This is great research and a great write-up, but I'm a little (pleasantly) surprised to see it on GitHub's blog.
Does anyone know what their "business reason" for doing research like this is? (not that a business reason should be needed, but like I said, I'm a bit surprised to see it here)
Unlike other departments, security teams often don’t have anything to do so this research is a good use of free time.
What is this comment? Github security research lab solely focuses on security research and publishes some of the best research in the industry.
Man Yue Mo is a security researcher who finds some of the most complex and impactful bugs in the industry like crbug.com/40065473
Seeing mmsc's post history, especially computer security related comments, I presume he was just being sarcastic :)
Indeed.
Although, it wouldn’t be abnormal for a security team to have free time, and dedicate it to researching an emerging technology whether it directly contributes to the business goals or not. Of course I’m not talking about a security team that is reading log files from their SIEM while sitting in a SOC.
Sadly people didn't see the sarcasm in this comment
i understand people disliking using tone indicators, especially when they can ruin a joke, but they are really wonderful things that can prevent misunderstandings like this online
How many security teams have you been on? Definitely ones with less work than I've been on...
Wow, that's just absolutely incorrect. Ignoring that tons of security teams are actually stupidly busy, this person's specific role at GitHub is security research. GitHub have security products for code security, which he ties into.
This work comes from GitHub's Security Lab https://securitylab.github.com/
A little surprising that hasn't been shifted into MSRC, but GitHub operates very independently inside Microsoft.
Man Yue Mo worked at Semmle (https://blog.sonatype.com/steps-to-responsible-disclosure) before it was acquired by GitHub (https://github.blog/2019-09-18-github-welcomes-semmle/). That research function has carried on as the GitHub Security Lab.
Semmle built CodeQL, now offered by GitHub (https://docs.github.com/en/code-security/code-scanning/intro...), which GitHub and Microsoft (see https://www.microsoft.com/en-us/security/blog/2023/11/02/ann...) want to associate with "deep security insight".
So they continue to fund this kind of novel security research, for which security practitioners across industry are grateful.
They got bought by Microsoft and so have the resources to sponsor research, including of this kind. There’s a GitHub app, and the security of that app is not outside their purview. if an attacker manages to install a lurky app on your phone, they could do stuff as you. if you're someone with GitHub clout, that could be real damaging so it's in their interests to find such vulnerabilities.
They have hosted action runners for arm too. So, they may have an interest in checking and verifying the security capabilities of arm hardware with MTE for sandboxing.
I think it's basically basic research [0]. In first order reasoning, github, as a product doesn't really need android security experts. But employing them has some potential long-term benefits.
[0]: https://en.wikipedia.org/wiki/Basic_research