{"id":61990,"date":"2022-02-10T12:00:31","date_gmt":"2022-02-10T17:00:31","guid":{"rendered":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/?p=61990"},"modified":"2022-02-15T11:10:49","modified_gmt":"2022-02-15T16:10:49","slug":"project-zero-bug-fixes-data","status":"publish","type":"post","link":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/","title":{"rendered":"Project Zero researchers see promising trends in vulnerability fixes"},"content":{"rendered":"

Big tech vendors generally are remediating serious bugs faster than they were three years ago, according to a new report from Google’s Project Zero<\/a>.<\/p>\n

The data \u2014 while limited to vulnerabilities the group itself reported between January 2019 and December 2021, and influenced by what the group’s researchers have chosen to pursue \u2014 offers “a number of promising trends,” according to Ryan Schoen of Project Zero<\/a>.<\/p>\n

“Vendors are fixing almost all of the bugs that they receive, and they generally do it within the 90-day deadline plus the 14-day grace period when needed,” he wrote. In 2021 there was not “a single 90 day deadline exceeded,” which could be because responsible disclosure policies are becoming more standard across the industry, “and vendors are more equipped to react rapidly to reports with differing deadlines,” he wrote.<\/p>\n

Under the team’s vulnerability disclosure policy<\/a>, it privately tells a vendor about a bug first, with the warning that it will publish the information after 90 days if the vendor takes no action. Vendors can get a 14-day extension beyond those 90 days if a patch is already on its way.<\/p>\n

Project Zero reported 376 issues to vendors in the roughly three-year time frame, and 350 \u2014 93.1 percent \u2014 have been fixed, the data show. The bulk of the reports are for products from three main vendors: Microsoft (26 percent), Apple (23 percent) and Google (16 percent).<\/p>\n

The overall time it’s taken for vendors to fix bugs and release fixed versions to the public has “consistently been decreasing” over the time frame, Schoen noted. Microsoft, Apple and developers for Linux have all reduced their time to fix, while a host of other major vendors \u2014 such as Adobe, Aapache, Facebook, Github, Oracle and others \u2014 have “collectively cut their time to fix in half,” he wrote, but that could be a reflection of less Project Zero research on those vendors as well.<\/p>\n

In a more apples-to-apples comparison, the team looked at its work on mobile phone operating system bugs, focusing on iOS, Android (Samsung) and Android (Pixel). All three vendors have an “extraordinarily similar average time to fix,” Schoen wrote, ranging from 69 days to 72 days.<\/p>\n

Shoen added that a caveat with the group’s data is that Project Zero bug reports “may be outliers” in that vendors know the bugs will be reported within a defined timeline, and also because “Project Zero is a trusted source of reliable bug reports.”<\/p>\n

Formed in 2014<\/a>, the group includes widely recognized security researchers, and earned plaudits<\/a> as it works with vendors to help secure their products and the wider internet. Project Zero also has ruffled feathers<\/a> of both vendors and Western government hackers upset that the group’s work has burned counterterrorism operations.<\/p>\n","protected":false},"excerpt":{"rendered":"

