Google Researcher Issues How-To On Attacking XP

theodp writes "A Google engineer Thursday published attack code that exploits a zero-day vulnerability in Windows XP, giving hackers a new way to hijack and infect systems with malware. But other security experts objected to the way the Google engineer disclosed the bug — just five days after it was reported to Microsoft — and said the move is more evidence of the ongoing, and increasingly public, war between the two giants."

Comments

I Don't Think Zero-Day Means What You Think

[eldavojohn]

exploits a zero-day vulnerability

Zero-Day would mean that Microsoft had zero days to fix it or no time at all to patch the system that had the security vulnerability between the time they release the software to the time the bug goes public. By that definition this would be best described as a "five day exploit" or more in fact if they knew about it before Ormandy's notice.

Re:I Don't Think Zero-Day Means What You Think

[Jurily]

Thank you so much. I'm sick and tired of every fucking bug labeled as "zero-day". Especially considering the fact that the bug itself may has been around for years.

Re:I Don't Think Zero-Day Means What You Think

[ircmaxell]

I've always understood (I know the "definition", but it seems like a lot of people use mine) a Zero-Day as an attack that requires no action by the victim. So a flaw in Apache that allowed a remote user to execute code with a malformed HTTP request would by very definition be a Zero-Day. I know that's not the "official" definition, but based on what a lot of people call a Zero-Day, it seems that I'm not the only one with that idea...

Re:I Don't Think Zero-Day Means What You Think

[Anonymous Coward]

Just because enough people say it, it becomes an unofficial definition. Like "hacker". These kind of definitions are not much use for actual analysis. They are for shit-spreading and sounding scary. You can either contribute to that or you can use something that is actually precise.

Re:I Don't Think Zero-Day Means What You Think

[Anonymous Coward]

we all know the bug have been around for years, a lot of people use it as their primary operating system

Re:I Don't Think Zero-Day Means What You Think

[richlv]

i'm sorry, but that's the first time when i hear such a definition, and i'm sorry again, but it's completely silly.
what's the "zero" in there, what's the "day" ?

two definitions that at least make sense -
* vendor had no time to patch it;
* there was no public information beforehand.

these are a bit similar, as you just redefine who had or had not information on the problem.

Re:I Don't Think Zero-Day Means What You Think

[Anonymous Coward]

Wrong. Zero-Day refers to the amount of time system administrators have had to patch their systems against the exploit. This will remain a Zero-Day exploit intil the day Microsoft releases a patch for it, after which aministrators can be expected to have secured their systems.

Re:I Don't Think Zero-Day Means What You Think

[SuperDre]

That's not true, only a few people use Linux or OS-X as their primary operating system...

Re:I Don't Think Zero-Day Means What You Think

[DrgnDancer]

Now see I always read "Zero Day" as being a vulnerability that either not found until it was exploited in the wild, or released before the vendor had a patch in place. In other words the vendor has "zero days" in which to patch the bug before it is or could potentially be exploited. Strictly speaking this bug would only qualified as "Zero Day" if the guy had released it publicly before or at the same time as he notified Microsoft; but an argument can be made that since there isn't yet a patch, and the vulnerability is in the wild, MS still has "zero days" to react. Regardless, much as I dislike Microsoft this was an asshole thing to do. He knows they release major patches on "Patch Tuesday", at least give them that long to fix it. As one analyst pointed out, he's hurting his company's customers nearly as much as he's hurting Microsoft.

Re:I Don't Think Zero-Day Means What You Think

[dieth]

Wrong again, Zero-day refers to the amount of time that the bug/vulnerability has been disclosed to the public, not patch. It is still possible to secure your system with just the knowledge of how the attack is reaching you.

Re:I Don't Think Zero-Day Means What You Think

[Anonymous Coward]

I've been in software security for almost 15 years and I've never heard your definition. FWIW, zero-day means that the vulnerability is being actively exploited in the wild on the day the developers/system owners become aware of it. People have now taken to using the term to mean the first day any vulnerability is released, but that is not how the term was originally used.

Re:I Don't Think Zero-Day Means What You Think

[Lord Ender]

That is incorrect. "Zero-day" means the patch has been out for zero days, as in the patch has not been released yet.

Re:I Don't Think Zero-Day Means What You Think

[alteran]

Dictionary.com defines zero-day as an unpatched bug. When I went to OneLook, half the sites that had definitions listed zero-day as unknown-to-provider bugs, half as unpatched.

Seems there's some ambiguity in the term.

Re:I Don't Think Zero-Day Means What You Think

[Anonymous Coward]

OP didn't mean the bug in MS's accounting sheet!

Re:I Don't Think Zero-Day Means What You Think

[Anonymous Coward]

Whoa, dude! Whut that guy said it jake! If alot of people say something to much times it's definition can change, making you'res a mute point.

Re:I Don't Think Zero-Day Means What You Think

[Anonymous Coward]

Zero-Day is an attack that is in use before anyone (the vendor, anti-virus companies etc) other than the attacker(s) know anything about it...

Re:I Don't Think Zero-Day Means What You Think

[Anonymous Coward]

I don't know of any idiots who think that is the definition. Guess all the idiots hang around together. And you use a computer, know about Apache, and a malformed HTTP request? Seriously, how do you not see a word that has the "Day" in it and not think it relates to something about time?

Re:I Don't Think Zero-Day Means What You Think

[BlackSnake112]

Zero-Day as an attack that requires no action by the victim.

Wouldn't that be more like a worm or virus?

Re:I Don't Think Zero-Day Means What You Think

[Labcoat Samurai]

I like how you can apply a joke to Windows and it's +5 Funny, but the same joke applied to Linux or OS-X is -1 Troll. I'm not making any particular value judgments about these respective operating systems. Just think it's funny.

Re:I Don't Think Zero-Day Means What You Think

[dave562]

Slashdot needs a "sticky" so that we don't have to rehash this symantic issue every time it comes up. Zero day doesn't mean what most people claim it means. Zero day was a warez term. Any use of the term to refer to anything other than a pirated software release is a bastardization of the term.

"Root is a state of mind. Zero day is a state of freshness."

Re:I Don't Think Zero-Day Means What You Think

[WrongSizeGlass]

The MS joke is "funny" because it's true. Just ask Homer Simpson. The Linux/OS X joke was lame because it's not true, not funny and just plain flaming lame.

Re:I Don't Think Zero-Day Means What You Think

[Anonymous Coward]

Your comment assumes that Windows is roughly comparable to Linux and OS X.

Linux is not an operating system. Linux-based operating systems do not monopolize the desktop OS market. Sales of Linux do not fund the development of restrictive, ill-conceived technologies, DRM, software patents and other outdated "intellectual property" policies.

OS X couldn't be farther from Windows technologically. The market share and corporate culture of Apple and Microsoft are worlds apart. Consider the effect that both companies have had, and continue to have, on computing and the world at large.

Re:I Don't Think Zero-Day Means What You Think

[Dashiva Dan]

Zero-Day in the way it was used is referring to an exploitable bug in software that is unknown to others. If a hacker discovers a flaw that is unknown, they have found a zero-day. They can then write an exploit for it and use that exploit, or they can simply note it. Hackers mayl trade or sell zero-days (well, the knowledge of them, the flaw obviously exists regardless of their knowledge of it, but it is their knowledge of it that makes it a zero-day) If someone else discovers it, say a security consultant, etc, and alerts the software developer, it is no longer a zero-day.

The use of the term in the article was to illustrate that it was an hitherto unknown flaw, which means that no patch is available for it, which means that it can be used, and there is nothing to stop it.

Most other flaws are known, patches exist (even if not everyone has patched with them) and as such are a lot less valuable to the malicious of the hacker community. It is reasonable to call this a zero-day flaw as his provided patch does not work, and hackers are aware of the exploit. However, as the developer also is aware of it, it won't be valuable for long.

Re:I Don't Think Zero-Day Means What You Think

[Anonymous Coward]

http://seclists.org/fulldisclosure/2010/Jun/243

Tavis indicated he suspects that the 'black hats' already know about
this particular exploit (IOW he thinks it is a '0-day' exploit already
loose in the wild).

Re:I Don't Think Zero-Day Means What You Think

[Labcoat Samurai]

Well, I counter that it's funny because it's cleverly framed, and the other joke is unfunny more because it's lame and introduces nothing new, but that extra bit that motivates a moderator to mod it troll rather than, say, redundant, is what I think is interesting.

Something doesn't have to be untrue to be a troll, and something that is untrue is not necessarily a troll. People here just like their linux and you better not talk smack about it :)

Re:I Don't Think Zero-Day Means What You Think

[CAIMLAS]

Eh, since I first heard the term back in the mid-90s, I'm pretty sure it's always been used in the "providers/security experts/etc. have not acknowledged and/or been made aware of the vulnerability". This would include everything from zero-day exploits in use in small numbers to something like this.

Re:I Don't Think Zero-Day Means What You Think

[gphilip]

Slashdot needs a "sticky" so that we don't have to rehash this symantic issue every time it comes up. Zero day doesn't mean what most people claim it means.

"symantic" doesn't mean what you think it means.

Re:I Don't Think Zero-Day Means What You Think

[hairyfeet]

Uhhhh dude? Your definition sounds more like a drive by or a worm than a zero day. The way I've always understood it a zero day is an attack that has completely blindsided the vendor, so he hasn't had time to prepare.

Considering an OS the size of XP I'd say only giving a business week to find a fix before throwing it into the wild would constitute a zero day, because there was no way in hell the vendor could provide a fix in that little amount of time. It is also VERY irresponsible, and I'd hope those here at /. would condemn their actions just as if they had done the same on Linux or OSX. There is simply no excuse for not giving the standard 90 day response before dropping this into the wild. They have put hundreds of millions of machines at risk, and for what? Just to be an asshole.

Re:I Don't Think Zero-Day Means What You Think

[dave562]

Oh it means what I think it means, even if I can't spell it correctly. ;) Semantic is the word I was looking for.

Re:I Don't Think Zero-Day Means What You Think

[geekoid]

Zero Day means they had no for knowledge of the bug before an exploit was found in the wild.

If you think about it, that's the only sensible definition.

This would be a 5 day exploit.
\

Re:I Don't Think Zero-Day Means What You Think

[geekoid]

It's the time from when the vendor found out about the vulnerability until the day the first exploit of the vulnerability was found in the wild.

The only people that need to be involved is the manufacture of the software and the creator of the exploit. The general public doesn't enter into it.

Re:I Don't Think Zero-Day Means What You Think

[SuperDre]

Hmmm.. your whole comment is nothing but your own opinion, especially your remark about 'ill-conceived technologies..... etc..' makes you nothing more than a stupid linuxfanboy.. HA don't make me laugh about the culture of Apple, Steve Jobs is nothing but a good salesperson and he makes you believe everything even if they sell crap and 'stolen' ideas (even more as microsoft).. Apple is even much more restrictive about their stuff as Microsoft is, but it seems a lot of apple fanboys can see further as the Steve's brown little star...

Re:I Don't Think Zero-Day Means What You Think

[drkim]

People here just like their linux and you better not talk smack about it

...or they will both kick your ass!

War

[Thanshin]

The classic "selling cheap weapons to the neighbouring country".

You can use it too. Instead of smearing your competitor for a raise, give his secrets to one of his subordinates.

Negative.

[Anonymous Coward]

He waited five days without even receiving a response from MS. I'd have done the same thing he did.

Re:Negative.

[Anonymous Coward]

Citation needed, I read the article and couldn't find that.

Re:Negative.

[armanox]

"Ormandy admitted that he reported the vulnerability to Microsoft only five days ago -- on Saturday, June 5 -- but said he decided to go public because of its severity, and because he believed Microsoft would have otherwise dismissed his analysis."

Re:Negative.

[SanityInAnarchy]

Microsoft was informed about this vulnerability on 5-Jun-2010, and they confirmed receipt of my report on the same day.

So they did respond. They just didn't fix it in five days:

Those of you with large support contracts are encouraged to tell your support representatives that you would like to see Microsoft invest in developing processes for faster responses to external security reports.

That's what he was complaining about, and I think it's a legitimate complaint.

Re:Negative.

[AHuxley]

"Ormandy admitted that he reported the vulnerability to Microsoft only five days ago -- on Saturday, June 5" in
http://www.computerworld.com/s/article/9177948/Google_researcher_gives_Microsoft_5_days_to_fix_XP_zero_day_bug

Re:Negative.

[skgrey]

Confirming receipt of the report sounds like "yes, we got your email of the report". I believe what we are looking for is if Microsoft provided any information (timeframe, severity, anything), so the point is still open. The fact that this article and every article I've read on it has not said anything about Microsoft giving some info is smoking-gunnish that it didn't happen. Still, until there's a credible source the question is still out there.

Re:Negative.

[Anpheus]

I submitted a security issue in how one of their management products generates a private key for signing internally distributed programs and other things. I gave them all the details, it took a while, but they patched it and included the fix in the release of the 2010 System Center Essentials (a mishmash of their pricier more specific products).

Full disclosure is of course, the only way to go when you don't get a response. If they don't treat security as a serious matter, then don't waste your breath. But complicated bugs can be difficult to fix, and fixing those bugs requires not insignificant regression testing.

Re:Negative.

[lseltzer]

Not true, he says in his advisory that Microsoft acknowledged receipt the same day.

They didn't do their own advisory within 5 days (actually 4 1/2), which is perhaps what made him think it was the right thing to go public. Ormandy himself has begun to realize that he handled it badly.

Bear in mind that he reported it the Saturday before an especially heavy Patch Tuesday. It's reasonable to presume that people at the MSRC were busy.

And if anyone thinks Google is involved they're obviously wrong. I'm sure the security people at Microsoft know that Ormandy thought he was acting in a private capacity. This was a poor decision on his part, and he can't do this sort of thing privately without it impacting on his employer. I'm sure they were pissed at him.

Re:Negative.

[dave562]

Those of you with large support contracts are encouraged to tell your support representatives that you would like to see Microsoft invest in developing processes for faster responses to external security reports.

That's what he was complaining about, and I think it's a legitimate complaint.

He did get a response. He didn't get a resolution (in the time frame he wanted one in).

Lets put a not so hypothetical situation out there to consider. You're working your ass off getting a project out the door, coding your little heart out (in this case, Microsoft was in the final hours of their "patch Tuesday" process). A vendor of yours comes to you on Friday night with a NEW problem that they think is a big deal. You acknowledge their complaint, file it away and go back to working on what you were working on. Two business days later, you learn that your vendor took out ads in every major publication and website touting what an idiot you are for not "responding" to him, even though you did.

The person who released the vulnerability needs to grow up. Just because he might be a competent security researcher doesn't seem to translate to him being able to act like an adult, and to treat others with respect. Don't even bother to say, "Well Microsoft doesn't treat other with respect." because as any second grader knows, two wrongs don't make a right (but three lefts do). What adult expects another grown adult (or group of adults) to drop everything they're working on to respond to what one person believes to be a huge problem? If everyone dropped everything every time something "important" popped up, nothing would ever get done.

The fact that the guy works at Google shows that he comes from a different head space. Google lives in perpetual beta and their apps are often times "temporarily unavailable". We've all seen what happens when Microsoft release a bad patch. Tens if not hundreds of millions of people are running Windows XP. The last "bad patch" Microsoft pushed out BSOD'd a bunch of compromised computers. The patch worked fine on clean computers, but Microsoft still caught a flak for that one, as if they should be required to test their patches against every known malware out there.

Why is the guy even messing with XP anymore anyway? That is two generations ago. Why didn't he hit Windows 7 if he wants to make the point that Microsoft is insecure and slow to respond to critical issues? It could be completely possible that the bug he found in XP doesn't even exist in Windows 7 (but I wouldn't hold my breath on that one). Maybe Microsoft researchers should focus on breaking Android 1.5 so that they can generate a bunch of bad PR for Google and point out how inept they are when it comes to developing mobile phones?

