Slashdot Mirror
Microsoft Makes Major Shift In Disclosure Policy
Trailrunner7 writes "Microsoft is changing the way in which it handles vulnerability disclosures, now moving to a model it calls coordinated vulnerability disclosure, in which the researcher and the vendor work together to verify a vulnerability and allow ample time for a patch. However, the new philosophy also recognizes that if there are attacks already happening, it may be necessary to release details of the flaw even before a patch is ready. The new CVD strategy relies on researchers to report vulnerabilities either directly to a vendor or to a trusted third party, such as a CERT-CC, who will then report it to the vendor. The finder and the vendor would then try to agree on a disclosure timeline and work from there." Here's Microsoft's announcement of the new strategy.
In response to the second step in the Coordinated Vulnerability Disclosure ("Step 2: Hurry Up and Wait"), I've printed several copies of the CVD on quadruple ply tissue paper and stocked all the restrooms with it. I've also prepared a special four course meal for Mr. Ormandy consisting of Taco Bell, a cup of coffee, a cigarette and a spoonful of castor oil.
Mr. Ormandy, I think you know what to do. I really found it amusing that they called the blog posting "Bringing Balance to the Force" when it looks to be completely defined by Microsoft with little or no input from the community.
My work here is dung.
Why would anyone report a vulnerability to Microsoft? Unless they start paying for the info, I say post it online the second you find it and to hell with Microsoft.
I guess they achieved their ends and I wonder if Microsoft will be collaborating with the MSRC in the future. :rolleyes
Just disrupt the deflector shield with a tachyon burst.
Looks like Google's policy announcement from July 20 rattled some MS cages.
God is imaginary
What is the researcher's motivation to spend the extra time working with Microsoft? They certainly have no obligation to do anything Microsoft asks...
Personally, I prefer the Google and Mozilla method whereby researchers are paid a bounty of a few thousand dollars for reporting vulnerabilities in the manner the vendor prefers. Microsoft would be wise to follow the leaders rather than invent their own convoluted process.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
So they are formalizing common sense into a policy.
It is a lot better than the previous formal policy of bat-shit crazy.
"You want to know how to help your kids? Leave them the fuck alone." -George Carlin
I've never discovered a vulnerability in Windows or anything else, but if I did I'd be fine to sit it for as long as needed, as long as Microsoft got back to me and said "Yeah, we're working on it, here's when you can expect a fix." What's maddening (and actually Microsoft seems to be good about this, it's Apple and Oracle that are the worst offenders) is when someone sends a bug report into a black hole, never hearing anything from the company for months and months. At that point, I see no reason why the researcher shouldn't just publish to the world. The company clearly doesn't take security seriously, why should he?
Dislike the Electoral College? Lobby your state to join the National Popular Vote Interstate Compact.
"Same old sh_t, different day."
ELOI, ELOI, LAMA SABACHTHANI!?
Posting anonymously for obvious reasons. What happens today if one emails Apple's product security team (product-security@apple.com)? A few things. First, you get a generic pre-generated email that acknowledges that Apple received your email. Next, if you're lucky, you get an email from an analyst who has reviewed your vulnerability. What happens next? 1) No updates are provided. Ever. 2) If you ask for an update as to when the vulnerability will be fixed, you will not get a detailed response. 3) Apple waits several months. 4) Apple waits several months. 5) Apple fixes the bug, possibly. 6) You get an email from Apple asking how you want to be credited. 7) If you're lucky, Apple will send you an email with notification on when they're planning to fix the issue, along with the exact wording of the specific advisory. 8) If you're lucky, Apple will fix the advisory in the week they say they will. 9) Normally, the date will slip a few weeks. Or maybe a month. I applaud Microsoft for doing this. Hopefully Apple will follow suit and move out from the stone ages.
Personally, I prefer the Google and Mozilla method whereby researchers are paid a bounty of a few thousand dollars for reporting vulnerabilities in the manner the vendor prefers. Microsoft would be wise to follow the leaders rather than invent their own convoluted process.
There's a fundamental problem with your comparisons. When a security bug is released in Firefox you see the Mozilla Foundation marvel at the cleverness of the attack. Then a distributed net of individuals quickly work together in an agile way to get the hotfix out and then sometime is spent testing and hardening that fix. When a security bug is released targeting Chrome or any of Google's products, you see Google developers that are comfortable on their campuses swing long hours and work together to push out a fix as quickly as possible. These are all sensible approaches to security bugs.
...
...
With Microsoft, however, you see the heavy thudding of a big corporation. You see a complex inner working of management slow things down. Somebody might ask for an estimate on how much money this is going to cost and that estimate comes back a week later. Senior management starts shredding documents. Engineers start falling from helicopters in Redmond. A tornado of chairs leaves several injured. Microsoft's campus looks like the superdome following Katrina. People are chained to their desks. The reason they ask for 60 days is because that's how long it takes FEMA aid to reach Microsoft
You just can't compare the two
About time...
Personally I think it would be wise for all large companies to maybe setup a standardized email something like exploit@company.com that is manned by someone some level of management, not some script reading help desk jockey.
Finder of an exploit can send to this address giving the company 1 week to acknowledge receipt of the information and that they are looking into it.
If they respond within that 1 week time period then it starts the clock on a 90day countdown to full disclosure.