Data from the Google-based team seems to reflect an industry getting faster at fixing bugs and deploying patches.<\/p>\n","protected":false},"author":261,"featured_media":62012,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"disable_grayscale_images":true,"grayscale_contrast":0,"sponsored_content":false,"display_author_bio":true,"story_type":"","footnotes":""},"categories":[5974],"tags":[105,4439,1237,795,763,740,511,278,238],"people":[],"special-report":[],"authors":[],"class_list":["post-61990","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threats","tag-apple","tag-zero-days","tag-linux","tag-firefox","tag-chrome","tag-google-project-zero","tag-vulnerability-disclosure","tag-google","tag-microsoft"],"yoast_head":"\nProject Zero researchers see promising trends in vulnerability fixes | CyberScoop<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Project Zero researchers see promising trends in vulnerability fixes\" \/>\n<meta property=\"og:description\" content=\"Data from the Google-based team seems to reflect an industry getting faster at fixing bugs and deploying patches.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/\" \/>\n<meta property=\"og:site_name\" content=\"CyberScoop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\" \/>\n<meta property=\"article:published_time\" content=\"2022-02-10T17:00:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-02-15T16:10:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2022\/02\/GettyImages-1230992863.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"683\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"AJ Vicens\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@AJVicens\" \/>\n<meta name=\"twitter:site\" content=\"@CyberScoopNews\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/project-zero-bug-fixes-data\\\/\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/project-zero-bug-fixes-data\\\/\",\"name\":\"Project Zero researchers see promising trends in vulnerability fixes | CyberScoop\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/project-zero-bug-fixes-data\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/project-zero-bug-fixes-data\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2022\\\/02\\\/GettyImages-1230992863.jpg\",\"datePublished\":\"2022-02-10T17:00:31+00:00\",\"dateModified\":\"2022-02-15T16:10:49+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/project-zero-bug-fixes-data\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/project-zero-bug-fixes-data\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/project-zero-bug-fixes-data\\\/#primaryimage\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2022\\\/02\\\/GettyImages-1230992863.jpg\",\"contentUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2022\\\/02\\\/GettyImages-1230992863.jpg\",\"width\":1024,\"height\":683,\"caption\":\"(Photo by Matic Zorman\\\/Getty Images)\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/project-zero-bug-fixes-data\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Project Zero researchers see promising trends in vulnerability fixes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#website\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/\",\"name\":\"CyberScoop\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#organization\",\"name\":\"CyberScoop\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2023\\\/01\\\/CyberScoop-Black.png\",\"contentUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2023\\\/01\\\/CyberScoop-Black.png\",\"width\":1545,\"height\":186,\"caption\":\"CyberScoop\"},\"image\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cyberscoop\\\/\",\"https:\\\/\\\/x.com\\\/CyberScoopNews\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/cyberscoop\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCDG2jjHiZ8r97MCVnsaAkXw\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Project Zero researchers see promising trends in vulnerability fixes | CyberScoop","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/","og_locale":"en_US","og_type":"article","og_title":"Project Zero researchers see promising trends in vulnerability fixes","og_description":"Data from the Google-based team seems to reflect an industry getting faster at fixing bugs and deploying patches.","og_url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/","og_site_name":"CyberScoop","article_publisher":"https:\/\/www.facebook.com\/cyberscoop\/","article_published_time":"2022-02-10T17:00:31+00:00","article_modified_time":"2022-02-15T16:10:49+00:00","og_image":[{"width":1024,"height":683,"url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2022\/02\/GettyImages-1230992863.jpg","type":"image\/jpeg"}],"author":"AJ Vicens","twitter_card":"summary_large_image","twitter_creator":"@AJVicens","twitter_site":"@CyberScoopNews","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/","name":"Project Zero researchers see promising trends in vulnerability fixes | CyberScoop","isPartOf":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#website"},"primaryImageOfPage":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/#primaryimage"},"image":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/#primaryimage"},"thumbnailUrl":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2022\/02\/GettyImages-1230992863.jpg","datePublished":"2022-02-10T17:00:31+00:00","dateModified":"2022-02-15T16:10:49+00:00","breadcrumb":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/#primaryimage","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2022\/02\/GettyImages-1230992863.jpg","contentUrl":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2022\/02\/GettyImages-1230992863.jpg","width":1024,"height":683,"caption":"(Photo by Matic Zorman\/Getty Images)"},{"@type":"BreadcrumbList","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/project-zero-bug-fixes-data\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/"},{"@type":"ListItem","position":2,"name":"Project Zero researchers see promising trends in vulnerability fixes"}]},{"@type":"WebSite","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#website","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/","name":"CyberScoop","description":"","publisher":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#organization","name":"CyberScoop","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#\/schema\/logo\/image\/","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2023\/01\/CyberScoop-Black.png","contentUrl":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2023\/01\/CyberScoop-Black.png","width":1545,"height":186,"caption":"CyberScoop"},"image":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cyberscoop\/","https:\/\/x.com\/CyberScoopNews","https:\/\/www.linkedin.com\/company\/cyberscoop\/","https:\/\/www.youtube.com\/channel\/UCDG2jjHiZ8r97MCVnsaAkXw"]}]}},"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"CyberScoop","distributor_original_site_url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop","push-errors":false,"jetpack_featured_media_url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2022\/02\/GettyImages-1230992863.jpg","_links":{"self":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts\/61990","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/users\/261"}],"replies":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/comments?post=61990"}],"version-history":[{"count":9,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts\/61990\/revisions"}],"predecessor-version":[{"id":62028,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts\/61990\/revisions\/62028"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/media\/62012"}],"wp:attachment":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/media?parent=61990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/categories?post=61990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/tags?post=61990"},{"taxonomy":"people","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/people?post=61990"},{"taxonomy":"special-report","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/special-report?post=61990"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/authors?post=61990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}