Re:Negative.

[Anonymous Coward]

Cry me a fucking river. You really think that MS only has one fucking developer? Really if the biggest software developer the world has ever seen cant quickly and methodically squash every bug that rolls though there doors is doing it wrong. If Microsoft was a country it would have the 38th highest GDP in the world. How many more resources do you need to fucking do your job?!

Re:Negative.

[dave562]

What exactly is their job that needs to be done in your perspective, Mr. has to post AC because he can't even stand by his own rant and own up to it? The way I see it, their job is to improve their software and provide their customers with the functionality that the customers need to run their businesses with. Last I checked, XP is dead. It is still out there in production and is still getting patched, but there isn't any new development happening.

Put the shoe on the other foot. If someone went to Google and said, "I found this vulnerability in Android 1.5, fix it." Do you think Google is going to put much effort into it? They'd probably just point out the fact that 1.5 is obsolete and recommend an upgrade to 1.6 or 2.1. Maybe someone can cry about flaw in Chrome 3.0 and we'll see how much weight Google puts on fix that.

Heaven forbid Microsoft takes more than 48 hours to patch an obsolete OS that most competent IT administrators are in the process of phasing out.

Even if you put the fact the XP is on the way out aside, how long do you think it takes a huge organization like Microsoft to regression test a patch? How many different departments need to sign off on something before it gets pushed out the door? I'm not saying that being big gives a company a pass for being inefficient, but be realistic. If they screw up a patch there are millions of people that can be impacted by it. It's not like Google where they enjoy the good will of the IT community and can just hang up a, "We're working on it, bare with us for a few moments" sign.

For an example read this article written by someone who is almost completely happy with Google apps.

http://www.forbes.com/2010/01/25/microsoft-email-spreadsheets-technology-business-intelligence-google.html

Re:Negative.

[B4D BE4T]

Let's try another hypothetical...

You're working your ass off getting a project out the door, that new oil well needs to be drilled ASAP. A vendor of yours comes to you on Friday night with a NEW problem that they think is a big deal; apparently one of the wells that you drilled in the past has broken and is spewing thousands of gallons of oil into the ocean every day. You acknowledge their complaint, file it away and go back to working on what you were working on. Two business days later, you learn that your vendor took out ads in every major publication and website touting what an idiot you are for not "responding" to him, even though you did.

Now, before you say that's comparing apples to oranges, give it some thought. Is this hypothetical really so different from Microsoft's handling of vulnerability reports? Both problems require a prompt response because they could cost people/businesses a lot of money if the problem leads to a loss of data/resources. Both problems exist as a result of companies cutting corners. Both companies responded slowly because a prompt response would hurt their bottom line (short-term anyway).

What Microsoft should do with this and all other vulnerability reports is allocate as many resources as necessary to, at the very least, find a way for people to shore-up/disable the affected services, systems, etc. then promptly notify the world of both the problem and a temporary solution even if that temporary solution is just to turn the entire system off.

What Microsoft should not do is keep the information from the public until they release a patch. Just because one guy filed a bug report, it does not mean he is the only guy who is aware of the bug. There could be someone else who not only knows about the bug, but has already written and begun using an exploit for it.

Re:Negative.

[B4D BE4T]

The GP has a good point, albeit poorly stated. Microsoft has the resources to fix these problems quickly, they simply choose not to because fixing their past mistakes would take time away from producing their next cash cow. No, they don't need to fully patch the problem immediately. But they do need to pass the information about the vulnerability along to anyone that may be using a system that is affected by it. And if they care about their customers at all, Microsoft should also provide a method to temporarily prevent an attacker from using that vulnerability against them.

Re:Negative.

[dave87656]

The person who released the vulnerability needs to grow up. Just because he might be a competent security researcher doesn't seem to translate to him being able to act like an adult, and to treat others with respect.

I think he did the responsible thing. People need to know that their OS is insecure. MS has never taken security seriously, or perhaps, better put, they've put their priorities on other things: backward compatibility (especially for drivers) market dominance and making sure competitors products don't run well (eg. "Dos isn't done until Lotus won't run").

Re:Negative.

[mhelander]

"There could be someone else who not only knows about the bug, but has already written and begun using an exploit for it."

Could be that someone else knew. Now for certain millions do.

Do no evil

[Addict-09]

Google, like Apple, is no longer any better/different than the companies they claim to be better than (from an ethical stand point).

Re:Do no evil

[1s44c]

Google, like Apple, is no longer any better/different than the companies they claim to be better than (from an ethical stand point).

That depends on how you look at it. It's not like this is the one and only zero day bug that has ever been found in a Microsoft product. Perhaps a bit of public embarrassment from a competitor will prompt Microsoft to do a few more checks on their code.

In the big scheme windows holes are so common that unless goggle is releasing 20 a day with quick and easy tools to help people use them this makes no difference at all.

Re:Do no evil

[Midnight's Shadow]

Google, like Apple, is no longer any better/different than the companies they claim to be better than (from an ethical stand point).

I don't know about that. MS could have really used this to their advantage - 'We praise Google in finding and releasing this exploit of our windows XP OS. This is just another example of why everyone should transition to Windows 7. Insert fancy marketing for windows 7'

I'd also argue that anyone still using windows really should upgrade to a more modern OS and Google was just trying to put XP out of its misery. Sometimes you have to do harm to not do evil, like cutting off a leg to save a life.

Re:Do no evil

[iserlohn]

What?? Given Microsoft's history of fixing their bugs, I would of released it as a 0-day instead of a 5-day! Google's just doing everybody a favor. Looks at all the other companies that are afraid of angering MS. Don't forget that Google's recent security breach is directly because of MS products.

Re:Do no evil

[commodore64_love]

Whatever it takes to damage Microsoft is okay with me. I've hated this company since the 80s - not because I randomly like to hate inanimate objects, but because Microsoft's products were 5-10 years behind what other companies like Apple, Atari, and Commodore were doing. MS == crap for a long long time.

And because Microsoft would do anything short of murder to "win" in the marketplace, such as stealing trade secrets, locking-out competitors products, or suing smaller companies in court until they went bankrupt (i.e. MS was patent trolling). It's about time MS received a dose of its own medicine.

Re:Do no evil

[Anonymous Coward]

Google, like Apple, is no longer any better/different than the companies they claim to be better than (from an ethical stand point).

Yeah yeah. Apart from the the guy not actually doing this as a Google employee;

"Finally, a reminder that this documents contains my own opinions, I do not speak for or represent anyone but myself."

And the fact that Google, Apple and everyone else have got a long way to go before they approach the utter moral bankruptcy required for the likes of the Halloween documents, the derailment of OLPC, the ODF/OOXML fiasco and so on.

Re:Do no evil

[Anonymous Coward]

It's not a zero day bug. RTFS!

Re:Do no evil

[decipher_saint]

If some guy at Google can figure it out, some guy not at Google can figure it out.

All he did was point a finger at the breach in the fort.

Re:Do no evil

[gad_zuki!]

>Whatever it takes to damage Microsoft is okay with me.

This doesnt punish MS, it punishes end users and admins. Sadly, this fact doesnt matter to those who are just full of MS hate.

Re:Do no evil

[bsDaemon]

In fact, they're much worse 'cause they don't even pay dividends. They just suck up ticker space.

Re:Do no evil

[imakemusic]

True, the hole shouldn't have been there but there is a difference between shout "Hey! Everybody! You can break into the fort here, the wall's broken!" and quietly saying the fort owner "your wall is broken, people could get in through there".

Holy crap, did I just side with Microsoft? I feel dirty.

Re:Do no evil

[mcgrew]

I don't expect any corporation to have morals, but I don't like Microsoft because I don't like its software. Well, Excel is ok, but that's only because all the other spreadsheets suck even worse.

What really bugs me about Microsoft is you can't hardly buy a non-Apple computer without getting Windows. How hard would it be for them to give me a choice of OSes? Probably pretty hard; MS has most likely made deals with the hardware manufacturers preventing it. THAT'S the immoral business practice that I hate, because it affects me directly.

Re:Do no evil

[casings]

If you didn't realize that windows was an insecure product, you get what you deserve.

The end users and admins punish themselves.

Re:Do no evil

[yossarianuk]

I completely agree, it took the world about 1/2 a decade to catch up after the Amiga died.

Getting my first (very expensive ) Windows PC was the most depressing day of my life.

Now that most technology companies are working on Linux products I sense the computing dark age is coming to an end.

Its not just google, Dell seems to have woken up from the Matrix... (we just need all the rest of them to stop being farmed)
Dell: "Ubuntu is safer than Microsoft® Windows®"

Re:Do no evil

[Anonymous Coward]

>Whatever it takes to damage Microsoft is okay with me.

This doesnt punish MS, it punishes end users and admins. Sadly, this fact doesnt matter to those who are just full of MS hate.

I was able to install the hotfix so I was definitely helped and my system is now safer.

Furthermore, in what way do you think would it improve my system's security to now uninstall this hotfix and let Microsoft sit on the issue, possibly for months?

I think you have it all backwards.

Re:Do no evil

[master_p]

It only punishes end users and admins in the short term. When these people are fed up with Microsoft, they will turn elsewhere, and then Microsoft will be hurt.

Re:Do no evil

[krou]

And why, exactly, is Google at fault here? The actual post on Full Disclosure states the following at the bottom:"Finally, a reminder that this documents contains my own opinions, I do not speak for or represent anyone but myself." He makes no mention of working for Google, posting this with Google's sanction, nor does he even post it from a Google email address.

The fact is, a guy who posted this vulnerability in a private capacity, and he just happens to work at Google. Just because he works at Google, somehow this means another stage in the "war" between Google and Microsoft? Nonsense. Sounds like journalists are trying to make a scandal out of nothing.

Re:Do no evil

[LordLimecat]

Im not going to bother defending google here; Id much rather you flesh out your argument. What is Google doing wrong, how does it benefit them, and how would you have handled it? Point number 2 especially I would be interested in-- If google had wanted to mess with MS, why not release it as 0-day, and not report the thing at all?

I mean, its really popular to just throw flames at whatever company is in the articles posted here, but I think people should at LEAST be required to spell out what theyre saying rather than throwing vague potshots like "theyre no longer any better/different than [others]" without really defining their justification or meaning.

Re:Do no evil

[Anonymous Coward]

It's because of INSECURED MS products. Remember, us smart ones have secured our machines, and I know for a fact that my secured system hasn't received any malware, etc. So, if they had a system that wasn't fully patched up and secured, that's their fault more than MS'. Besides, who knows - someone could have gotten in via the Adobe exploits - they never did say exactly what they found - they only blamed MS.

Their whole shenanigans on announcing they wouldn't allow Windows' use anymore is nothing but FUD - I'm surprised that you guys didn't see it as such. It's not like Google not using Windows on any systems anymore make a difference.

Re:Do no evil

[riegel]

No, it punishes Microsoft. Hopefully it will help to wisen up users and admins that use Microsoft.

Re:Do no evil

[LordLimecat]

Yes, leaving the bug unreported-- possibly until support for XP ends-- would have really done end-users a favor.

Re:Do no evil

[Anonymous Coward]

*** And because Microsoft would do anything short of murder to "win" in the marketplace, such as stealing trade secrets, locking-out competitors products, or suing smaller companies in court until they went bankrupt (i.e. MS was patent trolling). It's about time MS received a dose of its own medicine. ***

Oh, you mean the same things Apple and Google do now?

Though I do lament that back in the day the Amiga was awesome.

And I wish IBM hadn't dropped OS/2 - it was great!

Ah well.

Re:Do no evil

[Cheburator-2]

I don't think his managers approved his conduct. He doesn't believe in responsible disclosure, but it seems like Google as a company do. So I wouldn't be surprised if apology or termination would follow soon.

Re:Do no evil

[Anonymous Coward]

You Sir are an idiot. Security by obscurity is a broken model, I thought everybody already knew... And the sooner people start to notice the wonderful quality of M$ products, the sooner they will start looking for alternatives.

This man did everybody besides M$ a favor, you M$lover. Buzz off slashdot.

Re:Do no evil

[Anonymous Coward]

Public acknowledgement forces action.

Re:Do no evil

[Anonymous Coward]

Apple and Google try to compete.

Microsoft has always tried to stifle any and all competition.

Re:Do no evil

[McDozer]

Oh yeah because admins have a choice in what they are administrating...I'm not sure what world all you guys work in but the one I'm in some fat cat desk jocky that doesn't work or possibly never worked an admin position makes the decisions on what software we use and doesn't care what you want to run. You admin what your told not what you want to.

Re:Do no evil

[Anonymous Coward]

You have NOT secured your system. You simply THINK that you have, just because you have applied a few patches, and shut down a large of MS's services. The facts are, that NO operating system can EVER be secured. That includes Linux, OSX, Trusted Unix, Vax, and even MVS.

To have claimed that you have secured it shows a total lack of understanding of the situation. In addition, it ignores the fact that Windows IS the most cracked OS on the planet. They are the largest in shear number due to desktop. The problem is when you compare them on the servers where they occupy a smaller size, and yet, the account for over 90% of the cracked systems. It is far safer to drive a pinto, or a dodge neon then to trust a windows server.

Re:Do no evil

[bmajik]

Hey! I recognize you!

Remember when we were watching the news together? There was the story about that lady that went to the bar by herself, and turns out, she got raped later that evening.

Remember what you said after seeing the story?

I do. It was "stupid bitch was asking for it"

Re:Do no evil

[Anonymous Coward]

Except, what you have here is a used fort dealer selling broken walls to everyone. There's a difference between shouting "Hey! Everybody! That guy's wall is broken!" and shouting "Hey! Everybody! That bastard sold us all walls with a hole in it! Here's a car that can plug the hole."

(Damn! Can you believe I got a car analogy out of that one?)

Re:Do no evil

[Yvanhoe]

Google tries to bring back a sane practice (public disclosure) as an industry practice. This is GOOD(tm). On this precise example, it can lead to problems for many people, but one can expect that on the long term it will lead to quicker reaction from Microsoft's security team.

Re:Do no evil

[BlackSnake112]

If you read the article you would know that using a different web browser or email client makes no difference. The exploit uses XP's help system. The one that allows remote assistance.

Speaking for myself only, I have turned that off on every machine I have owned or used (work). This exploit will not effect me or machines that I run.

Re:Do no evil

[Rockoon]

I suppose that any time I hit a client in the face with company equipment, I can just say "my employer isnt responsible" while doing it, and poof, my employer doesnt have any responsibility?

Re:Do no evil

[perryizgr8]

yeah, apple competes with google by banning their software. thats some healthy competition right there!

Re:Do no evil

[Anonymous Coward]

It was directly because they decided it would be a good idea to not apply a single patch since SP2. Pretty tough to blame microsoft for that one.

Re:Do no evil

[ClosedSource]

"Whatever it takes to damage Microsoft is okay with me."

Perhaps you should apply to Google. Apparently they've been hiring guys like you.

Re:Do no evil

[ClosedSource]

Believe it or not hurting MS isn't a long term benefit for end users and admins.

Re:Do no evil

[Anonymous Coward]

Good, that way when the company gets burned because of a security exploit, it's the fat cat desk jockey who can explain what happen'.

Re:Do no evil

[Anonymous Coward]

This is just an employee, not Google-the-whole-company.

Re:Do no evil

[delinear]

There's a difference between shouting "Hey! Everybody! That guy's wall is broken!" and shouting "Hey! Everybody! That bastard sold us all walls with a hole in it! "

Those aren't holes in the walls, they're Windows. Okay, shoot me now :)

Re:Do no evil

[delinear]

Erm... since when does you flipping out at work and using work equipment to beat a client make your employer responsible anyway? Maybe if your employer had driven you to it in some way, too much pressure or putting you in situations you can't handle, they might, might have some responsibility under negligence if they should have realised the consequences, but I can't imagine that's the standard response.

