Slashdot Mirror
MS Excel exploit on auction
geo_2677 writes "Someone had put up for auction on eBay the details of an exploit in Microsoft Excel according to a recent article on Securityfocus. According to the article Microsoft has confirmed that this vulnerability exists, but in the meantime the original listing on eBay has been pulled. " The now pulled auction, but it does appear that Microsoft has confirmed the vulnerability in an eweek article.
eBay is infested with public domain repackagers and sellers of "information" that they seem to do nothing about. But if Microsoft doesn't like an auction, it's gone, apparently.
I too have felt the cold finger of injustice.
Looking at the motivation this guy has, I can't really see how it can be good.
So, it was submitted to Microsoft on the 6th, and since then he's recieved a reply stating they'll probably be working on a fix. That was LESS THAN A WEEK AGO. Releasing vulnerabilities is something that, IMO, should only be done if (a) there is some specific need for everyone to know about it right now, or (b) requests for fixes have fallen on deaf ears or otherwise failed for an extended period of time.
This meets neither of those criteria.
- looking to make a profit from releasing details of a vulterability
- phrasing the auction in a way that makes it clear he wants the buyer to do something bad - "It can be assumed that no patch addressing this vulnerability will be available within the next few months"
Sounds to me more like some dumb little script kiddy that got lucky finding a small hole, but doesn't have the ability to do anything with it. Working from an illogical hatred of MS he's trying to get someone else to unleash a virus on the world on his behalf.
What a great guy.
No, criminal profiteering. The only type of person who could make use of the information apart from Microsoft is a criminal.
EBay has a right and a duty to stop trade in vulnerabilities same as they have a right and duty to stop trade in any other illegal material.
This is not 'full disclosure', its selling information to the criminals.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
Ebay is more good than bad, but how can these people sell garbage?
One man's Garbage is Anothers Gold.
You mean a security researcher or corporate security officer couldn't have used that information? People who believe that the suppression of information is okay because it could be misused are heading down a dark road, the price of return from which will have to be paid in blood someday by a future generation.
I too have felt the cold finger of injustice.
I dont think it was very irresponsible, maybe only a little, it just lights that fire under Microsoft to fix it. Considering my lack of using unkown excel files I'm not too worried about it. Like some other posts say, it brought much less attention to the exploit than e-bay pulling it did.
No, criminal profiteering. The only type of person who could make use of the information apart from Microsoft is a criminal.
What about the system administrator trying to secure his networks? There are plenty of legitimate reasons why someone would want to know exactly what the vulnerability is so they are able to stop people from using it.
EBay has a right and a duty to stop trade in vulnerabilities same as they have a right and duty to stop trade in any other illegal material.
So vulnerabilities are now illegal material? Better call the cops and the feds to shut down Microsoft because they seem to be producing a lot of them.
This is not 'full disclosure', its selling information to the criminals.
Wouldn't that depend of the person who would have won the auction? See also point 1).
The bug is believe to be a buffer overflow. This makes it a perfect canidate to execute malicious code within excel. Imagine being able to send an excel file to another company you don't think is being truthful with you and r00ting some of their boxen. You could pretty much spy on them all day without antivirus or antispyware picking you up. Imagine sending the excel file to a game developer and stealing source code for an upcoming game *hint* *hint*. 0-day exploits and unknown exploits are a serious problem because most companies think they are safe with anti-virus. Anti-virus supplies little/no protection against these kinds of attacks.
If an officer ever threatens to taze you, say you have a pacemaker.
Hopefully this one. It will be a good lession in not shitting in your own nest.
Let the revolution begin, i say.
The system had the verbosity of HTML combined with all the readability of compiled assembly viewed as bitmap images
"As the Americans learned so painfully in Earth's final century, free flow of information is the only safeguard against tyranny. The once-chained people whose leaders at last lose their grip on information flow will soon burst with freedom and vitality, but the free nation gradually constricting its grip on public discourse has begun its rapid slide into despotism. Beware of he who would deny you access to information, for in his heart he dreams himself your master."
-- Commissioner Pravin Lal
Real Daleks don't climb stairs - they level the building.
