Project Zero

Project Zero is a computer security team at Google dedicated to discovering zero-day vulnerabilities — flaws unknown to the vendor and unpatched at the time of discovery — in software from any vendor, not only Google's own products. The team was publicly announced on July 15, 2014, in the wake of Heartbleed, the catastrophic OpenSSL bug that Google engineer Neel Mehta had privately reported that April. Heartbleed underscored how a single unnoticed flaw in widely-used software could undermine security across the internet, and Google, then in the middle of a broader push to harden infrastructure following the 2013 Edward Snowden revelations about mass surveillance, formed a standing unit whose sole mandate was to hunt for such bugs before attackers or intelligence agencies could exploit them. The team was established by Chris Evans, previously head of Google Chrome's security team.

Disclosure Policy

Project Zero's defining and most contested practice is its public vulnerability disclosure policy. Under the current "90+30" framework, once a vulnerability is privately reported to a vendor, the vendor has 90 days to ship a fix; if a patch appears before then, technical details are published 30 days after the patch is released, giving users time to update. If no patch appears within 90 days, Project Zero discloses regardless. Vendors may request a short grace period (extending the patch deadline to 104 days, with disclosure following at 120 days), and for vulnerabilities already being exploited in the wild, the timeline compresses sharply, to as little as 7 days before disclosure. The policy has drawn criticism from vendors, most notably Microsoft, after Project Zero disclosed a Windows 8.1 privilege-escalation flaw in 2014 before a patch was ready, and it remains a recurring point of tension between Google and other software makers who argue the deadline is sometimes too rigid, while Project Zero maintains that firm deadlines are necessary to keep vendors accountable.

Notable Work

Over its history, Project Zero researchers have been credited with independently discovering or analyzing major vulnerabilities and classes of attack, including the Rowhammer DRAM hardware flaw (2015), the Cloudflare "Cloudbleed" memory-leak bug (2017), a chain of iOS exploits used against Uyghur activists that the team documented in a widely read 2019 blog series, and the FORCEDENTRY iMessage exploit chain used by NSO Group's Pegasus spyware, which the team reverse-engineered and published a technical breakdown of in December 2021. Team member Jann Horn was one of the independent co-discoverers of the Meltdown and Spectre CPU vulnerabilities, disclosed jointly with other research groups in January 2018.

Structure and People

Project Zero operates as a small, distributed team of researchers who publish findings on the Project Zero blog and maintain a public bug tracker recording each reported vulnerability's disclosure timeline. Researchers associated with the team, several of whom have individual entries elsewhere in this encyclopedia, include Tavis Ormandy, Natalie Silvanovich, James Forshaw, and Ian Beer. Ben Hawkes managed the team for several years before departing in 2022; Project Zero has continued publishing research and its annual "Year in Review" reports since.

Timeline

• 2014-04-01Google engineer Neel Mehta privately reports the Heartbleed OpenSSL vulnerability, an event that helped motivate Project Zero's creation.
• 2014-07-15Google publicly announces the formation of Project Zero, led by Chris Evans.
• 2014-09-30Project Zero discloses a Windows 8.1 privilege-escalation vulnerability after the 90-day deadline passed without a Microsoft patch, drawing criticism of the policy.
• 2015-03-09Project Zero publishes research on the Rowhammer DRAM hardware vulnerability.
• 2017-02-19Tavis Ormandy discovers the Cloudflare 'Cloudbleed' memory-disclosure bug.
• 2017-07-28Jann Horn and other independent researchers privately disclose the Meltdown and Spectre CPU vulnerabilities to affected vendors.
• 2018-01-03Meltdown and Spectre are publicly disclosed, ahead of the originally coordinated release date, after details began leaking.
• 2019-02-01Project Zero publishes a detailed analysis of a chain of iOS exploits found being used in watering-hole attacks.
• 2021-12Project Zero publishes a technical breakdown of the FORCEDENTRY iMessage exploit chain used by NSO Group's Pegasus spyware.
• 2022-05-04Ben Hawkes departs as manager of Project Zero.