Googler Drops Windows Zero-Day, Microsoft Unhappy

http://threatpost.com/en_us/blogs/googler-drops-windows-zero-day-microsoft-unhappy-061010

by ukdm • 16 years ago

73 47 16 years ago

epochwolf• 16 years ago

I hardly think 5 days is enough time for Microsoft to patch this. The guy could have given them two weeks before releasing the exploit.

davidcuddeback• 16 years ago

The article says "Ormandy said protocol handlers are a popular source of vulnerabilities and argued that 'hcp://' itself has been the target of attacks multiple times in the past."

I'm not defending his actions, but I think he's arguing that it's likely that black-hats already know about the vulnerability because it occurs in a heavily targeted attack vector. Therefor, releasing details gives IT professionals the knowledge they need to setup firewalls or do whatever they have to do to protect against the vulnerability while waiting for an official patch from Microsoft.

With that said, perhaps there's a better way to accomplish that goal.

tptacek13• 16 years ago

You can make that same argument about a whole lot of different vulnerabilities, for what it's worth. The core issue is that a lot of people practice "responsible disclosure" by custom but don't really buy into the principle of it. Can't blame 'em.

kenjackson2• 16 years ago

That's an absurd excuse for Ormandy. As, I'm sure Ormandy knows, IT pros are a LOT less likely to implement a workaround to this problem than are hackers likely to exploit it.

Furthermore, MS stated that the provided workaround is insufficient and easily circumvented.

And, he provides no evidence that any blackhats know about this at all.

To me this clearly looked like a way for Google to try to attack MS's security -- this goes hand in hand with their PR stunt of moving Google employees off of Windows due to security.

btilly4• 16 years ago

The article links to http://threatpost.com/en_us/blogs/does-google-have-double-st... which discusses the ethics of this situation, and makes unspecified allegations that Google does "all sorts of hinky things behind your back" that justifies doing full disclosure against them.

Does anyone have any idea of what their beef is with Google?

tptacek13• 16 years ago

Tavis works for Google. He's one of their best-known security researchers.

Tavis published a Microsoft remote. Without waiting for a patch. That is unusual. Most researchers, Tavis included in other situations, don't do that.

Not at all surprising Microsoft took it personally. That doesn't mean it's constructive for MSFT to complain. But, there you go.

gojomo• 16 years ago

I understand the anger over this quick-publish.

But I also wonder what Robert Hansen was alluding to with the "all sorts of hinky things behind your back" statement. It seems to be about Google's behavior in prior situations.

btilly4• 16 years ago

You gave an excellent answer to the question I didn't ask. I don't need to be told why MSFT is unhappy. I want to know why Robert Hansen is upset enough at Google's practices that he wants full disclosure used against them.

Natsu2• 16 years ago

You're absolutely right, which makes me wonder if something else could be going on. The article makes it sound like he believed it likely that this exploit is already in the wild, but didn't want to say that directly when he said: "I've concluded that there’s a significant possibility that attackers have studied this component, and releasing this information rapidly is in the best interest of security"

And an active exploit in the wild seems like the kind of thing that would tip the scales. Or maybe he believed that they'd sit on this for 6 months while all the black hats quietly formulated and circulated an exploit.

tptacek13• 16 years ago

Before anyone starts talking about full disclosure or Microsoft or whatnot, just know that whether you agree with Tavis' logic or not, not giving Microsoft a couple weeks to patch a remote is a breach of protocol.

Tavis is one of my favorite researchers to watch and I'm not going to say anything negative about him or how he played this. But if I was Google, I'd be treading very, very, very carefully here. Google's gotten a lot of talent lately, but Microsoft has them way outgunned. We don't need these two companies setting up opposition labs because of a document that ends with "greetz".

Or, maybe we do. Depends on your politics.

(For what it's worth: http://twitter.com/taviso/status/15887290335S)

sayrer4• 16 years ago

security "researcher" does something questionable in order to generate publicity, news at 11

tptacek13• 16 years ago

Tavis is the real deal, Robert.

staunch3• 16 years ago

The idea that Microsoft or Google would create "opposition labs" to attack each other is pretty far out there. You may have been in the jungle of security just a wee bit too long.

tptacek13• 16 years ago

I think you're just reacting to the name I chose. Obviously, plenty of companies large and small run labs staffed with people who do nothing but find flaws in other companies code. For, uh, all sorts of reasons.

jerf2• 16 years ago

Man, that would be awesome. Companies aren't doing a very good job of policing themselves, if they policed each other customers would win big time.

hboon2• 16 years ago

Should be: http://twitter.com/taviso/status/15887290335

ww8520• 16 years ago

That was a dick move. 5 days are not enough to go through debugging, coding, reviewing, testing, and deployment of a complicate software like Windows. 2 weeks to 4 weeks are more reasonable.

count• 16 years ago

Or, 5 days is enough time, because people need to know it's out there, and the developers have had years to get this particular type of bug right.

metamemetics• 16 years ago

Reavey confirmed that the issue affects Windows XP and Windows Server 2003 only.

It's 2010, no one should willingly still be using windows XP unless they like hosting botnets. Can't say windows is the most intelligent choice for a server platform either.

hboon2• 16 years ago

Some server software only runs on Windows.

Googler Drops Windows Zero-Day, Microsoft Unhappy

Related Stories