Slashdot Mirror
Daily Exploit Releases Irk Both Vendors and Crooks
conJunk writes "Security Focus has an article about HD Moore's Exploit-Every-Day-in-July endeavor raising the hackles of both browser vendors and criminals. He started the project because he felt that vendors were not taking his analysis seriously enough, but he appears to be the only one enjoying it. 'Black Hats' are having their exploits exposed, and Microsoft (who bears responsibility for the majority of the browser holes) can't keep up with the pace he's setting." From the article: "The software giant indirectly criticized the release of vulnerabilities in a statement to SecurityFocus, underscoring the importance of getting customers updated before they are exposed to threats from malicious attackers. 'Microsoft continues to encourage responsible disclosure of vulnerabilities,' the software giant said in a statement sent to SecurityFocus. 'We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone's best interests.'"
For those of you who like to read articles starting with Page 1.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
A direct quote from the IE team over at Microsoft: "Don't tell anyone about all our holes! Then we won't have to fix them."
(end of post)
Yep. Too bad each and every one of these vulnerabilities has already long since been reported to Microsoft... which is hinted at by the correction at the bottom of the article:
Quoting the Microsoft "position" seems like a very odd choice for a story submission, without also giving the information that every one of these vulnerabilities has already been reported. Microsoft is simply sitting on their thumbs and not fixing them as usual; also as usual, they don't want the vulnerabilities published because this is made obvious.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Think about it; if a PC gets exposed to viruses or malware, the average Joe will either A: buy a new version of Nortan, or just not realise it untill the PC fails to boot in under 10 minutes at which point they just buy a new one, which means by default, another license for Winodws that isnt really needed, but Redmond gets the $$$ non-the-less...
"We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone's best interests."
From the looks of it, most if not all of those were reported months before they were published.
Give a vendor 90 days. If they fix it, never, ever release the details of how to exploit the vulnerability, as a reward and to help users who are slow to update. But if they willfully choose not to fix it, release the exploit to educate their userbase, and to help them to reevaluate their dangerous security policy.
I feel that there's not enough being done to curb gun violence here in Oakland Ca. So I'm going to shoot one person a day, every day, for the month of July. Any reports that I'm enjoying it are exaggerations.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Here's the link to the list of Moore's browser exploits, the ones that the article is talking about.
I made a PHP/MySQL library that prevents SQL injection & makes coding easier!
...you must be doing something right.
Best practices in my not-so-humble-opinion:
1) warn the vendor ASAP
2) warn the security community within a week, immediately if the vendor has no objections
3) as soon as there is an exploit that represents a real threat:
a) give all details to the security community
b) give a workaround, like "disable such and such service," to the general public.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
So, shedding light on these security problems "irks" some vendors. How about the sysadmins and users who are stuck wasting their time patching problems that should have been fixed months ago, or before release? What about people who have had data compromised or destroyed by exploits brought to the public eye in this report?
While I realize that many of these bugs are not critical security issues, my hat is off to Moore for having the rocks to continue his effort in the face of "irked" vendors and hax0rs. Producing better software is far more important.
Headline says: Daily Exploit Releases Irk Both Vendors and Crooks
Considering that Microsoft is the only Vendor complaining, and considering they've had months to fix all of these and didn't, the headline should be:
Daily Exploit Releases Irk Crooks
Viper is the preferred editor of the Emacs operating system.
in addition, it's making me have some slight apprehension regarding my plan to put a couple linux machines in the systems room at work. be a bit embarrassing if the new guy's machines got owned.
New Windows machines get owned too but I don't think that is exactly your concern. Any alternative has to be outrageosly superior to whatever established way of doing things is being replaced. The various ways that Windows machines can malfunction are common experiences to many and after long conditioning somewhat forgivable. Even though a Linux machine may be an outstanding way to replace a cranky Windows server, ANY malfunction is evidence "This Linux stuff sucks!" even though worse might be tolerated from the accustomed Windows solutions.
I've been the advocate for many such Linux deployments. Being the advocate, I make it my personal and professional business that the solutions I advance work. I've pulled a few overtimes here and there sorting issues out. It's what you have to do when it is YOUR big idea being tried out and that big idea bucks prejudices.
If you've been a long while from Linux, then you are correct to hang back. Find a little time to get to know your shit again so that if you ever DO propose a Linux trial that you can do the groundwork to really make it perform.
Microsoft 'should' also be keeping proper dialog with people that report these exploits, but that does not give one individual the 'button' to nuke MS when they don't jump on a fix as fast as the person wants, he is only screwing the consumers, not MS other than giving them bad press.
Huh? It sure does. He found the vulnerability, it's his to disclose. (Unless of course Congress has made that illegal this week...)
I think the software vendors are forgetting something: giving them an advance warning of the pending release of a vulnerability is a professional courtesy.
If they don't do anything, particularly if they don't ask politely that the release of the vulnerability be delayed, then they really have no business bitching when they see it over their coffee while reading the Wall Street Journal some morning.
I think reporting vulnerabilities to vendors is the right thing to do, but if the vendors piss all over people who are trying to do them a favor, then the hell with them. It's unfortunate that their customers end up getting hurt because of their lack of any sort of humility or willingness to communicate, but that's what you get when you do business with people like that.
If I was advising Microsoft, or any other large vendor -- or if I was a major customer of theirs, large enough that I could give input on their internal policy -- I'd tell them that every time a serious vulnerability was reported, they should assign an analyst to it personally; not only to verify the possible implications of the threat, but also to act as a one-to-one point of contact with the discoverer, to build a relationship with them and hopefully get them to agree to hold off on disclosure until the problem can be fixed. (I'd also expect them to throw wads of cash at anyone with a possible 0-day, and troll the black-hat IRC channels just like the mafia does, buying them up.)
It's ridiculous to expect people who are inherently doing the vendors and their customers a favor to simply sit on their hands when there's no active dialogue between them and the vendor on what progress is being made -- particularly when being the first to report a vulnerability can be a career-making move for some people.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."