https://arolstar52-zhtest.hf.space/index.php?action=history&feed=atom&title=Project_Zero_%28Google%29
Project Zero (Google) - 版本历史
2026-07-15T04:55:09Z
在这个wiki上该页的修订历史
MediaWiki 1.43.9
https://arolstar52-zhtest.hf.space/index.php?title=Project_Zero_(Google)&diff=2516065&oldid=prev
imported>暁月凛奈 来自 2025年11月5日 (三) 13:34
2025-11-05T13:34:28Z
<p></p>
<p><b>新页面</b></p><div>{{Infobox website<br />
|name = Project Zero<br />
|logo =<br />
|logocaption =<br />
|screenshot =<br />
|collapsible =<br />
|collapsetext =<br />
|caption =<br />
|url = {{URL|http://googleprojectzero.blogspot.com}}<br />
|slogan =<br />
|commercial =<br />
|type =<br />
|owner =[[Google]]<br />
|author =<br />
|launch_date = 2014年7月15日（{{age in years and days|2014|07|15|age=no}}）<br />
|alexa =<br />
|revenue =<br />
|current_status = 在线<br />
|footnotes =<br />
}}<br />
'''Project Zero'''是[[Google公司]]於2014年7月15日所公開的一個[[信息安全|-{zh-hans:信息安全; zh-hant:資訊安全; zh-tw:資訊保安;}-]]團隊，此團隊專責找出各種軟體的[[计算机安全隐患|安全漏洞]]，特別是可能會導致[[0day攻击|零時差攻擊]]者<ref name="announcement">{{cite web|url=http://googleonlinesecurity.blogspot.de/2014/07/announcing-project-zero.html|title=Announcing Project Zero|last=Evans|first=Chris|date=15 July 2014|publisher=[[Google]] Online Security Blog|accessdate=4 January 2015|archive-date=2015-01-19|archive-url=https://web.archive.org/web/20150119212236/http://googleonlinesecurity.blogspot.de/2014/07/announcing-project-zero.html|dead-url=no}}</ref>。此團隊的領導者為曾任[[Google Chrome]]安全小組的[[克里斯·伊凡斯]]（Chris Evans）。<br />
<br />
此團隊找出安全漏洞之後，會即時通知受影響軟體的開發者，在開發者還沒修補此漏洞前，不會對外公佈<ref name="announcement" />。但90天之後，無論原開發者是否已修復漏洞，都會自動公開<ref name="engadget">{{cite web|url=http://www.engadget.com/2015/01/02/google-posts-unpatched-microsoft-bug/|title=Google posts Windows 8.1 vulnerability before Microsoft can patch it|last=Dent|first=Steven|date=2 January 2015|publisher=[[Engadget]]|accessdate=4 January 2015|archive-date=2015-01-20|archive-url=https://web.archive.org/web/20150120114842/http://www.engadget.com/2015/01/02/google-posts-unpatched-microsoft-bug/|dead-url=no}}</ref>。<br />
<br />
==知名成員==<br />
*[[克里斯·伊凡斯]]<ref name="wired" />：團隊領導者<br />
*[[喬治·霍茲]]（George Hotz）<ref name="wired">{{cite web|url=http://www.wired.com/2014/07/google-project-zero/|title=Meet ‘Project Zero,’ Google’s Secret Team of Bug-Hunting Hackers|last=Greenberg|first=Andy|date=15 July 2014|publisher=[[Wired.com]]|accessdate=4 January 2015|archive-date=2015-01-22|archive-url=https://web.archive.org/web/20150122232050/http://www.wired.com/2014/07/google-project-zero/|dead-url=no}}</ref><br />
*[[Ben Hawkes]]<ref name="wired" /><br />
*[[Tavis Ormandy]]<ref name="wired" /><br />
*[[Ian Beer]]<ref name="wired" /><br />
*[[James Forshaw]]<ref name="wired" /><br />
*[[約翰·霍恩]]（Jann Horn）<br />
*Derick Sun<br />
<br />
== 重要发现 ==<br />
* Google Project Zero早期发布的一份报告引起了人们的关注，该报告涉及一个允许黑客控制运行[[Safari 浏览器]]的软件的漏洞。<ref>{{Cite book |url=https://books.google.com/books?id=8iNIDwAAQBAJ&q=Ben+Hawkes+google&pg=PT80 |title=TIME Cybersecurity: Hacking, the Dark Web and You |date=2018-01-19 |publisher=Time Inc. Books |isbn=9781547842414 |language=en}}</ref> 该团队，特别是 Beer，因其努力在Apple的简短感谢信中被提及。<br />
*2014年9月30日，Google 在[[Windows 8.1]]的系统调用 "NtApphelpCacheControl" 中发现了一个安全漏洞，该漏洞允许普通用户获得管理员权限。<ref>{{cite web|url=https://code.google.com/p/google-security-research/issues/detail?id=118|title=Issue 118: Windows: Elevation of Privilege in ahcache.sys/NtApphelpCacheControl|date=30 September 2014|accessdate=4 January 2015|archive-date=2016-03-14|archive-url=https://web.archive.org/web/20160314144327/https://code.google.com/p/google-security-research/issues/detail?id=118|dead-url=yes}}</ref> [[Microsoft]]立即收到了有关该问题的通知，但未能在 90 天内修复该问题，这意味着有关该漏洞的信息于 2014年12月29日公开发布。<ref name="engadget" /> 将该漏洞公之于众引发了 Microsoft 的回应，称他们正在解决该问题。<ref name="engadget" /><br />