Re:Do no evil

[Actually, I do RTFA]

It only punishes end users and admins in the short term. When these people are fed up with Microsoft, they will turn elsewhere, and then Microsoft will be hurt.

And that will hurt me as an end user. I like Windows more than OSX (to be phased out for iOS5?) and Linux. That's why I use it.

And it will hurt end users of Linux too. If Linux was 99% of the market, there would be quite a few successful cracks against it.

Re:Do no evil

[Anonymous Coward]

Sounds like you are presenting a challenge. Well, alright! You do realize there are far more bugs in your open-sourced Linux than Windows? It's just the fact no one wastes their time finding them because the market share is so low. However, you want to see zero-day exploits for linux just the same? No problem! Let the good times roll, and I'll see you on the other side, but only if you aren't using Linux will you make it through this one.

Re:Do no evil

[geekoid]

Google is behaving very ethically in this case. I don't see whats ethical about hiding a known exploit fro the millions of peoples who system is at risk. Especially after reporting numerous other exploits to MS that the took years to fix.

If he found out about a software bug that put certain car owners at risk would you want him to tell you, or let the auto manufacture just bury it?

And before someone short sighted responds with 'you could die in a car crash' I hope they think about the millions of systems running XP, and the millions of system running where peoples lives depend on the software.
Exploited software could kill hundreds and harm millions.

Re:Do no evil

[geekoid]

I would argue sitting no a know exploit for years does far more harm to users and admins.

Perhaps they should also complain to MS about there stupidly slow fix pipeline?

Re:Do no evil

[hairyfeet]

I'm sorry, but are you high? what is it with militant FLOSSies and fairy tale delusions? Yeah, because everyone is gonna throw away BILLIONS of dollars in proprietary software, many if not most of which like QuickBooks and Photoshop have NO real equivalent on Linux, get rid of years of experience for millions of dollars in retraining for an OS that won't do 1/20 of what they need it to do, just so they can kick MSFT in the nuts and go dancing through the flowers with RMS wearing togas. Get real!

For all those "Yay MSFT got pwned!" militants? Got news pal, this is YOUR ass as well! Don't care if you are running BSD, Linux, OSX, this is still YOUR ASS as well! Why? Because guess what Internet all those pwned machines is gonna be slowing down? Guess whose inboxes are gonna be getting a shitload more spam? Ooops, didn't think of that, did you?

So can we PLEASE quit the immature bullshit and the "They'll all switch to Linux!" fantasies and focus on the big picture? This asshole at Google, who BTW is a douchebag for releasing less than 5 days after telling them on patch Tuesday weekend, probably the worst weekend he could possibly pick, has just made ALL the Internet worse for ALL of us. Remember folks, zero days, no matter which OS, is bad for all of us, because we all use the Internet. The more zombies, the more botnets, the slower it becomes for us all.

So if you want to hate MSFT? Fine and dandy, I still think Bill Gates owes me an apology and a copy of Win2K Pro for WIndows ME, along with Ballmer owing me a heartfelt "I'm sorry" for Windows Vista (which I'll forgive because folks trying to get away from Vista boosted my profits by 30%!) but encouraging douchebaggery like this by going "Good for him!" is exactly the WRONG thing to do. The entire community needs to be saying loud and clear that the standard 90 day response should be stuck to, and anything less is irresponsible asshattery. Because this hurts us all folks, be you on Linux, BSD, OSX, or Windows.

Re:Do no evil

[SgtChaireBourne]

No, but killing it off completely would help admins and end-users. Some admins do bear some of the responsibility so some of the hurt does have to land on them. Microsoft is not some vague poltergeist, it is a group of individual people with names, faces and addresses. Shut them down and you shut Microsoft down. Probably some jobs could be found for them. Like with keeping embezzlers away from accounting, and junkies away from prescription drugs, you will need to find a place for them well away from ICT.

Re:Do no evil

[ClosedSource]

"No, but killing it off completely would help admins and end-users."

Perhaps you don't understand what the world "help" means.

Re:Do no evil

[ClosedSource]

Or perhaps I can't spell "word".

Re:Do no evil

[riegel]

Yep, your right, and when it all blows up the guy who made those decisions WILL wisen up.

Re:Do no evil

[Anonymous Coward]

End users have nowhere to turn to, so it doesn't matter.

Re:Do no evil

[commodore64_love]

>>>>>>Whatever it takes to damage Microsoft is okay with me.
>>
>>This doesnt punish MS, it punishes end users and admins

Until the users wise-up and jump to MacOS, AmigaOS, or LinuxOS. THEN that's when it punishes Microsoft. It's the Toyota affect - bad news scares away customers.

Re:Do no evil

[Anonymous Coward]

Unless you live in a guarded fortress, your home is insecure. Should I only laugh contemptuously if you get robbed? Or, unless you train every single day, and wear full body armor your body itself is weak and insecure. I'm also allowed to laugh if you get beaten up or shot?

Re:Do no evil

[Nyder]

>Whatever it takes to damage Microsoft is okay with me.

This doesnt punish MS, it punishes end users and admins. Sadly, this fact doesnt matter to those who are just full of MS hate.

How does it punish them? Lets them know about an exploit before MS would of let them known, or patched it?

Just because this guy released this doesn't mean he's the only one who knows about it. Sure, other peeps know about it now, but then so do the admins. They know what to fix & watch for now, they wouldn't of before.

Maybe you want to believe MS can do no evil, but they have a history of being pricks. They only care about making money, ever. Well that and being the top dog on everything, no matter how they get to that position.

You realize this is about free speech?

MS would rather people didn't have free speech and aren't able to say anything about it's bugs.
But since we have free speech, they try to make it seem bad if you share knowledge about bugs in their products.
This guy, being tired of how MS stomps on this free speech, and how they take their time to share this knowledge from others, decided to not only tell MS, but 5 days later tell the world. Excersing his rights of free speech.

His doing this, now lets everyone being equally informed, instead of just a few people and MS.

sorry, I rarely do car analogies because, well, i've never owned a car. don't drive, don't want to. But i'm usually great with computer analogies, 'cept they are almost never needed here on slashdot...

Re:Do no evil

[Nyder]

It only punishes end users and admins in the short term. When these people are fed up with Microsoft, they will turn elsewhere, and then Microsoft will be hurt.

It doesn't punish them at all.

not sure how sharing info with everyone, instead of just MS can hurt admins. Now the admins have the knowledge they need to prevent the bug from being exploited.

If dude didn't say anything, who knows how many other people, criminals, could of found the exploit and used it to gain access to people computers?

And yes, I understand that by the exploit being released to the public, now criminals have access to it. yes, that is true, 'cept now the public has access to the same info and can be forewarned, which they wouldn't of had otherwise.

Re:Do no evil

[John Hasler]

> ...difference between shout "Hey! Everybody! You can break into the fort
> here, the wall's broken!" and quietly saying the fort owner "your wall is
> broken, people could get in through there".

Microsoft is not the fort owner. The fort owners are the computer owners.

A better analogy would be telling the contractor who built the fort about the hole while keeping it secret from the owner even though you have reason to believe that the bandits may already know about it.

If you know of a way in which someone's computer might be broken into there is nothing wrong with telling them about it.

Re:Do no evil

[Unequivocal]

Hear hear! Well said amigo. Someone mod P up please.

Re:Do no evil

[imakemusic]

I guess it's kind of like a pizza place that makes pizzas that taste really good but the buildings got rats and the meat is...questionable. You could tell the management but they don't want to pay money for rat poison and they can make more money by using the cheap meat. So you're better off warning people not to eat those pizzas.

Re:Do no evil

[Johnno74]

Don't forget that Google's recent security breach is directly because of MS products.

Actually, wasn't google's breach caused by a flash or acrobat vulnerability?

Re:Do no evil

[nanoflower]

I understand what you are saying but this person has submitted many security issues to Microsoft in the past. Have they all been (or even most) been done as a Google employee? If so then it's no surprise that people would see this as a Google vs. Microsoft issue. (I don't know what the truth is here as I've never heard of the guy. Though I can say that the guy is going to get some grief from Google because of this issue. Regardless of his intention releasing this to the public after just five days was a bad idea and it will reflect badly on Google.)

Re:Do no evil

[mhelander]

You do have a point, but to complete the analogy wouldn't it be more like either your first option ("telling the contractor who built the fort about the hole while keeping it secret from the owner even though you have reason to believe that the bandits may already know about it") versus the option "telling the fort owners by means of telling the whole world, including every two-bit bandit in existence"?

At that point I'm not so sure the second option (the one actually taken in this case) seems the more attractive one, even though you are right that the first option is not completely rosy and better described the way you did.

Re:Do no evil

[hairyfeet]

Nope, I got labeled a troll for daring to speak the truth, like multibillion dollar corporations are gonna toss all those apps and spend millions on retraining just to dance in a field with RMS, like the numbers are all lies. Notice how "other" gets more share than Linux? Last time I looked up other it was Win9x and Win2K. Pretty sad when OSes more than a decade old and obsolete are still kicking you ass when you are giving it away, huh?

But if you would like some serious LOLs, just go here and see how many of the Linux bullshitter trademarks match /. groupthink. It is pretty damned accurate.

Just turn it off

[GaryOlson]

...leverage a flaw in Windows' Help and Support Center...

This service is turned off be default on all systems I manage both as part of initial installation; and where possible by Group Policy. Just another parasitic service which is not necessary....because everyone just uses Google anyways.

Re:Just turn it off

[1s44c]

...leverage a flaw in Windows' Help and Support Center...

This service is turned off be default on all systems I manage both as part of initial installation; and where possible by Group Policy. Just another parasitic service which is not necessary....because everyone just uses Google anyways.

You should turn off everything you don't need but if you turned off every insecure component of windows you would be left with a machine just running its BIOS.

Re:Just turn it off

[Anonymous Coward]

Sure, so why bother with windows?

Re:Just turn it off

[Anonymous Coward]

Who says the BIOS isn't exploitable too? just about all machines these days are capable of network boot. Whats to say there isn't some buffer overflow or some other exploit in this capability that could let you insert code into the NIC firmware or even the system's bios? Then you've got exploit code running at such a low level that not much short of monitoring all the traffic coming in/out the NIC at the physical level would tell you something is up. Of course this would have to be highly targeted

Re:Just turn it off

[Anonymous Coward]

http://www.theregister.co.uk/2009/07/30/intel_bios_security_bug/

Actually, you'd have to turn off the computer. Yes, I know BIOS isn't part of Windows.

Re:Just turn it off

[Anonymous Coward]

You should turn off everything you don't need but if you turned off every insecure component of windows you would be left with a power supply.

FTFY.

Good Touch

[luggage66]

Quick, someone make an exploit that installs IE8 or Chrome.

Re:Good Touch

[hedwards]

They already do, it's called the IE 8 install program.

Re:Good Touch

[luggage66]

Tell my users this.

Re:Good Touch

[TheRaven64]

Really, on Slashdot people should be expected to know the difference between an exploit and a trojan.

Microsoft's Official Response

[eldavojohn]

They were not happy and said

"Public disclosure of the details of this vulnerability and how to exploit it, without giving us time to resolve the issue for our potentially affected customers, makes broad attacks more likely and puts customers at risk. One of the main reasons we and many others across the industry advocate for responsible disclosure is that the software vendor who wrote the code is in the best position to fully understand the root cause. While this was a good find by the Google researcher, it turns out that the analysis is incomplete and the actual workaround Google suggested is easily circumvented.

Re:Microsoft's Official Response

[hedwards]

Ah, the security blanket approach. If they can't see me I'm not vulnerable.

Re:Microsoft's Official Response

[Anonymous Coward]

>and the actual workaround Google suggested is easily circumvented.

So since they said it was right, they must be perfect. I mean, the ARE Microsoft.

Re:Microsoft's Official Response

[commodore64_love]

>>>"...without giving us time to resolve the issue..."

Oh well. It's no different than how you routinely acted in the 80s and 90s Mr. Microsoft. I guess people should "do as we say, not as we act" eh? It's okay for MS to act like an ass, wiping-out competition left and right, but not other companies to copy the MS Warbook. Hypocritical corporation.

Re:Microsoft's Official Response

[jank1887]

avoid the gaze of the Ravenous Bugblatter Beast of Traal (a mindboggingly stupid animal, it assumes that if you can't see it, it can't see you - daft as a bush, but very ravenous)

funny. the daft but ravenous comment seems totally appropriate here.

Re:Microsoft's Official Response

[Anonymous Coward]

"without giving us time to resolve the issue"

The had time to fix it. 5 long days. If MS is not threatened by a public full disclosure, chances are they will never fix their bugs.

Re:Microsoft's Official Response

[SanityInAnarchy]

Public disclosure of the details of this vulnerability and how to exploit it, without giving us time to resolve the issue...

They had five days. Not great, but he made exactly this point -- Microsoft needs to patch these things faster when discovered.

Re:Microsoft's Official Response

[gad_zuki!]

Except these moves don't punish MS in the slightest. It punishes end users who are just using their computers and have no say in the policies here.

Not to mention, 5 days certainly is not enough time to do the testing MS needs to do to release a patch. I'd rather just perform a work around (limited rights, removing functionality, etc) than deal with a patch that will cause me further problems.

Re:Microsoft's Official Response

[rawler]

The way I see it, they've had about 9 years to fix it. All the way since XP was released. (unless it was introduced by some service pack).

Software Security is ultimately the responsibility of the creator of the software. Others have no obligation whatsoever, moral or legal, to report in errors.

Non-microsoft employees are NOT Microsoft's security-staff. Or maybe they are.

Re:Microsoft's Official Response

[Anonymous Coward]

When Microsoft crushes competition, buys out rival companies just to shut them down, when they keep rewriting their file formats just so that others can't make software compatible with their data, it punishes the end users even more than you could ever imagine. You just don't see the effects right away.

And if you're still using any Microsoft product, you should know by now that this kind of shit is normal. Everybody arounds you keeps saying that Microsoft products are crap yet you keep using them. It's your own damn fault.

Re:Microsoft's Official Response

[mcgrew]

the software vendor who wrote the code is in the best position to fully understand the root cause

Then why did someone else find it first?

Re:Microsoft's Official Response

[Anonymous Coward]

It is enough to respond with something like, 'Oh, good catch, we'll get this into the next patch tuesday.'

Re:Microsoft's Official Response

[Infiniti2000]

Then why did someone else find it first?

Because paying someone to find...and fix...bugs detracts from the bottom line. Why bother doing that when you have a huge army of Microsoft haters just vying for the chance to stick it to them?

Re:Microsoft's Official Response

[Abcd1234]

Except given the sheer volume of hardware and OS configurations MS has to support, fixing any bug and fully regression testing the fix in five days is utterly ridiculous.

I mean, honestly, around here, people bitch if MS doesn't fix bugs fast enough. And then they bitch when a fix busts someone's configuration. But you can't have it both ways. Either you take the time to test these fixes, thus extending the period in which systems in the wild are vulnerable, or you risk fucking up people's machines. That's life. Welcome to the real world.

Re:Microsoft's Official Response

[Abcd1234]

Because, if Linus is to be believed, with enough eyes, all bugs are shallow.

Honestly, your attitude is fucking ridiculous. By your definition, *any* bug found in a piece of software by someone other than the author(s) indicates some sort of failing in those who wrote it.

Re:Microsoft's Official Response

[Abcd1234]

No, it's the "look, seriously, give me some time before you tell everyone how to pick our locks" approach. 5 days is a *ridiculously* short time in which to expect MS to turn around a fix, doubly so given they've been burned in the past by fixes hosing obscure configurations.

What's the "right" number? I don't know... 15 days is probably more reasonable, but it really depends on the scope of the issue. But 5 days is *clearly* too short... well, at least to anyone with half a brain and experience in the software industry (which, evidentally, doesn't describe many of the commentors in this particular article).

Re:Microsoft's Official Response

[ae1294]

it turns out that the analysis is incomplete and the actual workaround Google suggested is easily circumvented.

