exploits used for the Android version, a reminder that if you've found Android in the wild 0-day, we'd love to write about it! https://twitter.com/...
2022-06-24 View on X
TechCrunch

Google details the commercial spyware Hermit, used in Kazakhstan and Italy, targeting Android and iOS; the iOS version has six exploits, including two zero-days

Zack Whittaker / TechCrunch :

2021-12-16
There are many companies that provide similar exploitation capabilities and services, and some more visible than others (e.g. the “US Entity List"). Taking action against one company (NSO), while noble and fosters a discussion, doesn't address the root of this problem.
2021-12-16 View on X
Project Zero

A deep dive into an NSO zero-click iMessage exploit, captured in the wild by Citizen Lab and one of the most sophisticated Google's Project Zero has seen

We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple's Security Engineering and Architecture …

Controls may help, but they are difficult to get right, with a high chance of constraining security research while insufficiently controlling the problem. An echo of this NSO issue is the story of HackingTeam back in 2014. https://theintercept.com/...
2021-12-16 View on X
Project Zero

A deep dive into an NSO zero-click iMessage exploit, captured in the wild by Citizen Lab and one of the most sophisticated Google's Project Zero has seen

We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple's Security Engineering and Architecture …

Apple should be commended for making iMessage harder to hack and the improvements they made in late 2020. These improvements have forced attackers to use the next level of exploits in their arsenals, rather than relying exclusively on old tricks. https://googleprojectzero.blogspot.com/ ...
2021-12-16 View on X
Project Zero

A deep dive into an NSO zero-click iMessage exploit, captured in the wild by Citizen Lab and one of the most sophisticated Google's Project Zero has seen

We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple's Security Engineering and Architecture …

I usually let the team's work speak for itself, but I wanted to make sure a few larger points aren't lost in this work. Firstly, the takeaway here isn't “NSO exceptionalism”. It's just that NSO was caught this time and we get a peek at how they are attacking iOS/iMessage. https://twitter.com/...
2021-12-16 View on X
Project Zero

A deep dive into an NSO zero-click iMessage exploit, captured in the wild by Citizen Lab and one of the most sophisticated Google's Project Zero has seen

We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple's Security Engineering and Architecture …

Finally, shoutouts to Apple and Citizen Lab, especially @radian and @jsrailton. Working together on this stuff can be complex for a number of reasons, but we made it work. Looking forward to a future post (currently being written) on the analysis of the sandbox escape. [fin]
2021-12-16 View on X
Project Zero

A deep dive into an NSO zero-click iMessage exploit, captured in the wild by Citizen Lab and one of the most sophisticated Google's Project Zero has seen

We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple's Security Engineering and Architecture …

2021-04-16
Project Zero's 2021 Disclosure Policy Update. Biggest changes: 1) if a bug is fixed under deadline, the technical details are released 30 days after the fix 2) we're planning to reduce the 90 day deadline starting next year Full post & reasoning here: https://googleprojectzero.blogspot.com/ ...
2021-04-16 View on X
The Record

Google's Project Zero updates its vulnerability disclosure policy to include a 30-day cushion before publishing bug details to give users time to apply patches

The Google Project Zero security team has updated its vulnerability disclosure guidelines today to add a cushion of 30 days …

2019-09-08
Contrary to some commentary, Project Zero's long form blogs are based on deep technical research into 0-days and novel exploitation, not a commentary on target populations or the wider threat space. Specifically though in this case (and as a one-off), I can tell you that...
2019-09-08 View on X
Apple

Apple accuses Google's Project Zero of stoking fear by creating a “false impression of mass exploitation”, says the sophisticated attack was narrowly focused

And They're Wrong PYMNTS.com : Apple, Google At Odds On iPhone Security Flaws Tied To Attacks Michael Tsai : Apple Responds to Project Zero Abner Li / 9to5Google : Google stands by...

2019-09-07
Contrary to some commentary, Project Zero's long form blogs are based on deep technical research into 0-days and novel exploitation, not a commentary on target populations or the wider threat space. Specifically though in this case (and as a one-off), I can tell you that...
2019-09-07 View on X
@alexstamos

[Thread] Apple's response to Project Zero downplays exploits against an oppressed minority, discounts the risk of other targets, and ends in unseemly marketese

Apple's response to the worst known iOS attack in history should be graded somewhere between “disappointing” and “disgusting”. First off, disputing Google's correct use of “indiscr...