*2015年3月9日，Google Project Zero的博客发布了一篇客座文章，披露了如何利用常见 DRAM 硬件漏洞[[Rowhammer|Row Hammer]]来提升本地用户的权限。<ref name="googleprojectzeroblog_rowhammer">{{cite web|url=https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html|accessdate=11 April 2019|title=Exploiting the DRAM rowhammer bug to gain kernel privileges|date=9 March 2015 }}</ref> 这篇文章引发了学术界和硬件界的大量后续研究。<br />
*2017年2月19日，Google 在[[Cloudflare]]的反向代理中发现了一个漏洞，<ref name=":0">{{cite web|url=https://bugs.chromium.org/p/project-zero/issues/detail?id=1139|title=Issue 1139: cloudflare: Cloudflare Reverse Proxies are Dumping Uninitialized Memory|date=19 February 2017|accessdate=24 February 2017|archive-date=2018-04-01|archive-url=https://web.archive.org/web/20180401092231/https://bugs.chromium.org/p/project-zero/issues/detail?id=1139|dead-url=no}}</ref> 该漏洞导致其边缘服务器运行到缓冲区末尾之后，并返回包含 HTTP Cookie、身份验证令牌、HTTP POST 正文和其他敏感数据等隐私信息的内存。其中一些数据被搜索引擎缓存。<ref>{{cite web|url=https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/|title=Incident report on memory leak caused by Cloudflare parser bug|date=23 February 2017|publisher=Cloudflare|accessdate=24 February 2017|archive-date=2018-03-06|archive-url=https://web.archive.org/web/20180306132452/https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/|dead-url=no}}</ref> Project Zero团队的一名成员将此漏洞称为[[Cloudbleed]]。<ref name=":0" /><br />
*2017年3月27日，Project Zero的 Tavis Ormandy 在流行的密码管理器[[LastPass]]中发现了一个漏洞。<ref>{{Cite web|url=https://nakedsecurity.sophos.com/2017/03/29/another-hole-opens-up-in-lastpass-that-could-take-weeks-to-fix/|title=Another hole opens up in LastPass that could take weeks to fix|date=2017-03-29|website=Naked Security|access-date=2017-03-29|archive-date=2018-10-10|archive-url=https://web.archive.org/web/20181010031918/https://nakedsecurity.sophos.com/2017/03/29/another-hole-opens-up-in-lastpass-that-could-take-weeks-to-fix/|dead-url=no}}</ref>2017年3月31日，LastPass 宣布他们已修复该问题。<ref>{{cite web|last1=Siegrist|first1=Joe|title=Security Update for the LastPass Extension|url=https://blog.lastpass.com/2017/03/security-update-for-the-lastpass-extension.html/|website=LastPass Blog|accessdate=2 May 2017|date=31 March 2017|archive-date=7 April 2018|archive-url=https://web.archive.org/web/20180407005605/https://blog.lastpass.com/2017/03/security-update-for-the-lastpass-extension.html/|url-status=dead}}</ref><br />
*2017年年中，Project Zero参与发现了影响大多数现代[[中央处理器|CPU]]的[[熔毁 (安全漏洞)|Meltdown]]和[[幽灵 (安全漏洞)|Spectre]]漏洞，并于 2018年1 月初披露。<ref>{{Cite magazine|url=https://www.wired.com/story/critical-intel-flaw-breaks-basic-security-for-most-computers/|title=A Critical Intel Flaw Breaks Basic Security for Most Computers|last=Greenberg|first=Andy|date=2018-01-03|magazine=WIRED|access-date=2018-01-04|language=en-US|archive-date=2018-01-03|archive-url=https://web.archive.org/web/20180103204011/https://www.wired.com/story/critical-intel-flaw-breaks-basic-security-for-most-computers/|dead-url=no}}</ref> 该问题由 Jann Horn 独立于其他报告该安全漏洞的研究人员发现，并计划于 2018年1月9日发布，但由于越来越多的猜测而提前了发布日期。<ref name="slashgear20180103">{{Cite news|url=https://www.slashgear.com/google-reveals-cpu-security-flaw-meltdown-and-spectre-details-03513512/|title=Google reveals CPU security flaw Meltdown and Spectre details|last=Davies|first=Chris|date=2018-01-03|work=SlashGear|access-date=2018-01-04|language=en-US|archive-date=2018-06-13|archive-url=https://web.archive.org/web/20180613013302/https://www.slashgear.com/google-reveals-cpu-security-flaw-meltdown-and-spectre-details-03513512/|dead-url=no}}</ref><br />