Wait... didn't Microsoft just admit that the workaround can be circcumvented? WTF that's a zero day disclosure!

Re:Microsoft's Official Response

[perryizgr8]

its funny because the newest ubuntu has broken headphone sound for a lot of people (me included). and nobody worries too much. "it happens, move on man. just install the earlier version again." but if ms had released a patch that fucks up even a minuscule of obscure configs, everyone would have been outraged and angry. "m$ is such a huge gorrilla, can't they even test properly?"

Re:Microsoft's Official Response

[hedwards]

Five days is plenty of time to at least respond. The problem is that MS will leave serious vulnerabilities unlatched for extended periods. They could've at least released a bulletin.

Re:Microsoft's Official Response

[Blakey Rat]

They could've at least released a bulletin.

For what purpose?

You're saying instead of a Google engineer spilling the beans in 5 days, Microsoft should have spilled the beans in does not work. Things like that are exactly *why* the process takes longer than 5 days, and exactly why this particular Google engineer is being a complete jackass.

Re:Microsoft's Official Response

[Anonymous Coward]

Its interesting you should mention file formats and Microsoft. Some of us still use ancient versions of MS Office released more than a decade ago. We are even today still able to open files produced in the latest versions of these products. A free converter is available from MS for .docx -> .doc and the results are the same with either format.

Since you can't be referring to office I'm left wondering what propritary on-disk file formats your talking about? Anything new/recent from MS with on disk storage seems to all be xml based nowadays. Most of their server products use sql server for data storage.

Yes Microsoft sucks. You suck too for having to resort to spewing falsehoods to support your reasons for MS sucking.

Re:Microsoft's Official Response

[geekoid]

If ms was concerned, 5 days would be enough. However it's a little bigger then that.

This gentleman has sent numerous reports to MS about exploits, and ofter MS just sat on them. Had they been reasonably responsive in the past, this never would have happened.

They are reaping what they sow.

Re:Microsoft's Official Response

[Abcd1234]

If ms was concerned, 5 days would be enough.

No, it wouldn't be. The very fact you think so tells me you don't work in the software development world (or you work for a company that produces shitty software).

Five days is barely enough to fully characterize an issue and propose a solution, let alone perform a complete impact analysis and begin the testing cycle to ensure you don't introduce regressions along the way.

Re:Microsoft's Official Response

[AK Marc]

How long should you wait? If you send in a "critical bug discovery" and you don't even receive a human acknowledgement, should you assume that they got it, they are working on it as fast as they can, or that they are ignoring it? Given that the person submitting bugs has been ignored before, would that affect your opinion? And if you know they'll fix it when you release it to the public, but not before, then it wouldn't matter when he released it to the public.

Remember, this isn't someone that randomly found a bug, but someone that's found ones before, reported them, and had them fixed. Perhaps he has a better idea of what works than you and I do.

Re:Microsoft's Official Response

[Abcd1234]

How long should you wait?

One patch cycle. In the case of MS, one month.

Next question?

Re:Microsoft's Official Response

[martin-boundary]

DNA was truly a head of its time. And that goes double for Zaphod Beeblebrox.

Re:Microsoft's Official Response

[Anonymous Coward]

Your reply tells me that YOU don't work in the software development world.

You get the report. You look at it, you read it, and you see where the bug is. It's very clearly shown in the bug report where the bloody problem is.

So, you fix it. It's not a huge frakking thing to fix. It's a simple little patch. See from the disclosure:

"Thus, MPC::HTML::UrlUnescapeW() does not check the return code of MPC::HexToNum() as required"

So, you simply do an extra if-statement to check the return value, and spit out appropriate errors if it's wrong. Then you recompile for the X versions you need to issue a fix for, pack it up and ship it.

Unless your development process is seriously broken, it really shouldn't take more than half a day from you've gotten the bug report until you've got the sign-offs to ship the bloody patch.

So get off your high horse about your so-called "software development world" and get into the real software development world.

Re:Microsoft's Official Response

[Abcd1234]

It's a simple little patch. See from the disclosure:

Except, of course, Microsoft has already stated that the claimed patch a) doesn't work, and b) doesn't address the root cause of the issue.

But, yeah, let's take the word of a guy who's never actually seen a line of Microsoft's code over Microsoft themselves. Good call, dude.

Re:Microsoft's Official Response

[mcgrew]

Any flaw in anything is a failing of whoever made it. Carpenter leaves a scratch? Fail. Software has a bug? Fail. Gas pedal sticks on your car? BIG FAIL.

Nobody's perfect and evertybody makes mistakes, but every mistake in any endeavor is a failure. One should always strive for perfection, even though it's an unattainable goal. But corporations only strive for profits, and that's not just Microsoft, that's all corporations.

Irresponsible

[dmcq]

If he has only given five days before releasing it into the wile he is recklessly irresponsible. It just shows a person can be intelligent one way and a complete eejit in another. Could he be sued for this by someone who gets infected?

Re:Irresponsible

[mp3LM]

It's probably important to note that it may not have been his decision to release the information to the public.

Re:Irresponsible

[axl917]

Could he be sued for this by someone who gets infected?

Don't be stupid. It isn't the messenger's fault.

Re:Irresponsible

[commodore64_love]

How do we know it was 5 days?

This could be one of those infamous bugs that MS has known about (secretly) for two years, but they never bothered to fix. If that's true and the programmer knew the bug had existed for two years, then I consider him a cyber-patriot for whistle-blowing. Maybe now MS will get off its 1200 pound ass and fix it.

Re:Irresponsible

[Anonymous Coward]

How do we know it was 5 days?

This could be one of those cyber-infamous bugs that MS has cyber-known about (cyber-secretly) for two years, but they never bothered to cyber-fix. If that's true and the cyber-programmer knew the cyber-bug had existed for two cyber-years, then I cyber-consider him a cyber-patriot for cyber-whistle-blowing. Maybe cyber-now MS will get off its 1200 pound cyber-ass and fix cyber-it.

Fixed that for you

Re:Irresponsible

[somersault]

FTBD:

Finally, a reminder that this documents contains my own opinions, I do
not speak for or represent anyone but myself.

Re:Irresponsible

[Anonymous Coward]

as I was reading this story, I thought to myself "I wonder what the stupidest person on Slashdot thinks about all this?" Now I know.

Re:Irresponsible

[somersault]

It kind of is if they publish the exactly exploit code needed before MS have time to figure out a real patch (the patch that this guy sent in is apparently very easily circumvented).

If he hadn't published full details of the exploit then you couldn't blame him.. but as it stands, he's not much better than a malware author.

Re:Irresponsible

[correnos]

How would this guy be responsible for the bug? Did he create it? Did he break into the M$ servers and implant the bug in the source code? If you want to be whiny and lump the blame on someone, find the coder who wrote the code with the bug. The Google employee is only being responsible and notifying the public about a standing security hole that needs to be protected against. Security through obscurity is no security at all.

Re:Irresponsible

[Exitar]

What would have been a good time for him to publish it?
The same day Microsoft will fix it? The day after? The day before?

They didn't fix it in 5 days. What if the fix will happen in one week? In one month?

Re:Irresponsible

[Anonymous Coward]

Don't be stupid. It isn't the messenger's fault.

Killing the messenger is traditional. -- Recipient of Bad News

Re:Irresponsible

[hey!]

It depends on the nature of Microsoft's response. Consider the following:

(a)"Thanks, this looks serious. We've got a team looking into it now, but we've found some difficulties with your suggested fix. If you don't see a security patch in the next several days, don't be alarmed. A patch is coming soon, but we don't want to release a fix that creates more problems. We'd appreciate it if you kept this under your hat while we're working on this. We'll be sure to credit you with finding this problem when the patch comes out. Feel free to call my cell at xxx-xxx-xxxx if you have any questions."

(b)"Thank you for your interest in the
      [ ] aesthetics
      [ ] features
      [ ] performance
      [x] security
of Microsoft Windows, the most
      [ ] good looking
      [ ] comprehensive
      [ ] powerful
      [x] safe
operating system on the market. We get more suggestions for improving Windows than we can respond to personally, but your input is important to us. With your help, we will make the next release of Windows
      [ ] more beautiful
      [ ] more useful
      [ ] faster
      [x] more secure
than ever."

If it is (b), I'd release the details too, although I'd wait longer than five days, and I'd give them a heads-up that I was announcing.

Re:Irresponsible

[Yvanhoe]

The problem is that, yes, you could sue him but you can't sue Microsoft to force you to run faulty software.

Re:Irresponsible

[Anonymous Coward]

He's not only the messenger.
He is the one who potentially taugth the attacker how to infect the person.
It would still probably be very difficult to sue him for it though.

Re:Irresponsible

[Anonymous Coward]

I think you're the one who's being stupid. He posted working exploit code, therefore he is no longer a messenger and is now a facilitator.

He can definitely get sued over this.

Re:Irresponsible

[euxneks]

Could he be sued for this by someone who gets infected?

Don't be stupid. It isn't the messenger's fault.

King Leonidas would disagree with you.

Re:Irresponsible

[Anonymous Coward]

Don't be stupid. It isn't the messenger's fault.

Actually, some vulnerabilities are the messenger's fault.

Re:Irresponsible

[John Hasler]

> Could he be sued for this by someone who gets infected?

Not successfully. He has no duty to keep such information secret. He also has not duty to tell you about it, and yet he did. Why should he be liable for the consequences of your failure to act on the warning he gave you?

I'm sure all the

[JamesP]

"securit experts" that try to convince people that IE is no less safe than FF/Chrome are going to be bothered (even though this attack has nothing to do with browser)

5 days would be enough for an advisory.

How long did MS took to solve some bugs again?!

Re:I'm sure all the

[biryokumaru]

Occam's Razor is crap. Occam's electric shaver, OTOH, is more soft on the skin and battery charge lasts a full week!

Hey! Get out of my bathroom!

- Occam

Time to dress up the emperor

[Anonymous Coward]

IT is now about fuedism not about technology. Google pushes out its drug of choice, and MS is now having to live with a growing public knowledge that for 20+ years its software is garbage. I just find it funny that Google is the one trying to make Microsoft accountable.

Industry Standard

[protektor]

I thought there was a big fuss a few years back about how vendors didn't respond to researchers and how they took forever to fix problems with close sourced software. So the industry decided that 5-7 days after letting a vendor know about a problem that everyone would release the information so that everyone would know about rather than just the bad guys and so system admins would know to watch for that type of attack and force the vendor to fix it in a timely manner.

Seem like this is just standard timing since vendors have gotten in the habit of ignoring researchers and not spending the time and resources to fix problems that they should have tested for in the beginning and most of the time don't want to bother fixing. Historically companies have not wanted to spend manpower and money required to fix program bugs. They more want to fix them when they get around to having the free time a few months later to fix the bugs. After all bug fixes don't make them any money. If I remember correctly there was a quote from Microsoft saying that exact thing. "People don't want bug fixes, they want new features and bells and whistles instead." So if Microsoft really feels that way then this shouldn't bother them at all, since people don't care about having bugs fixed.

The quote was from German weekly magazine FOCUS (nr.43, October 23,1995, pages 206-212). Bill Gates was being interviewed when he made statements to that effect.

If you treat program bugs as a PR issue, then don't be surprised when people use PR against you for bugs you don't want to be bothered to fixed, in a timely manner historically.

Re:Industry Standard

[Lord Ender]

The standard (called "responsible disclosure") is to give the vendors a chance to work a fix into their regular release schedules (be that monthly, quarterly or whatever). This includes making sure they have time for patch development and testing before the release.

Re:Industry Standard

[SillySilly]

"People don't want bug fixes, they want new features and bells and whistles instead."

I remember that interview: Bill Gates was asserting that people won't pay for bug fixes, but only for new bells and whistles. And he's right! People expect software with no bugs and they expect that the inevitable bugs will be fixed for free. The big problem, of course, is that Microsoft put new bells and whistles at a higher priority than bug fixes since they get paid for the former but do the latter for free.

Re:Industry Standard

[Anonymous Coward]

So the industry decided that

And that was the place where I stopped reading your necessarily trollish garbage.

Re:Industry Standard

[protektor]

So what everyone should wait on Microsoft to release a service pack? I think not! If everyone waited that long then the bad guys would have a field day. If you think researchers are the only ones who know about these bugs then you haven't been a system admin for long enough. You also clearly aren't following anything going on in the underground community. These bugs are researched all the time by huge numbers of bad guys these days. Why? Because there are entire underground markets to sell these bug exploits for huge money these days, to other hackers, companies, groups who do bad things (terrorist/activists) and governments. I used to know of at least 2 different market places in the past where you could buy these exploits and viruses, and I am sure there are even more such places now.

Waiting more than a week for a vendor to fix a bug, before forcing their hand with a public release is a nightmare. The longer you wait the higher the probability is that someone has quietly got into your system or network without you knowing and is having a field day with your systems. Publicly annoucing security problems and letting everyone know to be on the look out for attacks like these is the only way to go.

Historically vendors have down played security bug reports. They have gone so far as to tell people that no such bug was possible and that they can't duplicate the problem, thus it isn't a problem and doesn't need to be fixed. Vendors have tried to sue and threaten researchers in to not releasing information of any kind so they don't have to be bothered to fix the problem.

Full public disclosure after a limited period of time of a week or so, is the only way to make sure that vendors fix the problem and don't try to bury them.

Can you prove that Microsoft hasn't know about this for years and never bothered to do a thing about because they didn't want to spend the money to fix it since they thought well no one knows about it or complained about it, so it isn't a problem, and thus doesn't need to be fixed? I know of several cases in the past were that exact thing was done by Microsoft and only when people started screaming about it to everyone and the press picked up that Microsoft bothered to fix the problem. I know for a fact that a few researchers in the past reported bugs to Microsoft and they sat on them for over a year. That is no way to handle security fixes. That smacks of screw the safety of our customers, we don't care, we just want them to buy our latest thing, and we don't want to do anything that we aren't being paid for, even if we should have caught this a long time ago.

Re:Industry Standard

[Lord Ender]

So what everyone should wait on Microsoft to release a service pack? I think not!

No, they should give Microsoft a chance to work a patch into its regular release schedule, which is monthly.

Re:Industry Standard

[Anonymous Coward]

Microsoft gets paid for both bug fixes and new features. The payment for bug fixes show up when the user decides whether to buy Microsoft's next OS or to try a competitor's. Microsoft is actually losing ground on that front despite all their monopoly tie-ins.

Re:Industry Standard

[b4dc0d3r]

Not disagreeing, just fact checking. Huge money is a bit mythical - a few thousand seems to be the going rate. I'm pretty sure that was linked from here no more than a month ago, possibly two.

Why would legit admins follow the underground community? The last thing someone wants is when the network goes down for someone to find links to fravia and woodman in someone's browser history - that isn't damning by itself, but it looks bad.

Announcing security problems is not the only way to go if the vendor is responsible. "Be on the lookout for hcp:// links because I reported a vulnerability" would be a good compromise, letting admins block content or at least watch for it, while divulging the details to the vendor, is an alternative. When the vendor doesn't respond, you have no choice - they force you into forcing them, so you're not the bad guy in that scenario.

And finally, why does anyone have to prove something that Microsoft itself probably couldn't prove? We should assume that every exploitable vulnerability is something MS should have tested for, and therefore should have known about. Whether they did or not is irrelevant. The code should have been reviewed, and a huge red flag is when a function returns a value which is not checked. I make it a rule to either declare a function void or always check the return value - never even think about putting a comment in the code that you don't care about the return value, and static checkers test for this sort of thing. It's terrible code, terribly reviewed, and probably was put together by the scrub team because the component is low-risk, low-priority, low-usage.