Cosidering that the opening bid was set at $0.01, I doubt he really expected to profit. Instead he probably just wanted to call public attention to the exploit and force Microsoft to address it quickly.
Insert Generic Sig Here:
It seems to me that E-Bay are behaving somewhat unfairly in pulling this auction. The seller has clearly devoted some time and effort into discovering this piece of information and has behaved responsibly by informing Microsoft of the problem in their software.
I see no reason why he shouldn't be compensated for the work he's done here and if Microsoft aren't paying him then it's only fair that he offers his work to the highest bidder, it's perhaps unfortunate for Microsoft that he can leverage the most value for his work before they have had a chance to patch the problem but the seller doesn't have any obligation to Microsoft and their problems are no concern of his.
I'm pretty sure it was meant as a joke, he just took a chance to jab at MS. Don't take it too seriously. After all, he only wanted 1 cent for it.
The 'Net is a waste of time, and that's exactly what's right about it. - William Gibson
eBay has no obligation to list anything in particuar. It is in their best intrests to list most auctions without objection since the more that sells the more money they make, but there's no obligation. If eBay management decided that they wanted to ban selling of all religious items or something, they'd be well within their rights.
Now if I worked for eBay and was the guy with his finger on the button, so to speak, for canceling autions, I'd pull this. Why? Well simple cost-benefit analysis:
It's entirely possible, even likely, this guy is lying (I'm talking from their perspective, pre MS announcement) and thus we'll just get invloved with having to refund someone's money in the end. But let's assume he's telling the truth. In that case we would be on the hook for a ton of bad publicity since no doubt the press would eat up the story of eBay welling hacking instructions, and we might even be civily or criminaly liable for knowingly allowing this to go on. Now weigh that against the 2% or so we'd make from the final sale, maybe a few hundred at most if the auction gets bid way up. Not even a blid on our balance sheet. Thus, we cancel the auction.
eBay's a business, pure and simple. They'll let you sell whatever you want (for a cut) unless they feel what you are selling might cause them trouble. That's why they ban some entire classes of items, like firearms. It's not illegal to sell firearms on the Internet, and there are sites that do it. However it's trickey, since they have to be shipped to a licensed dealer and so on. It exposes you to a lot more liability, liability eBay doesn't want, so they just outright ban them.
Do you think that realistically, Microsoft could not release a patch for this in the 7 day timeframe of the original auction?
Are you kidding? Of course not. Excel is used by MILLIONS of people and the testing that needs to go into any kind of patch takes a weeee bit longer than 7 days.
In addition, we have no idea of the implementation details of the patch. Perhaps the offending code actually lives in a system library. This further adds to the time it takes to implement and test a patch.
This guy put the exploit on eBay for purely egotistical reasons... and perhaps some greed. It had nothing to due with holding Microsoft accountable, and even if it did it would be questionable at best.
On the other hand, if you know the code because theres a flaw in the system, it's reasonable to distribute that widely, so that it reaches all the customers involved - assuming that the company doesn't take reasonable steps itself. I know theres a common thought that you shouldn't take action into your own hands just because the company doesn't respond to your satisfaction, but on the other hand it's demonstrably true that many companies are much more interested in maintaining a pretense of security than real security, and they rarely have customers best interests at heart.
Except those issues are completely devoid of relevance. This isn't the Supreme Court deciding whether the auction should be legal because of "substantial noninfringing uses." This is solely an incident of a private entity deciding not to do business with another private entity. eBay is entitled to deny any listing for any reason it chooses, and the only measure of whether that decision was right or wrong is whether or not it protects eBay's interests. The only justification they need is that they didn't like the listing, and the only possible repercussions are the possible alienation of the massive vulnerability-purchasing demographic.
On the other hand, they could have let the listing stand and exposed themselves to possible private or public legal action, tarnished their public image, and further encouraged people to test the proverbial waters with equally or exceedingly unconventional listings.
But the good news, if you believe that eBay is eschewing a substantial opportunity, is that you have the chance to step in and serve the exploding market for software vulnerabilities by creating your own auction site. Maybe you'll get rich, or maybe you'll get sued so hard by Microsoft that you can't walk straight for weeks.. there's only one way to find out!
https://www.eff.org/https-everywhere