*2019年2月1日，Project Zero向[[Apple Inc.|Apple]]报告称，他们发现了一组五个独立且完整的 iPhone 利用链，影响从[[iOS 10]]到所有版本[[iOS 12]]的系统，这些漏洞并非针对特定用户，但能够感染任何访问过受感染网站的用户。一系列被黑客入侵的网站被用于针对其访问者的无差别[[水坑攻击]]，Project Zero估计这些网站每周接待数千名访问者。Project Zero认为，这些攻击表明，一个组织在至少两年的时间里一直在持续努力地攻击某些社区的 iPhone 用户。<ref>{{Cite web |last=Tim |date=2019-08-29 |title=Project Zero: A very deep dive into iOS Exploit chains found in the wild |url=https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html |access-date=2019-08-30 |website=Project Zero |archive-date=2025-02-05 |archive-url=https://web.archive.org/web/20250205225954/https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html |dead-url=no }}</ref> Apple在2019年2月7日发布的iOS 12.1.4中修复了这些漏洞，<ref>{{Cite web |last=Cox |first=Joseph |date=2019-08-30 |title=Google Says Malicious Websites Have Been Quietly Hacking iPhones for Years |url=https://www.vice.com/en_us/article/bjwne5/malicious-websites-hacked-iphones-for-years |access-date=2019-08-30 |website=Vice |language=en |archive-date=2020-06-05 |archive-url=https://web.archive.org/web/20200605111907/https://www.vice.com/en_us/article/bjwne5/malicious-websites-hacked-iphones-for-years |dead-url=no }}</ref> 并表示在Project Zero报告时，修复工作已经在进行中。<ref>{{cite web |last=Goodin |first=Dan |date=7 September 2019 |title=Apple takes flak for disputing iOS security bombshell dropped by Google |url=https://arstechnica.com/information-technology/2019/09/apple-takes-flak-for-disputing-ios-security-bombshell-dropped-by-google/ |website=Ars Technica |access-date=2024-08-03 |archive-date=2024-12-06 |archive-url=https://web.archive.org/web/20241206165308/https://arstechnica.com/information-technology/2019/09/apple-takes-flak-for-disputing-ios-security-bombshell-dropped-by-google/ |dead-url=no }}</ref><br />
*2019年4月18日，Project Zero在[[Apple Inc.|Apple]][[iMessage]]中发现了一个漏洞，其中某个格式错误的消息可能导致[[SpringBoard|Springboard]]“……反复崩溃并重新生成，导致无法显示用户界面，并且手机停止响应输入。”<ref>{{cite web | url=https://bugs.chromium.org/p/project-zero/issues/detail?id=1826 | title=Issue 1826: iMessage: malformed message bricks iPhone | publisher=bugs.chromium.org | date=18 April 2019 | accessdate=9 September 2019 | archive-date=2024-12-12 | archive-url=https://web.archive.org/web/20241212164112/https://bugs.chromium.org/p/project-zero/issues/detail?id=1826 | dead-url=no }}</ref> 这将导致[[IPhone|iPhone]]的[[用户界面|UI]]完全崩溃，使其无法操作。即使在[[硬件重置]]后，该漏洞仍然存在。该漏洞还会影响[[MacOS|Mac]]上的 iMessage，但结果不同。Apple 在Project Zero发布该漏洞之前的90天内修复了该漏洞。<br />
* 2021年12月，该团队根据其与 Apple[[安全工程与架构]]（SEAR）小组的合作，发布了[[FORCEDENTRY]]漏洞的技术细则。<ref name="projectzero">{{Cite web|last1=Beer|first1=Ian|last2=Groß|first2=Samuel|date=2021-12-15|title=Project Zero: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution|url=https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html|access-date=2021-12-16|website=[[Google Project Zero]]|archive-date=2021-12-16|archive-url=https://web.archive.org/web/20211216121726/https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html|dead-url=no}}</ref><br />
<br />
== 参考文献 ==<br />
{{Reflist}}<br />
<br />
== 外部連結 ==<br />
* {{en}}[http://googleprojectzero.blogspot.com/ Official blog]{{Wayback|url=http://googleprojectzero.blogspot.com/ |date=20141225000730 }}<br />
* {{en}}[https://code.google.com/p/google-security-research/issues/list?can=1 Database of detected vulnerabilities]{{Wayback|url=https://code.google.com/p/google-security-research/issues/list?can=1 |date=20150128114716 }}<br />
* {{en}}[https://www.google.com/about/appsecurity/research/ List of vulnerabilities found by Google before starting "Project Zero"]{{Wayback|url=https://www.google.com/about/appsecurity/research/ |date=20150131230522 }}<br />
<br />
{{-}}<br />
{{Google公司}}<br />
<br />
[[Category:Google]]<br />
[[Category:資訊安全]]<br />
[[Category:2014年建立的計畫]]</div>
imported>暁月凛奈