Project Zero: Five Years of 'Make 0Day Hard'

The speaker discusses the importance of open attack research and the Project Zero model in improving cybersecurity. They also address the challenge of the public understanding of attacks diverging from the private state of attacks.

• Open attack research in the Project Zero model provides the best path forward to improving cybersecurity
• The public understanding of attacks may diverge from the private state of attacks, making it difficult to counter
• Security researchers need to model tacit behavior to make optimal decisions
• There are many justifiable models for attacking behaviors, making it a challenge to model
• The vulnerability disclosure debate is unlikely to be solved

The speaker mentions a piece of digital art from 1974 that highlights the subjective and profound impact of machines on humans. They use this to emphasize the importance of making machines safe to use.

This year marks the fifth anniversary of Project Zero, an applied security research team at Google that aims to "make 0day hard". It has been a tumultuous and exciting journey so far, and we've managed to explore a huge range of weird and wonderful attacks. Full-chain browser exploits. Remote WiFi firmware attacks. The trials and tribulations of Flash! Kernel and userland privilege escalation for Linux, Windows, macOS, chromeOS, iOS, and Android. Hypervisor escapes. Oh, and something about speculative execution...We've published a dizzying array of vulnerabilities and exploits. But why? How? And what does this all mean for user security? This presentation gives a behind-the-scenes look at Project Zero's work, and a retrospective assessment of the impact this work has had. We'll look at why a team like Project Zero is needed in the first place, and some of the core principles that we use to make decisions. We'll dive into some of the classic hits from Project Zero's portfolio, and share some of the technical insights that result. And finally, we'll share some of the lessons learned, and a sketch for the next five years of Project Zero.