Google is recruiting a team of bug-hunting research experts to track down lucrative and highly dangerous 'zero day vulnerabilities' in some of the web's most popoular consumer tools

Google is recruiting a team of experienced hackers who will be charged with hunting down serious weaknesses in internet security in the hope they can prevent the most advanced cyber attacks.

The Project Zero team, announced by Google’s “researcher herder” and security chief Chris Evans, will look to protect users of some of the web's most commonly used tools, including Google Chrome, Internet Explorer and other connected software.

“You should be able to use the web without fear that a criminal or state-sponsored actor is exploiting software bugs to infect your computer, steal secrets or monitor your communications,” Evans said in a blog post.

Project Zero will spend much of its time finding “zero-day vulnerabilities” - tech speak for software weaknesses that are unknown to the wider world and are often used to hack people’s computers or smartphones so they can be spied upon.

As these vulnerabilities are usually unknown to the software vendor, there is usually no fix or patch is in place, and so zero-days are hugely valuable to anyone wanting to break into systems with otherwise sound security.

A whole industry has built up around uncovering zero-days in popular software. Market players, who primarily sell to government agencies and law enforcement, have previously claimed that single zero-days have sold for hundreds of thousands of pounds.

Yet these companies, such as France’s VUPEN and America’s Endgame, have come under fire for not sharing their findings. If only a limited people know about a software weakness, they can use it against the wider world, which will not benefit from a fix until an altruistic party uncovers that bug and updates are launched.

Project Zero’s bug hunters will hope to address this by uncovering zero-days before those with malicious intent and immediately setting to work on fixes. Details will be published in an open database for transparency, meaning the wider world will know when a vendor is being responsible or not. The team will also work with other vendors to update and secure software.

“In sophisticated attacks, we see the use of ‘zero-day’ vulnerabilities to target, for example, human rights activists or to conduct industrial espionage. This needs to stop. We think more can be done to tackle this problem,” Evans added.

Brian Honan, a security consultant, believes this altruistic move by Google might negatively affect the market for zero-days. “With such a talented team working on altruistically managing vulnerabilities there could be an impact on the market for such bugs,” said Honan.



But in its bid to boost security across the web, the Google security professionals won’t just be going on bug hunts - they will also carry out research into how attacks are executed and how best to mitigate them. There are no “particular bounds” to what Project Zero will do to fix the internet, Evans said.

Morgan Marquis-Boire, a former Google security engineer who now focuses on protecting activists as part of the Citizen Lab initiative, said Project Zero was likely to be a boon for internet security.

“The security of users doesn't exist in a vacuum. Project Zero is an intriguing effort to improve the ecosystem in which people conduct their digital lives,” said Marquis-Boire, who was involved in early discussions with Evans around forming such a team.



“By focusing specifically on maximum efficacy in killing bugs which are being used to target high-risk users, there seems a good chance this team can have positive real-world impact.”



There are already a host of projects designed to uncover serious software flaws. Google, Facebook, HP, Microsoft, Yahoo and many other tech giants already run bug bounty programmes, which give monetary rewards for those who uncover weaknesses.

Some experts believe that while such initiatives are laudable, more emphasis needs to go on embedding security in products before they hit the market. “As an industry we still need to drive the message home to many software companies that they have a duty of care and responsibility to ensure their code has security built into it from the very beginning,” Honan added.

• UK privacy watchdog seeks stronger powers and better funding