Microsoft has improved on its responsiveness, but I still see complaints that simple crashes are ignored, and later turn out to be exploitable. At least MS should do a better job determining if something is exploitable before setting it as a low priority fix. That doesn't mean it's open season, and each bug is going to be a case-by-case situation. Some bugs need immediate disclosure, some need attack vector disclosure (if the vector can be mitigated), and some may need complete silence (assuming the vendor is actively working on it, althogh I can't think of a valid reason right now - I'm just leaving open possibilities like the Kaminsky DNS issue which was probably best left vague for a while until enough people patched).

Thanks Google

[AmiMoJo]

Now I can protect myself against this exploit. 5 days is plenty of time to issue a patch, even if it just closes the hole while a proper fix is worked on. Monthly update cycles are too slow.

Re:Thanks Google

[Anonymous Coward]

5 days is plenty of time to issue a patch, even if it just closes the hole while a proper fix is worked on.

You live in a dream world. Yes, 5 days is fine if you have a non-os product that isn't part of an ecosystem with millions of applications running on it. For example to patch something like a text editor - 5 days is probably enough. But a responsible company with millions of installs (Microsoft, Apple) isn't going to rush something out that would break more than it fixes. That would be stupid.

Re:Thanks Google

[Xest]

That depends on the company.

Sure some companies don't give a fuck about incompatability caused by updates and that sort of thing, however MS very much does.

Further, as they have such a large share of the desktop and server market that depends on working it would be irresponsible of them to throw out a patch in a mere 5 days that can't have been fully tested with countless configurations and ended up causing more harm to customers machines than if they'd just not bothered to patch at all.

You can't reasonably build and test a patch that has minimal effect on your customer base in 5 days when your customer base is as large and varied as Microsoft's.

Re:Thanks Google

[tajribah]

It may seem that so, but the reality seems to disagree. Most Linux distributions release security updates within a day or two after the vulnerability is announced and while I maintain dozens of Linux machines, I had witnessed a security update breaking something at most once. On the other hand, I have seen problems caused by Windows updates countless times.

Re:Thanks Google

[ifrag]

5 days is plenty of time to issue a patch.

Perhaps for some that is possible, although clearly Microsoft has no process in place to do something in that amount of time. With analysis, design, implementation, unit testing, code reviews, and whatever else their software cycle involves, I don't think they have a chance at having anything at all releasable in 5 days. So this expectation is a known impossibility, and likely known to some degree by those responsible for releasing the information.

And I don't fault them for actually following their own process and not rushing things out. Sure, they might be able to throw together some half-assed fix in a fraction of the time, but what will the consequences be? Instability? Data loss? An entirely new security hole as bad as the original? It's entirely possible the damage done through hasty work could even be worse than the exploit itself. Just "closing the hole" might mean leaving the OS inoperable (in broad generic terms, not whatever this story is referencing). Sure, maybe their process could be stream-lined, and improved upon, but 5 days can easily be chewed through especially in "big" software projects.

Re:Thanks Google

[Ash-Fox]

But a responsible company with millions of installs (Microsoft, Apple) isn't going to rush something out that would break more than it fixes.

Both Apple and Microsoft have both failed to release some patches that don't break more than it fixes this year. No idea if it was rushed though.

Re:Thanks Google

[Anonymous Coward]

Does this make them too big to fail? Are we as the people of the US going to have to bail them out too?

Re:Thanks Google

[csrjjsmp]

Hence his qualification "as large and as varied as Microsoft's."

Re:Thanks Google

[protektor]

If a industry leading OS vendor who has a legally declared monopoly doesn't have a process in place to fix serious reported bugs in 5-7 days, after what 10-15 years as an OS company, then they deserve everything they get. Microsoft is the largest software company in the world. They should have had a team in place for years to deal with these kinds of reports and have a process in place to get a "hotfix" out within a few days and a serious stable long term solution with a week or two max. If Microsoft can't manage that then they simple just don't care, and aren't willing to spend the money to fix the problems that are their own creation.

That is simply putting profits above the health of their customers computer systems and networks. Which is in my opinion crappy ethics, and being a poor American corporate company.

Re:Thanks Google

[tajribah]

All the Windows installations I have seen broken were just the default install (unlike the Linux machines), so if the MS's QA process fails to discover such cases, it's hopelessly broken anyway.

Re:Thanks Google

[LordLimecat]

There is apparently a simple registry edit that can fix this, as Secunia advised. Surely MS can do something stopgap? I mean my goodness, a single Google guy found the bug, found a function partially responsible in helpctr.exe, offered a binary patch to partially fix the issue, and created PoC code. A secunia guy then reviewed the patch, found the REAL culprit function, and offered a working registry patch. This all occured within the last week-- and a multi-billion dollar company hasnt done anything except "confirm receipt of the issue" in that time?

Or how about this-- offer less tested patches through windows update under a hidden-by-default "Security fixes-- Testing" label or through a WSUS interface, and let IT staff test the damn thing. Arent such options available for various flavors of linux, now that I think of it?

Re:Thanks Google

[LordLimecat]

Perhaps for some that is possible, although clearly Microsoft has no process in place to do something in that amount of time

I thought the point was that Ormandy recognized that and thinks it sucks, is unacceptable, and needs to be changed asap.

Re:Thanks Google

[VGPowerlord]

Most Linux distributions release security updates within a day or two after the vulnerability is announced

Which distributions?

Just last week Ubuntu released two kernel updates (at least for x86-64) for 10.4. I can't help but think the reason is that there was a flaw in the first release that forced a second.

This happens less often with Debian, because Debian uses its unstable tree (where Ubuntu gets its packages) to have users check for crashes or conflicts before promoting them to the testing tree, where, if no serious bugs are reported there, will eventually make it into the stable tree.

Re:Thanks Google

[Rockoon]

"..at most.." ??

Did you want it to sound like 'never' was still in the running? Fucking spinner.

You just nullified everything else you had to say.

Re:Thanks Google

[Rockoon]

Microsoft is the largest software company in the world.

[pandant]
When Did Microsoft become another name for IBM?
[/pedant]

Re:Thanks Google

[tajribah]

No, but unlike many others I prefer to present all the evidence I have. I have written "at most once", because in our case I do not really know whether the problem was related to the security update or not, because it disappeared quicker than I was able to find out its cause. But even if it were a failure, one problem on a large amount of machines vs. many problems even on a small number of machines is still a strong case.

Re:Thanks Google

[Anonymous Coward]

Further, as they have such a large share of the desktop and server market that depends on working it would be irresponsible of them to throw out a patch in a mere 5 days that can't have been fully tested with countless configurations and ended up causing more harm to customers machines than if they'd just not bothered to patch at all.

Yes, but it doesn't take 5 days to email the person back saying "We've received your information and are now in the process of extensively testing it's effect on the operating system to make sure it doesn't introduce any accidental incompatibilities."

Re:Thanks Google

[tajribah]

Which distributions?

Debian, Suse, Gentoo, ...

Just last week Ubuntu released two kernel updates (at least for x86-64) for 10.4. I can't help but think the reason is that there was a flaw in the first release that forced a second.

Sure, such cases happen, but you still have the choice: either you prefer security even if it might cost stability in rare cases (which can be worked around by reverting to the previous version almost always), or you prefer stability, so you can wait a couple of days with applying the patch and check if an updated version is issued.

Re:Thanks Google

[AmiMoJo]

Read what I wrote. They could issue a very simple patch that disables the vulnerable code and then go to work on a full fix. That could easily be done in 5 days.

Sure, maybe it will break things for some people, but that is better than everyone being vulnerable to being 0wned. It's the lesser of two evils.

Re:Thanks Google

[Xest]

Seeing as Linux rarely seems to work out the box with a lot of hardware I've tried it with anyway, it's hardly a good example.

I've never found it works right with many things like different wifi cards, graphics cards, and TV tuners over the years without a massive amount of fiddling, although I've not had any real hardware problems using it in a server environment with no GUI, just a standard non-wireless network card and such I suppose.

Personally I'd be happier with Linux if it just worked on the desktop at all without a need for fiddling at all, let alone before dealing with patches.

Still as I said in my original post, Microsoft's marketshare is a major factor in the differences between Linux and Windows, but there are other factors- Linux networks tend to be administered by much more skilled professionals who can shrug off problems a lot of Windows users and admins can't. Further, people pay for Windows so have higher expectations in terms of quality, if Linux fails to work people might whine in the forums, but they know they'd have no legal recourse, whilst if Microsoft brought down a bunch of important servers across the world with a patch it could find itself deep in legal trouble. Patching for Linux still doesn't really compare to patching for Windows.

Re:Thanks Google

[Blakey Rat]

If a industry leading OS vendor who has a legally declared monopoly doesn't have a process in place to fix serious reported bugs in 5-7 days, after what 10-15 years as an OS company, then they deserve everything they get.

First of all, could people stop throwing out "legally declared monopoly" (or the even worse "convicted monopolist") in threads where it's utterly irrelevant? It just makes me think you're a fucking idiot. Idiot.

Secondly, do you think the fact that Microsoft runs so many computers is perhaps the *reason* they can't fix serious bugs in 5-7 days? (And I'll note that this time they only got 3 *business* days, and when their security team was already working on a major patch release.)

Microsoft does this thing you may have heard of, it's called "QA." They test everything. Regression testing, fuzz testing, code reviews, etc. There's no way any company that follows those procedures, on a product as big as Windows, would be able to create a working patch in 5 days. No way in fucking hell.

Now you probably work at a small software company that has shitty QA and puts out shitty products. Most do. (Either that or you're completely ignorant of software development, but posting here as an 'expert' anyway.) Fine. But don't extrapolate your experience to Microsoft.

Microsoft is the largest software company in the world.

No they aren't.

But it's good to know that you have no shame about posting easily-verifiable bullshit to this forum. I think it puts the rest of your little screed here into perspective.

They should have had a team in place for years to deal with these kinds of reports and have a process in place to get a "hotfix" out within a few days and a serious stable long term solution with a week or two max.

What makes you think they don't?

If Microsoft can't manage that then they simple just don't care, and aren't willing to spend the money to fix the problems that are their own creation.

Arguably they don't (and shouldn't) care-- about a flaw in IE6 and Windows XP! Support for it ends in a couple years, and we'll all be happy to get rid of the fucking thing. If you care about security, upgrade! Windows 7 and IE8 are significantly more secure.

That is simply putting profits above the health of their customers computer systems and networks.

Or maybe it's "doing the best that is humanly possible." Do you have any *proof* of this accusation? Or are you just posting more bullshit?

Look, if you have a hard job to do, throwing money at it won't make it go any quicker. You're living in some strange fantasy-world if think otherwise... it's well documented that adding more people to a software development job makes it *slower*. Paying existing people more doesn't make them miraculously able to type or think more quickly.

What are you expecting the money to be able to do, exactly? Call down miracles from heaven?

Which is in my opinion crappy ethics, and being a poor American corporate company.

You're welcome to hold whatever opinion you like, but it would be nice if it wasn't based on complete bullshit.

Re:Thanks Google

[tajribah]

I do not claim that MS does not need to test their patches thoroughly. I only told that at least in the cases I have observed, Windows updates produced at least one order of magnitude more problems that all Linux updates I have seen. It is a sign that whatever testing MS does, it is not effective.

As of legal trouble: If there were any real legal liability for MS's software defects, MS would be already bankrupt a dozen times and you can choose whether for their bugs in general, the failures of products to meet their specs (remember the Windows Vista hardware requirements fiasco?), or negligence to fix security bugs.

Re:Thanks Google

[Anonymous Coward]

so like... if Windows is so convoluted that it's impossible to patch in a reasonable amount of time... how is that not Microsoft's fault?

Re:Thanks Google

[orient]

You can't reasonably build and test a patch that has minimal effect on your customer base in 5 days when your customer base is as large and varied as Microsoft's.

When you design your software properly, you can change the implementation of every little module or function without affecting anything else. But why would Microsoft eliminate the best excuse for not fixing bugs?

Re:Thanks Google

[Anonymous Coward]

That's one thing I like about Chrome's "channels" concept. It'd be great if you could subscribe to "developer", "beta", or "stable" channels for OS updates too. That way Microsoft could release not-fully-tested fixes immediately, and sysadmins can get more control over which type of risk they want to take on (more secure, more buggy vs. less secure, less buggy). Of course, we're just going to have to wait for Chrome OS to get that, because Microsoft will obviously never do it.

Re:Thanks Google

[Xest]

It's not necessarily Microsoft's software that's the problem, it's the fact that many people have used undocumented APIs over the years but that Microsoft is still decent enough to support them. The Windows ecosystem is so massive that that excuse just doesn't hold, even if Microsoft builds software sensibly it doesn't mean everyone else has.

Re:Thanks Google

[soppsa]

Lol you've never seen a Linux machine broken after a default install? You are either: new to Linux (last 5 years) or have a really sheltered install base.

I hate Microsoft, would never use Windows etc, but out of the *thousands* of Linux machines I have installed, I have seen many things broken out of the box. Everything from RHEL to Slackware... never works on 100% of hardware, and especially if you encounter bleeding edge platforms...

Re:Thanks Google

[tajribah]

I was speaking about upgrades, not fresh installs.

Grandstanding

[1 inch punch]

>>Finally, a reminder that this documents contains my own opinions, I do not speak for or represent anyone but myself.
Didn't see where the Google association was, but judged in isolation it appears to be nothing more than grandstanding since 5 days doesn't seem to be reasonably enough time to respond.

Raging Bull

[PopeRatzo]

This story would be funny if not for the fact that the Google engineer may have put a lot of computer users, and probably its own customers, at risk in this little game of one-upmanship.

It reminds me of a quote from Robert DeNiro playing Jake LaMotta in the great film Raging Bull by Scorsese. He's sitting at the table of some mobsters who are needling him about the impressiveness of another fighter: "Maybe I'll put da two of ya in the ring together and you can fuck each other".

When two big companies fight it out, one would hope that the consumer would be the beneficiary of their competition, not collateral damage.

Re:Raging Bull

[tajribah]

Sorry, but it seems that you are a little bit confused about the real cause. First of all, the blame lies on MS for creating the bug. Secondly, a responsible vendor should fix a security hole as quickly as possible, because security bugs are rarely discovered by a single person only. It is highly probable that the same bug is already being expoited by the black hat hackers in the wild. Five days is more than enough for the vast majority of security problems and delaying the fix is completely irresponsible. IMHO, MS should stop complaining and fix their processes instead.

In addition to that, it seems that MS has never replied to the researcher. Responsible vendors do that and they even cooperate with the researchers on the possible fixes. Most researchers treat such vendors very respectfully, but they hardly have any understanding for vendors who expect that they can delay security fixes for months and ignore the input from the security community.

Re:Raging Bull

[HikingStick]

It's not really a new vulnerability--it's been around for almost a decade.

Re:Raging Bull

[Barny]

Thirdly a sanely designed OS shouldn't be crippled and burn because one user ran something they shouldn't have in their own user space...

Re:Raging Bull

[PopeRatzo]

First of all, the blame lies on MS for creating the bug.

Of course this is true. But it doesn't change the fact that Google underling acted irresponsibly by releasing the bug into the wild.

In addition to that, it seems that MS has never replied to the researcher.

After five days they didn't reply to the "researcher" (a Google employee), and the researcher says "I'll show you...". His little hissy-fit could have cost Google customers money and time, not to mention data. It would be interesting to find out if this "researcher" checked with a superior before leaking the bug. It seems that he was making a decision that might have been above his pay grade. I've known some security "researchers" and at least the ones I've known have been capable of pettiness and ego-driven pissy behavior. I'm not saying that's what happened here, but it would be interesting to get some background.

My point is that we're just the little people getting trampled underfoot while Godzilla and King Kong fight it out.

Re:Raging Bull

[tajribah]

My point is that we're just the little people getting trampled underfoot while Godzilla and King Kong fight it out.

Agreed, but fortunately we often have the choice to avoid the Godzillas and King Kongs of this age and choose an OS which has real security support :-)

Zero days notice

[RulerOf]

I have been led to believe that "Zero-day" refers to the amount of time that exists between public knowledge of an exploit and when you see it being used in the wild.