Within 1 week of acknowledgment of receipt of the exploit, which should be enough time to evaluate the exploit the company needs to at least release work around steps for customers to protect themselves, ie ports that should be blocked at a firewall, non critical services that can be stopped, etc as long has it offers some level of protection to the customer without breaking core functionality of the software or releasing info on the full exploit
Within 1 month of acknowledgment of receipt of the exploit the company should provide the finder of the exploit with a preliminary patch under NDA if need be, this obviously doesn't have to be ready for shipping, nor go though tons of testing. but it would at least let the finder apply it to a test system to see that they are actually working on a patch.
If a preliminary patch isn't given in the 1 month window then the exploit can be fully disclosed.
If followed This would give the company a month to make the patch and then a further 2 months to do any kind of regression testing before shipping to customers
If not followed, then there are 2 scenarios. If they don't even acknowledge receipt of the exploit then full disclosure in a week. If they do acknowledge receipt but don't provide a preliminary patch in a month then full disclosure in a month
The title I read was Microsoft Takes Major Shit on Disclosure Policy
If I happened to run across a vulnerability tomorrow I might be inclined and would likely publish it that very day. Microsoft assumes I care for the well being of them and their customers when really I don't. I know this is aimed more at security researchers but then again they may very well feel the same way.
Got Code?
Here's a radical idea: How's about they don't release code tons of fresh code every cycle, and instead maybe check the code over first for buffer overflows, NULL pointer abuse, heap munging, and all the other obvious ways of executing code?
Just sayin'
OSS: find a bug, fix it (because you can), submit code changes
CSS: find a bug, see a lawyer, contact a CERT, wait several weeks for a response, sign an NDA, share vulnerability informations, wait 2 months, ask for status, wait for an answer for 4 more months, realize that the vendor will do squat about the vulnerability as long as his customers don't know how threatened they are, release the infos to the public to put pressure on the vendor, be threatened by the vendors lawyers, be called a criminal by the vendors customers and the press and politics, have a house-search, wait 2 more months, get patch, realize that it doesn't fix the problem, rinse and repeat
The MAFIAA is a bunch of mindless jerks who will be the first up against the wall when the revolution comes
I am very curious how Microsoft defines "ample time" especially considering some of their vulnerabilities (like the one recently "patched" in the DOS subsystem) have existed for years or decades.
This isn't a slam at Microsoft, it's a hope that someone has some clarification that can be used as a context to determine if this statement means anything. Even when the terms of their statements are less ambiguous, they seem to find ways of backpedalling - thus greater clarity on something so very ambiguous is warranted (even if it turns out to be pointless in the long run per whatever practices they actually employ).
Oh wait, the summary is not correct (of course) - but the reality of the statement is worse:
Microsoft:
CVD's core principles are simple: vendors and finders need to work closely toward a resolution; extensive efforts should be made to make a timely response; and only in the event of active attacks is public disclosure, focused on mitigations and workarounds, likely the best course of action -- and even then it should be coordinated as closely as possible.
Inotherwords, this statement really says "You should never tell anyone but us, unless active attacks are taking place - but even then, you should coordinate such with us" (at which point, they will probably say "dont tell anyone" as has been the current and previous cases.
Also, who are they to dictate how (and to who) researchers disclose such information? Is there some legal basis for this, or is (will) it be under the threat of using their financial muscle and influence to try to get the person charged with some sort of online security or terrorist crime? Yes... for those who don't know, the Patriot Act does indeed cover such things.
Additionally, the spin group at Microsoft said this, which is misleading in the grand context of this problem:
Microsoft:
However, we fundamentally believe (and our experience over the last 10 years has shown) that once vulnerability details are released publicly, the probability of exploitation rises significantly. Without coordination in place to provide a security update or tested workarounds, risk to customers is greatly amplified.
The truth is, once a vulnerability is released to the public and exploited, Microsoft is somewhat forced to fix it in a more timely fashion - as opposed to ignoring it for years (the numerous .NET exploits that still aren't fully patched) or decades (the DOS exploit recently patched).
This is really a non-news item as this is business as usual, carefully worded to seem like Microsoft is changing their stance on things (while the reality is, they are not).
StarTrekPhase2 - The Five Year Mission Continues!
"[CVD] is the same thing as responsible disclosure, just renamed," repeated Reavey. "When folks use charged words, a lot of the focus then is on the disclosure, and not on the problem at hand, which is to make sure customers are protected, and that attacks are not amplified."
http://www.computerworld.com/s/article/9179546/Drop_responsible_from_bug_disclosures_Microsoft_urges
I still haven't gotten anything but the automated emails from them from a kernel privilege escalation bug I found in Snow Leopard. It's been about a month now.
Sometimes it's tempting to go put the bug on a blog somewhere.
Here dude, I think you dropped your swastika.
I'm certain a properly set up SELinux system is still miles more secure than Windows 7, - by agrif (960591) writes: on Thursday July 22, @04:44PM (#32995662) Homepage
Per my subject-line above, your quote, and the results in this URL (which uses the multiplatform CIS Tool as its security performance gauge), your "surety" will be shaken ("not stirred") badly -> http://forums.theplanet.com/index.php?showtopic=89123
Linux machines are often the servers that have everyone's credit card numbers, trade/military/government secrets, massive processing power and commercial-grade Internet connections, VoIP servers, and all the other real goodies. Each Linux machine is a potential Fort Knox in a world of 7/11s.
And even though these are the minority these days with most Linux machines being home PCs and geek tinker toys, if any Linux machine is accessible from the Internet on port 22 it will be hit with ssh brute force attempts 24/7/365 - because that's typically the easiest way to break into one. To brute force a password.
There's no lack of interest or effort, just a lack of success. What does that tell you?
"When information is power, privacy is freedom" - Jah-Wren Ryel