Google Online Security Blog: March 2016

Security Blog

The latest news and insights from Google on security and safety on the Internet

More Encryption, More Notifications, More Email Security

24 March 2016

Posted by Nicolas Lidzborski, Gmail Security Engineering Lead and Jonathan Pevarnek, Jigsaw EngineerNew tools and industry standards make email even saferSafer Internet Day

increased by 25%researchdraft IETF specificationSafe Browsing makes Gmail more secureSafe BrowsingUnwanted SoftwareAndroid

Enhancing state-sponsored attack warningsSince 2012

Google

Certificate Transparency for Untrusted CAs

21 March 2016

Posted by Martin Smith, Software Engineer, Certificate TransparencyCertificate TransparencyInitially

Those that were once trusted and have since been withdrawn from the root programs.

New CAs that are on the path to inclusion in browser trusted roots.

Including these in trusted logs is problematic for several reasons, including uncertainties around revocation policies and the possibility of cross-signing attacks being attempted by malicious third-parties.

However, visibility of these CAs’ activities is still useful, so we have created a new CT log for these certificates. This log will not be trusted by Chrome, and will provide a public record of certificates that are not accepted by the existing Google-operated logs.

The new log is accessible at ct.googleapis.com/submariner and is listed on our Known Logs page. It has the same API as the existing logs.

Initially, Submariner includes certificates chaining up to the set of root certificates that Symantec recently announced it had discontinued, as well as a collection of additional roots suggested to us that are pending inclusion in Mozilla.

Once Symantec’s affected certificates are no longer trusted by browsers, we will be withdrawing them from the trusted roots accepted by our existing logs (Aviator, Pilot, and Rocketeer).

Third parties are invited to suggest additional roots for potential inclusion in the new log by email to google-ct-logs@googlegroups.com.

Everyone is welcome to make use of the log to submit certificates and query data. We hope it will prove useful and help to improve web security.

Google

BinDiff now available for free

18 March 2016

Posted by Christian Blichmann, Software Engineer

Compare binary files for x86, MIPS, ARM/AArch64, PowerPC, and other architectures.

Identify identical and similar functions in different binaries.

Port function names, comments and local variable names from one disassembly to another.

Detect and highlight changes between two variants of the same function.

Here is a screenshot demonstrating what using BinDiff to display per-function differences looks like:

At Google, the BinDiff core engine powers a large-scale malware processing pipeline helping to protect both internal and external users. BinDiff provides the underlying comparison results needed to cluster the world's malware into related families with billions of comparisons performed so far.

Ever since zynamics joined Google in 2011, we have been committed to keeping our most valuable tools available to the security research community. We first lowered the price, and today we are taking the next logical step by making it available free of charge.

You can download BinDiff from the zynamics web site. It’s the current version, BinDiff 4.2 for both Linux and Windows. To use it, you also need the commercial Hex-Rays IDA Pro disassembler, 6.8 or later.

Happy BinDiff-ing!

Google

Securing the web, together

15 March 2016

Posted by Rutledge Chin Feman and Tim Willis, HTTPS EvangelistsTransparency ReportGoogle sitesadsBlogger

This chart represents the percentage of requests to Google's servers that used encrypted connections. YouTube traffic is currently not included in this data.
We plan on adding additional Google products over time to increase the scope of this report.

Popular third-party sites
Our report also includes data about the HTTPS connections on many popular sites across the web, beyond Google. We've chosen these sites based on a combination of publicly-available Alexa data and our own Google internal data; we estimate they account for approximately 25% of all web traffic on the Internet.

Certificate Transparency
Websites use certificates to assert to users that they are legitimate, so browsers need to be able to check whether the certificate that you’re being presented is valid and appropriately issued. That is why this report also offers a Certificate Transparency log viewer, providing a web interface for users and site administrators to easily check and see who has issued a certificate for a website. For example, if you use this log viewer and search for google.com with ‘include expired' checked, you'll see the mis-issued google.com certificate from September 2015.

Encryption for everyone
Implementing HTTPS can be difficult—we know from experience! Some common obstacles include:

Older hardware and/or software that doesn’t support modern encryption technologies.

Governments and organizations that may block or otherwise degrade HTTPS traffic.

Organizations that may not have the desire or technical resources to implement HTTPS.

we’ve put together a resource for webmasters to useEncrypt the Web
Implementing encryption is not easy work. But, as more people spend more of their time on the web, it’s an increasingly essential element of online security. We hope this report will provide a snapshot of our own encryption efforts and will encourage everyone to make HTTPS the default on the web, even faster.

Google

Get Rich or Hack Tryin’

14 March 2016

Posted by Nathan Parker, Chrome Defender and Tim Willis, Hacker PhilanthropistGoogle paid researchers more than $2,000,000 for their work

Increasing our top reward from $50,000 to $100,000. Last year we introduced a $50,000 reward for the persistent compromise of a Chromebook in guest mode. Since we introduced the $50,000 reward, we haven’t had a successful submission. That said, great research deserves great awards, so we’re putting up a standing six-figure sum, available all year round with no quotas and no maximum reward pool.

Adding a Download Protection Bypass bounty. We’re extending our reward program scope to include rewards for methods that bypass Chrome’s Safe Browsing download protection features. There’s much more detail on this new category on our rewards page - be sure to take a look if you’re interested.

We look forward to seeing some amazing bugs and continuing to work with the security research community.
Happy hacking!

Google

Scalable vendor security reviews

7 March 2016

Posted by Lukas Weichselbaum and Daniel Fabian, Google Security[Cross-posted on the Google Open Source Blog]https://github.com/google/vsaq

Web Application Security Questionnaire

Security & Privacy Program Questionnaire

Infrastructure Security Questionnaire

Physical & Data Center Security Questionnaire

All four base questionnaire templates can be readily extended with company-specific questions. Using the same questionnaire templates across companies may help to scale assessment efforts. Common templates can also minimize the burden on vendor companies, by facilitating the reuse of responses.
The VSAQ Framework comes with a simple client-side-only reference implementation that's suitable for self-assessments, for vendor security programs with a moderate throughput, and for just trying out the framework. For a high-throughput vendor security program, we recommend using the VSAQ Framework with a custom server-side component that fits your needs (the interface is quite simple).
Give VSAQ a try! A demo version of the VSAQ Framework is available here: https://vsaq-demo.withgoogle.com

Excerpt from Security and Privacy Programs Questionnaire
Let us know how VSAQ works for you: contact us. We look forward to getting your feedback and continuing to make vendor reviews scalable — and maybe even fun!