If, for example, you heard about this exploit today, and the same exploit was WTFPWNing computers today, then it is, by definition, a "Zero-day exploit."

It's kind of like "hacker" though, and gets thrown around to mean all sorts of shit that it does not.

Re:Zero days notice

[bsDaemon]

I always assumed it to mean that the day the software is released, an exploit is found -- kind of like a zero-day crack to pirate software. Apparently I was wrong, and it means whatever the article author needs it to mean in order to sound as bad and scary as possible like "z0mg! we have zero days before the end of the world!"

Re:Zero days notice

[drinkypoo]

I have been led to believe that "Zero-day" refers to the amount of time that exists between public knowledge of an exploit and when you see it being used in the wild.

No, it's the time between public disclosure of the vulnerability and the time when the exploit is released. When you hear about it or when you see it is quite irrelevant.

It's kind of like "hacker" though, and gets thrown around to mean all sorts of shit that it does not.

Yes, as demonstrated by your comment. Zero-day cracks are cracks which come out on the release date, and Zero-day exploits are exploits which exist in the wild (whether you have detected them or not) the same day as the disclosure.

Re:Zero days notice

[squizzar]

Can we mod this up for being the only correct answer here? Or: http://en.wikipedia.org/wiki/Zero_day_attack

Re:Zero days notice

[Anonymous Coward]

Did you get that link from the first post? Where the correct answer is?

Re:Zero days notice

[Imagix]

This is the definition that I'd advocate. Otherwise the "zero-day" moniker loses pretty much any significant meaning. Being able to find and exploit a bug on the day that the software is released is a big deal. That would mean that the developer has left a pretty glaring hole in their software. Finding a bug 2 years later just isn't the same. Both are vulnerabilities, but one shows a higher level of inattention.

Re:Zero days notice

[Anonymous Coward]

I thought it meant that if a hole was found and it was already actively being exploited it was zero day, in essence a patch should be developed immediately.

Re:Zero days notice

[geekoid]

if the software MAKERS heard about it on the same day it was found on the wild it would be Zero day. The fact that you or I didn't hear about it is not relevant.

Re:Zero days notice

[Anonymous Coward]

It's kind of like "hacker" though, and gets thrown around to mean all sorts of shit that it does not.

Yes, as demonstrated by your comment. Zero-day cracks are cracks which come out on the release date, and Zero-day exploits are exploits which exist in the wild (whether you have detected them or not) the same day as the disclosure.

You know, there are any number of ways you could have said that without starting off sounding like a total cockmouth. If you spent as much time learning some tact as you do massaging your superiority boner, people just might start to like you.

Re:Zero days notice

[Anonymous Coward]

"It's kind of like "hacker" though, and gets thrown around to mean all sorts of shit that it does not".

Exactly, now Juan Corona , he was a real hacker.

Re:Zero days notice

[Anonymous Coward]

When you hear about it or when you see it is quite irrelevant.

That was "you" in the second person, not the first. I don't think anyone here is dumb enough to assume that the concept of "Zero-day" is subjective, but I suppose you never know.

Is this really 'do no harm'?

[guysmilee]

Is this really 'do no harm'?

Re:Is this really 'do no harm'?

[joaosantos]

Yes it is, what's doing harm it's not warning the users when some security flaw is discovered.

Re:Is this really 'do no harm'?

[Anonymous Coward]

Is this really 'do no harm'?

I think you meant 'don't be a jerk'.

Re:Is this really 'do no harm'?

[Anonymous Coward]

No, but you're thinking of the Hippocratic Oath that doctors take. It doesn't apply to people who aren't medical practitioners.

Re:Is this really 'do no harm'?

[mcgrew]

The motto is "don't be evil", not "do no harm." Besides, this is one engineer acting on his own, not the company itself. If a McDonald's fry cook robs a bank, does that make McDonald's evil?

Re:Is this really 'do no harm'?

[rimugu]

Wait, are you saying McDonalds is not evil?
I thought it was the sole responsible for fattening up everybody. That alone makes it more evil than Burger King and Microsoft combined.
Oh, sorry you are saying that McDonalds could or could not be evil, just not because an employee is evil.
Hold it, what if the employee robs a bank because of brain damage obtained of all the fat and the "would you like fries" he got at McDonalds?

Re:Is this really 'do no harm'?

[John Hasler]

> Wait, are you saying McDonalds is not evil?

Yes. They sell people stuff they want. That is not evil. YOur lack of self-control is not their fault.

> I thought it was the sole responsible for fattening up everybody.

Nope. They haven't fattened me up: I'm not fat and rarely eat their products (and not at all for several decades).

Jeopardy

[Slash.Poop]

I will take "Don't be Evil" for $600 Alex.

They did no evil

[keirre23hu]

Google, like Apple, is no longer any better/different than the companies they claim to be better than (from an ethical stand point).

Did you RTFA? The Google engineer - who btw didn't use any indication that they are from google, other than the link back to code.google.com - also posted a hotfix. So... they told Microsoft 5 days ago AND GAVE THEM A FIX... If this person was from a company that wasn't a competitor, would anyone call disclosing an (NON-ZERO DAY) issue on the security list so that security professionals are aware evil, after giving MS time to see the vulnerability and test the potential fix - I'd expect a company that derives Microsoft sized revenue from their OS to have someone readily available for these issues.

Re:They did no evil

[gad_zuki!]

Im sure his hotfix and one man testing matches MS's extensive testing. Seriously, do you think any company would just release this fix immediately without serious testing?

Re:They did no evil

[keirre23hu]

Not really, but I think his hotfix is a starting point, and testing would/should be at least partially automated. As another poster stated, they could put out an advisory or diable the service or do something more than they have done for the past 5 days.

Re:They did no evil

[228e2]

Hahahahahahaha.

Really? You think MS (or any company near their size) would use submitted code as a starting point? Geez, I understand the dislike for MS, but lets use sound reasoning please.

Re:They did no evil

[Anonymous Coward]

Spot on. Here's the problem with the majority of the comments I see now: they didn't even bother to RTFA. Your comment pretty much sums it up.

Note that the workaround (disabling the protocol handler) is preferred, as the hotfix is not sufficient (see comments on the article itself).

Re:They did no evil

[Anonymous Coward]

Except the fix did not work and left users still vulnerable.

Did you even read the article before spouting off?

Re:They did no evil

[Anonymous Coward]

It turns out that the fix doesn't work and can be circumvented. The Google employee apparently didn't understand the root cause of the problem and thus his patch missed the mark.
In the meantime, while waiting for an official patch, you can disable the Windows help to protect yourself:
Step 1: regedit /e HCPbak.reg HKEY_CLASSES_ROOT\HCP
Step 2: create a file HCPdisable.reg with the following content:
Windows Registry Editor Version 5.00
[-HKEY_CLASSES_ROOT\HCP]
Step 3: open HCPdisable.reg and confirm.
To re-enable this protocol after Microsoft fixes the issue, open HCPbak.reg and confirm.

Re:They did no evil

[LordLimecat]

Microsoft is a gigantic company with gigantic resources. Is it possible their priorities are not in patching? If ONE GUY can whip up an exploit and a patch in a few weeks, MS should be able to review the damn thing in a few hours on a few thousand virtual machines running in Hyper-V. You cannot tell me they dont have the resources to test this quickly.

Re:They did no evil

[Gr8Apes]

Im sure his hotfix and one man testing matches MS's extensive testing. Seriously, do you think any company would just release this fix immediately without serious testing?

I'm sure this was tongue in cheek. I'd safely bet there's a whole lot of "one man testing" that far exceeds MS's lack of testing based on these types of stories that keep coming out about MS's lack of quality control. After all, isn't MS the company known for selling software and letting their customers beta test it?

As for MS releasing the fix? How hard is it to test something when you've been pointed to the flaw, given all the test conditions, and the fix, and it's in a relatively small piece of code? Granted, the folks that wrote it are probably long gone....

Re:They did no evil

[n0-0p]

Actually, he recommended against using the hotfix, and instead suggested disabling the protocol handler. Speaking of, is anyone aware of the hcp: protocol being used for anything other than security exploits? Because in its 10 years of existence I've never once seen it used legitimately, but I've repeatedly seen it expose security vulnerabilities.

Re:They did no evil

[n0-0p]

Actually, Tavis specifically suggested disabling the hcp: protocol handler. His statement on the hotfix was:

In the unlikely event that you heavily rely on the use of hcp://, I have
created an unofficial (temporary) hotfix. You may use it under the terms of
the GNU General Public License, version 2 or later. Of course, you should only
use it as a last resort, carefully test the patch and make sure you understand
what it does (full source code is included). It may be necessary to modify it
to fit your needs.

MS are the ones focusing on the hotfix and claiming it's flawed without providing an explanation. MS are also the ones desperately trying to frame this as Google, when it was Tavis operating independently on his own time.

I'm not saying I agree with what Tavis did, but MS' shady response certainly isn't making me less inclined to side with Tavis.

Re:They did no evil

[Rockoon]

Microsoft is a gigantic company with gigantic resources.

There is a book you need to read. After you read it, maybe you wont be such a naive resource idiot.

Re:They did no evil

[westlake]

So... they told Microsoft 5 days ago AND GAVE THEM A FIX...

There are roughly 500 million users running XP.

63% of all PC users globally. Operating System Market Share, PCs In-Use Reached nearly 1.2B in 2008

XP is backwards compatible with many programs written for MSDOS, Win 3.1 and Win 9x.

But protecting the installed base of small business and enterprise applications written for XP is truly misssion-critical for Microsoft. The patch must not break these apps.

It would be lunatic to blindly trust a patch from a competitor -

and it is Microsoft - not Google - that has thirty years experience in its core markets. That knows which apps are likely to break and why.

Re:They did no evil

[Bill, Shooter of Bul]

Seriously, do you think any company would just release this fix immediately without serious testing?

I know what the implied answer to that question is, I'm not sure how much I believe it. Reason #213 why I am not using MS software any more.

Re:They did no evil

[Anonymous Coward]

BP would

Re:They did no evil

[Shotgun]

Write a program or two, then support it for more than a week. After you do so, maybe you won't be such a naive idiot.

The engineer presented a very specific exploit, with a workaround to fix it. The exploit mechanism was very clear. If MS has any design documents at all, it would be simple to trace out how the mechanism works in the system with such a clear pointer to the problem source. Mythical-man-month points out difficult projects with complex timeline inter-dependancies. Not something that is generally applicable to an identified bug fix.

Re:They did no evil

[Rockoon]

We arent talking about implementing the fix. We are talking about testing it.

Are you really that stupid? Why don't YOU support a project that runs on millions of setups? Not doing that? Yeah.. thats right... you aren't.

You can't double up on testing man hours to double the speed of testing. Period. Don't be a moron.

Re:They did no evil

[Anonymous Coward]

Im sure his hotfix and one man testing matches MS's extensive testing. Seriously, do you think any company would just release this fix immediately without serious testing?

If it works for McAfee and their anti-virus updates, why not MS? It's not like MS hasn't borked machines with updates before....

Re:They did no evil

[flyingfsck]

Uhmmm, I don't get it. What do you mean by "Microsoft's extensive testing"?

Re:They did no evil

[Anonymous Coward]

Seriously, do you think any company would just release this fix immediately without serious testing?

Maybe not Microsoft, but McAfee sure would!

Re:They did no evil

[CAIMLAS]

Yep, absolutely.

The only thing this release indicates is that Microsoft does not, in fact, "support" their products to their EOL. XP isn't quite dead yet by Microsoft's terms, and millions still use it. Yet an evident non-trivial security problem with a provided hotfix does not get attention for a work week.

How's that support working out?

Re:They did no evil

[Shotgun]

If it is running on millions of setups, you most definitely can double up on testing man hours to double the speed of testing. You run it in parallel. I guess you really are that stupid.

Furthermore, you wouldn't test it on millions of setups, unless you also thought that you can't run different setups in parallel. You'd run it on a few dozen carefully chosen configurations is an automated test harness.

I do happen to work in QA, and we run developer hot fixes periodically. You don't have to run a whole test suite of the whole OS. Just a subset that entails the surrounding functionality. If they have to test the entirety of Windows to verify the validity of a fix to a minor protocol stack, then we now know why the Windows OS is a rickety piece of stink.

Re:They did no evil

[geekoid]

I've seen MS do exactly that, in fact I've seen them do worse. This is why a walked out the second my contract ended and refuse their multiple offers for employment.

I have no idea why people think that a large corporation is some perfect bastion of thought and reason. In my experience (25) years in the private sector, and (5) years i the public sector has taught me is:
Corporation have less oversight and behave far worse then people imagine.

IN fact, if you look at public sector financials records and compare then to private sector, private sector has for more waste and abuse.
It wouldn't surprise me at all if some over worked programmer whose boss only cared about getting something out no matter what just copied and pasted the code and called it good after about 3 hours of testing.

Re:They did no evil

[Rockoon]

Nobody said anything about testing it on millions of setups. You are one of the following: (a) so fucking stupid that you cant understand simple things (b) so naive about what testing entails that you can't make rational judgments about what people mean, or (c) being intentionally obtuse because you just got caught with your pants down talking about shit you dont understand

I'm going with (c), because everything else you have said also indicates that you dont know what you are talking about. You dont have any idea what goes on in a real testing cycle at a real company serving real mission critical clients.

Re:They did no evil

[Nyder]

Im sure his hotfix and one man testing matches MS's extensive testing. Seriously, do you think any company would just release this fix immediately without serious testing?

yes, I would expect MS to do exactly that.

Re:They did no evil

[Anonymous Coward]

Especially since the hotfix doesn't work . Deploying it would be completely irresponsible.

Re:They did no evil

[BikeHelmet]

Im sure his hotfix and one man testing matches MS's extensive testing.

It's for XP, so it probably exceeds it.

Judging by all the individuals on the MSFN forums that did Win2k hotfixes better than Microsoft, from 2006 on... and now all the people there fixing bugs in Microsoft's XP hotfixes... I'm guessing that one person can do better testing and fixes than Microsoft. And my guess is based on different individuals doing so hundreds of times.

Seriously, do you think any company would just release this fix immediately without serious testing?

No no, of course not...

and the response will be

[Spiked_Three]

I can't wait for Microsoft to release an exploit for gmail - surely no one will be bothered by an exploit that makes everyone's current and past email available?

Re:and the response will be

[Veyasu]

The difference here is that if Microsoft gives Google the same 5 days, they can have a patch ready in 5 minutes, and as soon as whatever testing they need done is finished, they can apply it to all their users right then and there.

Re:and the response will be

[frank_adrian314159]

an exploit for gmail

You mean other than Windows?

Re:and the response will be

[geekoid]

IF thye give Google 5 days before reporting it? bring it on.

Of course this wan't google, it was a google employee on his own time.

Another meaning for "Zero Day"

[Ancient_Hacker]

Dang, and here I'd al;ways assumed "Zero Day" meant the bug had been there since the day the software was released. Like the bug in the .BMP rasterizer, revealed in 2004, that had been there since Windows 3.0

Who manages the canonical definition of "Zero Day" ?

Re:Another meaning for "Zero Day"

[geekoid]

I do.

X-Day is the time from when the vendor knows about the bug, to the day the first exploit was found in the wild.

Missing from the summary

[Photo_Nut]

Missing from the summary is that not only are they documenting the exploit in detail, but they are also providing a hack to patch the hole.

The point of releasing this "Five day exploit" which has been vulnerable for 9 years now (XP was released in 2001) is to point out that Microsoft needs to do a better job responding to security threats and that the closed source model is less robust to these kinds of threats. Had this been open source, they could have simply issued a patch to a mailing list to close the hole.

No compiled software is safe from someone with the means and the motivation to modify it. Having the source code does not make it any easier or harder to exploit, but it does make it easier to patch exploits and allows for more people to examine the code for exploits.

Re:Missing from the summary

[Anonymous Coward]

Except the patch is not tested, does not work, and still leaves users vulnerable.

