Slashdot Mirror
Microsoft's Security Disclosures Come Under Fire
Old Banana writes "Is Microsoft silently fixing security vulnerabilities and deliberately obfuscating details about patches in its monthly security bulletins? Matthew Murphy, a security researcher who has worked closely with the MSRC (Microsoft Security Response Center) in the past, is accusing the software maker of 'misleading' customers by not clearly spelling out exactly what is being patched in the MS06-015 bulletin released on April 11."
If you explain exactly what is being patched, then you give the hackers a pretty clear roadmap of what they need to do to exploit all of the unpatched systems, don't you? The sad truth is that most systems remain unpatched. Granted, Microsofts assumption that it's customers are idiots that couldn't handle the truth is annoying to those of us that do understand the problems, but in the majority of cases there assumption is pretty close to the truth - they are protecting the naive by not giving hints out to the malicious.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
As long as Microsoft are fixing them I'm not too bothered about this, but it would be nice to know what exactly they are fixing.
"Oh boy"
For Business users, they might actually want to know what might break if they do the update - especially since many cannot be "un-done".
This issue is a bit more complicated than you think.
I would speculate that more people download Windows updates then almost any other piece of software (mostly because they are unaware mostly because this feature comes standard and enabled in Win XP). So why would microsoft want to divulge the security holes it is patching so openly? If I was looking to break into someone elses system the first place I would go is to microsoft.com check to see what security holes it has just patched and then see if my neighboor has patched yet.
It would be way to easy for people to learn about the problems that microsoft has riddled the world with.
I think the real point of the article was a few paragraphs in when Murphy said that "You simply don't know what the patches are for. It's virtually impossible to make a determination about a deployment time frame if not deploying a patch has the potential to place you at an additional, unknown risk."
One of my favorite things about open-source systems like Redhat's RHN up2date is that you know exactly what a patch will effect and what code it will be changing. An update to the kernel, or to an individual program, will have a description of what it does, and in may cases a list of files that it will modify/replace.
I can see how microsoft could be more open about what specifically a patch does, but without making the patches open-sourced I don't see how they will ever be able to match Linux's level.
To me this looks like MS have patched the flaw they say they have, and maybe seen some other bugs that were in there whilst they were there.
This is not necessarily a good thing though, as vagueness in what a patch fix implies vagueness in testing that the patch works properly. Microsoft should post exactly what it fixes, so people know what they are putting on their system. For instance, what if the patch breaks third party software? As the third party won't know what was changed, they can't fix it.
If I'm getting the gist of the article correct, it sounds like this guy is just whining because he found a variation of a vulnerability that was being fixed and he didn't get his name posted in the headline as finding the main vulnerability.
So, really, this is just a single guy complaining because he feels like he should have been a headliner but MS felt he was just an extra.
This brings up the age old debate which I will not revive. However, my spin is that if you are patching a vulnerability you should disclose that. Otherwise the end user might not apply the patch. This very same situation happened with Cisco at Blackhat and ended up in the Courts and Cisco ended up with a public black-eye. Based upon the IT reaction to that I would venture the assumption that we want to know.
Quality Hosting e3 Servers
If you explain exactly what is being patched, then you give the hackers a pretty clear roadmap of what they need to do to exploit all of the unpatched systems, don't you?
You do that already by providing a patch. The bad guys will simply look at the differences of the binaries and find out what has been patched. So instead of helping the good guys, Microsoft gives an information advantage to the bad guys.
OS Reviews: Free and Open Source Software
New patch advisory: "This patch solves yet another attack vector that can be exploited by a malicious hacker. The fact is, this is like sticking your finger in a dike. Actually, it is more like sticking your finger in a non-existant dike against a tsunami. Tomorrow, five other security holes will be discovered. Odds are, this patch will introduce yet more attack vectors. You are screwed"
Microsoft: You may use the above for a small fee. TIA. HTH.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Aside from the terrible, terrible, sad analogy, do you enjoy Windows vulnerabilities as much as a cigarette after sex? Patching flaws without disclosure (as long as that is indeed what they are doing) is like taking a pill for a cold and having it cure your syphillis while it's at it.
An old-timer with old-timey ideas.
I would think that corporate "Software Assurance" customers who are paying for continual updates and support, and have to support MANY legacy applications that may be affected by such flaws or patches would be (and ARE) demanding such notifications. Joe Bob Home User does't really care, but Fortune 100 Fred in IT sure does, especially when his job (which is to keep the companies infrastructure up and running) is on the line.
Microsoft's just trying to save face, they could quite obviously still tell you that your applications and/or operating system had flaws that you needed to be aware of without going into specifics. Regardless of how much they want to disclose, one would imagine that they should have a legal responsibility to their customers to release any knowledge they have about a fault in their product that could compromise the security of their customers financial and private information, particularly in today's age of putting warnings out for every little possible fuck-up imaginable for other products (you know, like pepsi bottles that tell you to open with the cap pointing away from your face, etc...).
Ex nihilo nihil fit.
How to find out? MD5 sum your /windows folder including the sub-directories (don't forget the hidden ones) before the patch. MD5 Sum again after the patch and compare the results. bdiff the questionable file differences and dis-assemble. At least thats what I used to do as a prior legitimate Windows license(s) owner (but before being called a thief by Microsoft).
Like I said earlier today, you either own a Microsoft appliance or a personal computer, these days you can't have both. Switch to something else or stay with Windows.
Enjoy,
It's just the normal noises in here.
The bad guys don't need to spend time with compatibility or regression testing for their software.
They can download the patch the day it is released and have an exploit ready that same day. You'll still be meeting to discuss the test plan for your servers.
Attempting to hide information doesn't help anyone except the vendor and the bad guys.
At least if you have the information, you can determine your own level of exposure and decide what mitigating actions you want to take based upon your environment.
You tell people what you're doing to their systems.
It's that simple.
Security reasons, or no security reasons, you tell people. Anything else is misleading, which equates to lying.
They own the systems, not you, regardless of your fucking EULA.
Then if anybody doesn't care or doesn't want to know, it's on them.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Companies actually testing their software against the latest releases of Windows? thats definately a change from what I normally see; lazy software companies sitting around, rolling naked in money, then running an anti-Microsoft campaign when compatibility is broken with a bug fix. Rather than providing a fix to the end users, they run that campaign hoping that Microsoft will cave in and make some sort of elabortate work around.
I'll say it once, and say it again; it isn't Microsofts responsibility to provide backwards compatibility to people who would rather spend time whining about Microsoft than sifting through Microsofts knowledge base and product errata's and update their software to be compatible with the latest service pack/quickfix.
If you're a customer, a particularly large customer, and a software breaks when you update your Windows machine, your first port of call should be to the software vendors phone line and demand that they provide a patch; if they don't provide a patch, and you're a particular large customer, threaten to drop their product - send them a clear message, that you paid for a product, and you expect support, both telephone and prompt updates to address an compatibility issues that may arise when Windows is updated.
That's all well and good, right up until the point that the syphilis cure also causes a fatal allergic reaction in a small but significant percentage of the population.
Patches can break things. This is why disclosure of what it's touching is important, so you can properly test that everything it touched still works after the patch.
I'll say it once, and say it again; it isn't Microsofts responsibility to provide backwards compatibility to people
I'd disagree, partially, with this. Yes, it isn't Microsoft's responsibility to provide backwards compatibility to people who have used undocumented behaviour - but where they have changed the API so that it no longer operates as documented, then it is their responsibility.
What would Lemmy do?