Please read the article before going off half cocked.

There have been numerous 5-10 year old serious bugs in open souce also. Your argument does not make closed or open source less robust than the other.

Re:Missing from the summary

[Anonymous Coward]

Did you RTFA? Sounds like you're jumping the gun, too.

He gave a definite workaround AND a hotfix for people who need the buggy feature. Don't use the hotfix, which he admits to being insufficient (read the full article, and his comments), just disable it like he suggests.

Re:Missing from the summary

[Anonymous Coward]

Also missing from the summary is that if you switched from IE6 to something else than IE, you're safe.

Re:Missing from the summary

[Anonymous Coward]

I would say at least a couple of weeks would have been better. Also MS is a huge company. So it takes a little time to get their attention. Hell sometimes you end up talking to the wrong group at first.

Firing off an email at 3pm on a saturday. Is not going to cause the kernel engineer that needs wake up and say 'i feel a disturbance in the force' or something. No, more than likely the guy who really needed to fix it was at home watching TV, or at a mall somewhere buying something, etc. SO the earliest it is going to be probably looked at is 9 to 10am PST. That is assuming it was triage properly yet, and a fix is well understood. Also 2 of those 'five days' was weekend when no one was going to look at it.

Oh btw XP is considered a critical testing thing if you didnt know. They do not want to slap off a patch that oh takes out half the XP installations on the planet (which they have done in the past). So they test it for a good month. In their huge automated test farms. Would you want say a half day of testing on something like that?

Now MS does *NOT* make it easy to send in bug reports. In fact they make it rather difficult. They do this because anytime any little thing gets a little bit wonky on someones computer they fire off an email to them. So they have built up some walls around it to sort thru the crazy volume they get.

I am not defending them. But people need to re-evaluate how to talk to MS. MS also needs to wake up and realize that *YES* there are people out there who will find bugs in their code and want it fixed, yesterday.

Re:Missing from the summary

[Anonymous Coward]

But the hack didn't work. Oops.

Re:Missing from the summary

[MrBulwark]

perhaps I am missing something, but how can the statement: Having the source code does not make it any easier or harder to exploit go along with: allows for more people to examine the code for exploits. If it is easiers to find exploits in, then that would make it easier to exploit? Quicker to fix exploits, maybe. But definately not the same as closed source.

Re:Missing from the summary

[Texodore]

I know that if I'm running Linux, I'm going to immediately take code off a mailing list, compile it in my kernel, and feel comfortable.

Had this been open source, everyone would wait for a patch just like they are from Microsoft. It will almost definitely be quicker, but the mailing list idea is just absurd.

Re:Missing from the summary

[Dan Ost]

Also MS is a huge company. So it takes a little time to get their attention.

It took him 5 days, but he found a way to get their attention.

In my opinion, if the vendor doesn't make any attempt to contact you after 1 work day, you should assume they're not going to do anything in a reasonable amount of time without their hand being forced. Going public is the best way to force their hand.

This guy waited 3 business days. It would have been charitable to give them 5 business days just to avoid even the appearance of impropriety, but he did the right thing: contact vendor, wait for evidence of a real response from the vendor, then go public when the vendor ignores you.

Re:Missing from the summary

[Anonymous Coward]

Missing from the summary is that not only are they documenting the exploit in detail, but they are also providing a hack to patch the hole.

Missing from your post is the minor detail that the patch doesn't work.

Re:Missing from the summary

[Anonymous Coward]

Except Microsoft did contact him after 0 business days, and 2 business days later he revealed the flaw. And he outright said that he had problems with "responsible disclosure". And his employer, which happens to be Google, has a published policy of responsible disclosure which their security team is supposed to follow: http://www.google.com/corporate/security.html.

The guy did:

1. Contact vendor with a broken binary patch on the weekend
2. Get a response in the same day
3. Fuck over the vendor Wednesday at lunchtime
4. Justify this by flagrantly mocking his own employer's published security disclosure policies

For a non-trivial patch to be developed on Monday, tested Tuesday, and distributed Wednesday is an optimistic schedule.

The guy's asking for trouble. Google can hardly not reprimand him now; it would be blatant hypocrisy and contrary to their published policies to do otherwise. It's one thing to have your opinion in the disclosure debate, and to disagree with your employer on that note. When you use your employer's resources for that, you are making the employer responsible unless they swiftly repudiate it. I'll give Google until monday morning, to make it even.

Re:Missing from the summary

[Dan Ost]

My reading was that he got an acknowledgment indicating that they "received his report". That's not a meaningful response. A meaningful response would have been someone who is capable of groking the issue emailing or even calling him to ask relevant questions and negotiate (yes, negotiate!) an amount of time to effect a patch before the details are made public.

The vendor is the one who needs to go the extra mile to convince the researcher that there is a net benefit to the users for delaying the publication of the bug (and exploit). The researcher has to balance the arguments of the vendor against the knowledge that every day that publication is delayed is another day that the users are completely vulnerable.

I applaud his actions

[hesaigo999ca]

Because he works for google and they will protect him, M$ can't use their massive amounts of money to sway him from talking or slap him with lawsuits....therefor the only thing to do is actually FIX THE BUG!....imagine we live in a world where when we tell a company their product is flawed and even offer a way to reproduce this bug, that they say thank you very much, and fix their product...right away....well I applaud his effort, and think that more people (from google) should all come out with these types of bugs to show that not only are we going to let everybody know about your bug and how to use it, but after giving you a small amount of time to fix it....so you might as well just swallow that pill, put on your coding caps and fix those bugs....

So many exploits come from M$ and have been around for so long that it is nice to see someone (other company) stand up for us and help bring about a safer web/internet for us to play in...

Grow up

[Shivetya]

Sorry, just because your arbitrary deadline has passed does not give you right to aid others in harming others computers.

Even the summary needs help here, I really get the impression of a bunch of immature know it all of which that developer who is one. Damn, if I didn't have to put up with this during with five year olds running around...

I warned you!!!! I warned you I was going to do it!!!! See its all your fault.

Re:Grow up

[samjam]

However he does have the right to provide others the information they need to secure (or evaluate retirement of) their computers.

Which is the same thing...

Re:Grow up

[nunojsilva]

Actually, if the manufacturer doesn't fix it by that time, maybe you're doing more harm if you help them hiding the vulnerability. Now people at least know it's there, and maybe even fix it, or at least workaround it.

If he didn't disclose, what would be the chances noone else found out about this same vulnerability? Well, some cracker could eventually find this and do bad things...

Except for script kiddies, XP is not less secure than it was before the disclose, it's only the false belief of security that looses.

Maybe this is indeed part of a war, but it's less than a Microsoft vs. Google war and more of a Security Through Obscurity vs. No Obscurity war.

Re:Grow up

[n0-0p]

You might want to pick a subject you know a little about before pontificating. Tavis Ormandy has reported dozens of critical security vulnerabilities to Microsoft and others. Just search for "Tavis Ormandy Windows kernel vulnerability" to get some of his top finds. And in these previous cases you can compare the report and disclosure dates to see that he's waited several months, or in some cases more than a year for the patch release. If you actually read Tavis' disclosure and note the trivial nature of this bug, you'll see that he just got sick of waiting on Microsoft's extremely long fix pipeline, and chose this as an opportunity to push back.

Now, I'm not saying I agree with Tavis' actions here, but the actual situation bears no resemblance to your uninformed framing.

Re:Grow up

[russotto]

Sorry, just because your arbitrary deadline has passed does not give you right to aid others in harming others computers.

You're right; the deadline has nothing to do with it. Anyone has every right to publicly release exploit information as soon as he or she discovers it, without informing anyone in advance.

As a practical matter, the policy your post implies -- that one should never publicly release exploit information -- has been tried. It usually results in the bug simply not being fixed.

Re:Grow up

[dave87656]

just because your arbitrary deadline has passed does not give you right to aid others in harming others computers.

MS created the bug, not the google researcher. He gave them five days to fix it. Who knows how long this bug has been letting hackers attack your system? Five days is long enough to fix it. MS just didn't take it seriously.

Re:Grow up

[Anonymous Coward]

Now, I'm not saying I agree with Tavis' actions here

Meh. Wuss. I agree fully with his actions. I have zero sympathy for Microsoft in this case. A company of that size and influence simply has a lot more responsibilities and they generally fail miserably in living up to them. It's fine for Microsoft being as big as it is, and if it can't take the heat and burden that comes with it, well, tough.

So yeah, go Tavis.

(I am not in any way affiliated with Google, Microsoft or anything even remotely related to either of them.)

Oh not the we're to big to fix it defense

[keirre23hu]

Right, they won't use the security researcher who found the bug that their "evolved" process missed... And that's why Microsoft has such a great and well deserved reputation for producing secure products. Internet Explorer, SQL Server, IIS, the Active X framework, every version of Windows OS before 2008/Seven. Firefox has been a terribly insecure product, but they do make timely efforts to fix the bugs when they are discovered. For me, that counts for something. I don't want to be an open source zealot, but how is it that a multi-billion dollar software company cannot even issue an advisory in 5 days, but groups loosely knitted groups of 3rd party funded engineers and volunteers can?

Imagine if that argument were applied elsewhere.

"Yes ma'am we received your 9-11 call about a house fire, but our city government is so large that we'll need to send a team out to verify there is smoke and heat and that a fire truck is warranted before the actual fire truck can be dispatched"

Re:Oh not the we're to big to fix it defense

[VGPowerlord]

You are aware that said code was submitted to Microsoft by someone who works for what is currently Microsoft's biggest competitor, whom they are currently in a 3-front war with (Browser, Search Engine, Netbook OS)?

This is a moot point, though: Google could later claim copyright over said code and sue Microsoft over it. Something that doesn't apply to your fire analogy.

Re:Oh not the we're to big to fix it defense

[Nerdfest]

The way the ridiculous software patents work, don't they have a problem anyway if this guy is rude and patents the solution? Seems to me that software patents are currently of the form "I've patented all solutions to the following software problem", regardless of whether the implementation of the solution is different. Theoretically they would need to license the fix. Wouldn't that be a nice wake-up call to the industry? I am probably just dreaming/misinterpreting things, but it's interesting to consider.

Re:Oh not the we're to big to fix it defense

[DeadDecoy]

Just to be a little pedantic here, the GP said that Google might copyright their exploit, not patent it. Source code and the like are actually valid targets for copyright protection and can still incur a tidy sum of legal fees. The copyright restrictions would ultimately slow down MS as they couldn't legally use or copy the third-party's code (if there was code involved) to break their system and do subsequent testing on it. They can however write their own code to break their system in the same-ish way, do regression testing on that, and release a fix.

Re:Oh not the we're to big to fix it defense

[Nerdfest]

Yes, and I said "If he is rude and patents it" , as patents are the mechanisms that cause trouble. If he copyrighted it, they can't use exactly that code, but can still create a solution. If he patents the solution to a specific problem, people can't create their own solutions, even if they're slightly different. It's all irrelevant anyway. He didn't patent it, and he gave them the code under GPL licence. Software patents still suck of course.

Re:Oh not the we're to big to fix it defense

[Anonymous Coward]

s/Netbook OS/Mobile phone OS/

Google haven't released their netbook OS yet, so I don't think it should be counted as competition to Microsoft products, yet. But they do both have mobile phone OSes.

Re:Oh not the we're to big to fix it defense

[marcosdumay]

Well, there are plenty of countries where Google could sue Microsoft for using that code... But on any country that I've looked at, doing what you said would be a crime and would get no money to Google.

Zero-day?

[AlgorithMan]

A Google engineer [published] a zero-day vulnerability in Windows XP
just five days after it was reported to Microsoft

maybe you should look up what "zero-day" means...

8 yro Linux Kernel exploit

[kervin]

The point of releasing this "Five day exploit" which has been vulnerable for 9 years now (XP was released in 2001) is to point out that Microsoft needs to do a better job responding to security threats and that the closed source model is less robust to these kinds of threats.

Um sure....

Bug exposes eight years of Linux kernel

Linux developers have issued a critical update for the open-source OS after researchers uncovered a vulnerability in its kernel that puts most versions built in the past eight years at risk of complete takeover.

Re:8 yro Linux Kernel exploit

[Anonymous Coward]

He's not arguing that it was vulnerable in XP for 9 years, he's arguing that they're taking a long time to come up with a fix and then holding off until their monthly update to propagate the fix. Looking into the Git repository shows that the bug was fixed the day it was reported and that Linus tagged the tree that day. Given the distro's backport kernel fixes (especially severe ones) to more stable kernels within a few days, the fix was likely seeing user's PCs in a matter of days, not a month or two compared to the Windows update cycle.

Re:8 yro Linux Kernel exploit

[columbus]

Thanks for the linux bug reference. I noticed a couple of things.

Both the linux kernel null pointer dereference bug & the malformed character escape bug we're discussing today were reported by the same guy: Tavis Ormandy. I think that this refutes the claim that a few people are making that today's incident is just an attempt by google to sabotage microsoft. It seems to me like this guy is disclosing vulnerabilities wherever he finds them and letting the chips fall where they may.

Also, the linux bug is one that can allow local privilege escallation. It's bad & needed to be fixed, but an attacker would have to have access to the system first. The windows bug is one that will allow remote code execution; that's why we have botnets. I'm just sayin'

Re:8 yro Linux Kernel exploit

[Anonymous Coward]

Um sure....

Some observations about this bug:

1. Same guy, Tavis Ormandy, found both the Windows exploit and the linux kernel bug.
2. Kernel bug was a local exploit. Windows bug is remote exploit.
3. The kernel bug was publicly reported on 2009/08/13 and the fix had already been committed by Linus. I don't know when it was privately reported.

Re:8 yro Linux Kernel exploit

[geekoid]

He is talking about response to security threats in that statment, and he is correct.

No one is saying there haven't been any long standing security threats that have gone unnoticed.

Nice try, but your zealotry seemed to have over ridden your thinking capacity.

Re:8 yro Linux Kernel exploit

[selven]

Bug exposes eight years of Linux kernel

Linux developers have issued a critical update for the open-source OS after researchers uncovered a vulnerability in its kernel that puts most versions built in the past eight years at risk of complete takeover.

Well, if you want to play that game...

Weird

[ledow]

It's a bit of a crappy and unreliable exploit to say the least.

For some reason, my up-to-date Opera on XP SP2 just executes VideoLAN to load a (non-existent) JPG instead of the supposed WMP execution -> vulnerability trick that IE is vulnerable to. VLC then just errors out because the hcp:// protocol is obviously nonsense to it. I assume my copy of VLC is somehow associated with opening unknown protocols in Opera.

And in the IE case, WMP executes and then ZoneAlarm (ancient version) pops up and asks if I want Windows Media Player to access the local network. Twice. If I Deny, nothing happens. If I allow (both times), Windows Help and Support Center opens and then another ZA popup asks me to give permission for that too (and that says "Internet" rather than local, which would be blocked by default). If I allow that too, I get a copy of Windows Help and Support Center with a search for the nonsense page and not much else. "Computer Information for \\eval(unescape('Run("calc.exe")'))" is what's literally written inside it, and calc doesn't execute.

My IE, WMP, ZA and Windows Updates on this machine are NOT up to date by any means. The only thing that's up-to-date is Opera. Nothing untoward would have happened under normal usage. So it seems of dubious use at best, it's not a particular killer of a vulnerability.

However, the technical analysis was quite interesting and the problem basically stems from shitty programming at every level - not checking return values that indicate failure, continuing on and then passing arbitrary (and unescaped) strings to other functions, a cross-site scripting error within the Windows Help internals (due to insufficient escaping of data), allowing script execution to happen again on dynamically-generated script code because someone tagged "defer" (a Microsoft-only invention) to a script tag, and finally a way to avoid a security-related prompt on versions of IE, Firefox and Chrome by hiding the very same code inside an iFrame / Object which executes WMP. It's like a catalogue of errors, some of which have been previously reported and well-known for ages. It's just crap all the way down to actual execution of anything you like using wscript. And that's present in XP - a 9-year-old operating system with millions of deployments, Server 2003 and probably a lot of others using non-ancient version of IE, WMP, etc.

Stop whinging Microsoft, and fix this crap. That's been in the OS that millions of people used for **years**, after all your patching and service packs, and you never even spotted it, even when you were the only people with the code to the damn thing. I'm not saying it's easy or you should find everything, but FFS - the problems there just show crappy programming and patchwork all the way to the OS core. That "defer" thing just REEKS of someone saying "But I need a way to bodge this...". Whether it's responsible disclosure or not - fix it first, whinge about their methods later. Where's my response saying when you'll fix it? Where's the estimated patch release date? Where's the hotfix? When you've put those out, you can whinge about them being irresponsible with security. And then they can say "But we're one of your main competitors!" and laugh at you, the same way you would if one of your researchers found a major bug in Google's websites / OS / browser.

Re:Weird

[Pentium100]

Yea, I tried the exploit code and link too, but it did not work on Windows XP SP3 with IE6 (don't use it, so why would I update it?) or Windows 2003 with IE7.

Re:Weird

[tweak13]

Both the test links worked for me on several different machines at work. The windows media version does give the popup asking for permission, but the wording doesn't make it seem threatening at all. The second link has no such warning though. We're running a fully up to date XP SP3 and IE8.

didn't even give 5 days...

[kervin]

So the industry decided that 5-7 days after letting a vendor know about a problem that everyone would release the information so that everyone would know about rather than just the bad guys and so system admins would know to watch for that type of attack and force the vendor to fix it in a timely manner.

Except he doesn't give 5 days. This guy minimizes the amount of time Microsoft has to respond to the issue while trying to stay in the 5 day window.

1. First he could have given more than 5 days, ie. at least a week. He chooses 5 days.
2. He chooses the worst possible day of the entire week to report the bug. Saturday. Even Sunday would have been better, since have the weekend is gone. Also it would be easier to get a bigger emergency team on this the following day.
3. After all this he reports the bug, first thing on the 5 day!

This just shows how dirty the IT fighting has become ( not that it was ever civil ). And as many have pointed out, even if you don't like Microsoft this affects the XP and 2003 Server users the most.

he got a response

[kervin]

Sorry, but did you read the article? He got an immediate response.

This guy is clearly trying to meet the 5 day minimum only. Who reports a bug on a Saturday, then goes public first thing the morning of the 5th day?

Does Google Have a Double Standard on Full Disclosure?

Re:he got a response

[Nyder]

Sorry, but did you read the article? He got an immediate response.

This guy is clearly trying to meet the 5 day minimum only. Who reports a bug on a Saturday, then goes public first thing the morning of the 5th day?

Does Google Have a Double Standard on Full Disclosure?

You know alot of business's use the 5 day rule.

You have 5 days to respond to this, etc.

Or like the electric companies, "7 day disconnect notice".

companies don't let you slide, why should be let companies slide?

Re:he got a response

[bigngamer92]

Its not like he released it on Wednesday or Thursday, which would have prevented MSFT from having something on Patch Tuesday.

That's the most misleading part of this story

[n0-0p]

This issue has absolutely nothing to do with Google. Google has a strict policy that what you do on your own time and dime is yours. That's why they have a lot of really good security people there who all conduct independent research that's completely unaffiliated with Google. So, to be very clear, Tavis did this entirely on his own. MS mis-framing it as Google (and Slashdot buying it hook line and sinker) is just a smokescreen. Sorry, but you've been suckered.

Silly Google

[scorp1us]

Do this AFTER you release Chrom[ium] OS. Then users have something to defect to...

More MS lies and FUD

[Anonymous Coward]

Don't listen to the lies and FUD.
Why do papers insist on printing what MS spokesmen say without the qualifiers?
Note: MS spokesmen are widely known to be both flat-out liars and unabashed FUD machines.

People need to get their facts straight please. Microsoft DOES sit on known issues.
http://www.theregister.co.uk/2010/01/22/aurora_exploit_known_months/
That is just one example of many....

In this case the specific Google engineer discovered a bug, built PoC code to ensure that it existed, and notified Microsoft.

If Microsoft would do its own stinking job and build secure code to begin with, this would not happen. If they checked out their own code, this would not happen. But when independent researchers take the time and effort to do Microsoft's QA work for them, and provide them the information....we get nothing but whining about how they weren't given 'adequate time'. You had the months and years you planned the product release. You had all of the time since the product release. You had 5 days, and probably more, since the engineer was kind enough to provide a detailed description and PoC FREE OF CHARGE. Stop your stinking whining and fix the freaking problem. btw, thanks for doing QA work Google. Some of us appreciate it.

Re: Pot meet kettle.

[complete loony]

And yet how many times has microsoft "fixed" a vulnerability by band-aiding over *one* instance of an exploit while leaving many other related attack vectors wide open?

Hansen is a Microsoftie

[Anonymous Coward]

"Google can't have its cake and eat it, too," said Robert Hansen, the CEO of SecTheory .. Hansen, who acknowledged that he has worked for Microsoft as a security consultant on several projects, weighed in again. "The whole thing rubbed me the wrong way," he said.

And for us jr admins?

[Anonymous Coward]

How do we disable a protocol handler in WinXP?

Tried Googling it, but just got links to security alerts suggesting disabling other handlers.

Google engineer Thursday?

[IBBoard]

Huh what now?

A Google engineer Thursday published attack code...

That's one very clever Thursday to go publishing attack code. And, even better, it appears to be a special Google Engineer flavour of one!

Re:Google engineer Thursday?

[geekoid]

Who is going to be here?
Thursday?
He'll be here Thursday?
Why are you asking me, Do I look like Thursday?

and so on.

Bingo

[Kludge]

I was not bothered at all because I do not use Microsoft products and have not for 14 years.

is slashdot a decent source of info?

[Anonymous Coward]

with all the bs fanbois post and the unbelievably naive opinions?

Users?

[Anonymous Coward]

When the users are tired of being damaged because they made a bad choice in products, perhaps they will suck up and make a better choice - same goes double, maybe treble, for administrators, who should know better.

Hate has nothing to do with calling someone a stubborn fool for repeatedly buying something that burns them.

People still use IE?

[MacGyver2210]

/*
You can test this with a command like so (assuming a recent IE):

C:\> ver
Microsoft Windows XP [Version 5.1.2600]
C:\> c:\windows\pchealth\helpctr\binaries\helpctr.exe -url "hcp://system/sysinfo/sysinfomain.htm?svr=<script
defer>eval(unescape('Run%28%22calc.exe%22%29'))</script>"

*/

So that did nothing for me, even with no recent updates in weeks.

Could this mean that when Firefox is set as the default browser and IE is old and unused, this bug is ineffective? I don't think I've used IE in at least 5 years.

Re:People still use IE?

[tweak13]

I believe what you posted is only a portion of the exploit. There are two test links provided later, using two different methods to try to launch calc. Did you try those links? Both worked for me, so I'm already looking into disabling it on our work machines.

Sympathy???

[baomike]

I find it very hard to generate much sympathy for MSFT.
Gee, someone played a dirty trick on them.

While it wasn't nice of Google , I hope they don't stop.

Poor Communication Skills, Poor Triage

[Anonymous Coward]

I suggest it is poor communication is to blame.

Did they just email back 'Thank you for your ... your ticket number is 936473'. Chances are their help desks resemble other non-technical help desks staffed by droids.

For the amount of revenue MS gets they should say things like
1) Its logged.
2) Rank the person who reported it - easy to spot a technically good report. Recognized names
3) Within 48 hours tell the person who reported it is confirmed, and ranks whatever on their priority scale - or ask for clarification.
4) say why the fix cant go out now
5) Within 4 days, clearly say what MS is going to DO.

Sorry, give lots of feedback for people who spot buts and provide solutions.

6) Send Beer/Pizza T-Shirt to person who reported it.

None of this arrogant - we'll decide when, if and in our own sweet time , what we are going to do business.

Re:Poor Communication Skills, Poor Triage

[perryizgr8]

i'll complete it.
7) ???
8) Profit!

Re:Poor Communication Skills, Poor Triage

[delinear]

Spot on, it seems like the main reason he released the details of this so quickly is that he's reported issues and exploits in the past which have gone unfixed for many months. A company with such a bad reputation for exactly this kind of thing should be going out of their way to make sure exploits are reported to them immediately and that they let the reporters know what an important job they're doing and how MS are handling the situation. Sometimes I guess the impression MS are actually happy with their reputation for lax security - it wouldn't surprise me to learn that they did a cost/benefit analysis of being seen as insecure (and losing some sales because of that) vs. spending money to be seen as secure (and gaining sales accordingly) and just came to the conclusion, "screw it, it's not worth the money".

Google?

[Anonymous Coward]

"Finally, a reminder that this documents contains my own opinions, I do not speak for or represent anyone but myself."

Talk about hyping Google vs Microsoft

Don't Be Evil, huh?

[kriston]

"You can make money without doing evil."
Really?
How's that working out for you?

http://www.google.com/intl/en/corporate/tenthings.html

And this prevents them from releasing an ADVISORY?

[keirre23hu]

Lots of focus on the badness of applying the hotfix... granted this is a valid concern what gets broken by issuing an advisory about the bug? Its not like Microsoft never had a security advisory issued before about some obscure "feature" noone uses.

expect chrome exploits now

[Anonymous Coward]

immediately as a response

cyber war betwen corporations

cool
i want movie rights

The cosmogonical definition is

[ClosedSource]

A vulnerability that existed before the universe existed.

Although irrelevant to this discussion

[ClosedSource]

Your anti-MS post has been duly noted and your AMS points now stand at 1500. 100 more points and you're eligible for the full-size Bill Gates as Borg poster.

Re:Although irrelevant to this discussion

[BikeHelmet]

What anti-MS post?

Successfully not using Windows makes you a troll and/or Microsoft hater? Get a life.

I found it informative that even as far as a decade and a half back, there's people out there that found solutions. That's pre-OSX, so I'm guessing he's been using various linux distros, which I'd like to find out more about. We all know of Ubuntu - but what did people do 14 years ago, when there seemingly were no full-featured alternatives?

Re:Although irrelevant to this discussion

[ClosedSource]

"What anti-MS post?

Successfully not using Windows makes you a troll and/or Microsoft hater?"

No, but bringing it up out of the blue does. If the topic under discussion was "how long have you been MS free?" it would make sense.

No sympathy.

[Dashiva Dan]

Sure, it may have been a little childish to release the information.
His stated reason of 'forcing microsoft to fix it' as they would 'otherwise ignore it' is hard for me to disagree with, however, it's nice to see MS get served. Perhaps if this happened often enough they'd start releasing better software, although Win & so far seems to be showing they are moving in that direction.
Also, he did release a patch with it, and the real question to me is if he knew his patch was flawed or not. As a software developer, I'm willing to give him the benefit of the doubt on that one.

I like the idea of using zero-days to put developers under the gun for their mistakes.

There is nothing to sue over

[axl917]

Please, get over yourself.

Fortunately, just like in that case, MS was ...

[daboochmeister]

... able to issue a simple SELinux profile fix, the same day, that slapped the exploit around the room like a silly little girl, and also fix the kernel and put it out in the repositories the next day, and ... what? Microsoft doesn't have any SELinux like protection mechanism?? Updates take a MONTH or more???

Probably not the orange you wanted to compare to his apple. He wasn't saying that it having been there for years was the issue, but that them not being able to rapidly roll out protections or a fix is the issue. 5 days is an eternity.

Would of? What does that mean?

[gumpish]

I would of released it

"Would've" might sound like "would of", but as the ve indicate, it is a contraction for WOULD HAVE.

More importantly, it makes sense for someone TO HAVE DONE something.

It does not make sense for someone TO OF DONE something.

I doubt it

[mozkill]

Is this an exploit that Norton Antivirus (for example) is unable to protect you from? So, for persons with antivirus software and internet security software, do they still need to be afraid of injected malware without being detected? I doubt it.

Re: Pot meet kettle.

[Blakey Rat]

And yet how many times has microsoft "fixed" a vulnerability by band-aiding over *one* instance of an exploit while leaving many other related attack vectors wide open?

As far as I know, zero.

Why don't you put your money where your mouth is and show otherwise?

Squeaky Wheel...

[Anonymous Coward]

It's highly probable that this bug will get fixed, unlike the who-knows-how-many others which languish in the "pipeline" to get fixed. With Microsoft's cash on hand they can easily assign teams to give much better turn around. Five days does not seem out of the question considering their resources.

I am Tavis Ormandy. I am from Google. And fixing XP was my idea.

Bzzt! Thanks for playing.

[Gary W. Longsine]

You assumed incorrectly.

Not a man-month problem

[DrYak]

The book you point out is based on the principle that you can't accelerate a project by throwing more people at it, because :
- these new comers will need to get trained (takes lots of time, resource and slows down the rest of the veteran team who now have to train in addition to develop)
- the bigger the group, the bigger the communication problems.

What we wanted to point out is that, as a seller of paid-for software who has significant monetary resources (and who regularily points out in its marketing material that paid-for software is supposed to have better support because it is paid for), microsoft is probably already having a huge team with already lots of man-power, already trained for their job, and already using a more or less efficient communication method. These team *should* have the resource to analyse the threat and respond accordingly, specially given the fact that the bug is not only well documented, but that the guy even provided his own fix as an example. They *should* have been able to analyse and test this and deploy an official fix within 5 days.

We are not advocating hiring more coders (which would have failed due to the man-month problems). We are wondering why microsoft didn't put at work the teams THEY ALREADY HAD and which ARE SUPPOSED TO DO EXACTLY THAT (which should theoretically succeed given that these teams are supposed to be good at that work)

This story will make money for Microsoft.

[Anonymous Coward]

Wow!! Can I get a poster, too? Here's my contribution:

This story will make money for Microsoft, by getting people to buy Windows 7.

Windows 7, in my opinion, is sloppy. The right thing is to wait for at least service pack 2.

Anyone ever consider...

[Anonymous Coward]

that this bug is most likely known by most private "black-hat" operations whose sole revenue is derived from illegal covert IT intrusion operations? I think a small fire under MSFT ass is a good thing. I am sure there were many people out there that used this vulnerability that are now a little pissed off that a useful "tool" of theirs will soon be patched. Just my 2 cents.

Cheers.

New signatures

[xororand]

Unless you are running a well-designed web proxy that filters active content, chances are pretty high that someone has already created an undetected piece of malware for targeted attacks. The heuristic detection of anti-virus products is obviously beatable because otherwise the vendors wouldn't need to update any malware signatures. Malware heuristics have to work in a rather conservative way if you don't want to get false positives all the time. Quite a number of useful applications share characteristics with viruses or malware.

1. Copy protection & DRM schemes:
Copy protection is probably the most vicious "useful" software that doesn't trigger anti-virus heuristics. Some of those programs lurk deep inside the operating system, using drivers, encrypted binaries, self-modifying code, anti-debugging techniques.

2. Debuggers - can attach themselves to running programs, modifying data & code.

3. Game recorders. 3D video recording software "injects" code into the running game executable or hooks system calls to intercept OpenGL/DirectX rendering functions. Malware might attach itself to a windows system process using the same or similar techniques.

As you, as an anti-virus vendor, don't want to annoy the users with false positives of any of the aforementioned applications, it becomes clear that there are most likely a lot of ways to circumvent the heuristics.

--
Not related to your post but the topic:

I for one know about one large corporation that still uses thousands of Windows XP(-32) machines with Internet Explorer as the only allowed browser. They do force all traffic through a web proxy that filters quite aggressively but naturally leaves all HTTPS traffic unchecked. Once you know what anti-virus solution they're using, NOD32 in this particular case, it's most likely very easy to get into their network until Microsoft publishes a fix for this problem.