Slashdot Mirror
MS Asks Google To Delay Fuzzer Tool
eldavojohn writes "Polish Google security white hat Michal Zalewski has announced concerns that one of a hundred vulnerabilities his fuzzer tool found in IE is well known to third party hackers in China. His simple explanation provides an interesting counter argument to Microsoft's usual request that security problems not be released until they can slowly investigate them. From the article, 'Microsoft asked Zalewski to delay cross_fuzz's release, but he declined, in part because of his fear the IE vulnerability was already being explored by Chinese hackers, but also because the company's security experts had not responded to information he provided.' You can read about and download cross_fuzz for your own use."
Microsoft is the last among browser makers to react to the vulnerability. Everybody else has released patches to address some, if not all of the holes.
Seems the IE team is so small, they can only do is development on IE9; perhaps there is no other team. Maybe they're all working to make the latest Windows Mobile platform a rousing success.
Its a much slower, conservative company now that Bill Gates has left. And I don't mean that in a good way.
I wonder if this tool will work on other browsers as well?
Free Martian Whores!
When is someone going to DO something about the possibly government sponsored hacking taking place in China? It ought to be brought up at the UN, or trade meetings, or SOMETHING! If the Chinese government won't stop it, we need to cut them off.
MS believes in security through ignorance, since it makes them money. As long as the common users don't know that their machines are infiltrated, stealing their bank information and sending spam, they are happy, since at worst, they will think their machine is worn out and slow and then go out and buy a new one, chock full of new versions of MS software.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
http://it.slashdot.org/story/11/01/01/2142202/Security-Researcher-Finds-Hundreds-of-Browser-Bugs
Last year I attended a conference where one of the talks was about browser security. The speaker demonstrated how easy it was to gain access to someone's PC when the machine was being specifically targeted. Some of the things he did:
1) Set up a rogue access point with open access and SSID name similar to the venue..
2) Set up a rogue DNS.
3) Set up a redirect page that installed demo software...
One of the things he mentioned was that if you are being targeted specifically, your system will likely be compromised. If you are not targeted specifically, it's trivially easy to find machines that can automatically be compromised.
Adding any apps increasing your exposure.
The number of unpatched vulnerabilities is staggering and it's only a numbers game when a slew of machines are needed.
If it wasn't being exploited by Chinese hackers before it's going to be exploited now!
"We consider all Mr. Zalewski claims invalid. Obviously he didn't contact Security Experts for IE in reality just like you cannot contact Santa".
839*929
Didn't work for me until I turned off the 'block pop-up windows' in Tools-Options-Content.
So I'll keep that window pop-up blocker turned on I guess.
You can't handle the truth.
The summary made it sound like IE had 100 vulnerabilities, while the article stated that there was 100 vulnerabilities between 5 browsers ...
First, this article is basically a dupe of one from a couple days ago. Second, Zalewski was working on his own and MS asked him, in his personal capacity, not to release the tool. I had all this in my PCMag article referenced in the previous /.
The title should be changed to:
Microsoft asked a guy who works at Google to delay publishing work he did on his own time and did not publish through Google or as a representative of Google.
Is that the guy that wrote "Silence on the Wire"? That was a good book of not-likely attacks that are completely and utterly practical, at least in a lab environment consisting of "my living room and $10 of shit I bought off Mouser." Reading the blinking lights off modems, for example.
Support my political activism on Patreon.
CIA (or maybe China Gov) asks MS to delay fuzzer tool.
Yes, "Silence on the Wire" is written by Micha "lcamtuf" Zalewski
Polish Google security white hat Michal Zalewski
-What's your name?
-Zalewski
-Zalewski? Is that Polish?
-Yes.
-Are you trying to do some Polish humor?
-That's..
-SHUT UP!
-That's just my name..
-SHUT UP! I don't appreciate racial slurs! I think them dumb Pollacks have been ridiculed enough!
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
Microsoft's edge has always been their ability to buy companies' products (and companies themselves) and sell them at profit and the locked-in nature of their clients. They are a business company that deals in technology rather then a technology company doing business.
There are exceptions, like their entry into the gaming arena, but don't forget their primary nature.
Um, what? It's hard to estimate profit margins, but Daniel Eran Dilger estimates that Microsoft has a 66% profit margin on Office and 81% on Windows. That's far beyond typical profit margins, so such prices are not "rock bottom".
- David A. Wheeler (see my Secure Programming HOWTO)
Dumping the currency, or the embargo? Because the answer is still "yes", either way. Globalization means we're all in this together. You can't hurt the othe without hurting yourself.
And, consequently, if they fuck up with say, a huge housing bubble or some such, it'll mean we have to share the pain.
....Microsoft really has security guys?
This is like the google dude a while back who said "I gave you 5 days before releasing my hack" where 5 days was thursday night to monday over a US holiday.
According to this dude's timeline. He contacted them on December 20th, and got a real reply the next day. However, things generally move pretty slowly over the last week of the year... They ask him to hold off a bit, and instead he releases his info on New Years Day.
I repeat, if you base your tool release timeline over a major holiday, you are a dick.
Once again, it's clear that fuzzing is really useful for testing security. Not that it's a be-all/end-all, but people developing secure software should be using fuzzers. It's unfortunate that this fuzzer's "design can make it unexpectedly difficult to get clean, deterministic repro"; without deterministic repros, it's often really hard to find and fix the problem.
- David A. Wheeler (see my Secure Programming HOWTO)
The Chinese have long been dumping their dollars as fast as they feasibly can. Go look at some market graphs for chrissakes, you can see the cycle everywhere as they slowly crash-land the US economy in the wake of the demise of the petro-dollar. Dump, market crash, wait for recovery, repeat.
They aren't doing it slowly because they love us, they are doing it slowly because that's the best strategy for them. They want to get as much iron, copper, and petroleum from their titanic dollar reserve as they can, and if they crashed us fast it's likely they would no longer be able to obtain those commodities with dollars. We have a window of opportunity to get our economy off the petroleum base, but we may miss it since we have a certain major faction that wants massive poverty in order to keep the Mexicans out while keeping labor cheap.
Nuclear option, schmuclear option. Dumping their entire cash reserve at once would be a shoot-yourself-in-the-foot option. Especially since most of it only exists as electronic pulses in banking systems. The Chinese will do almost anything to prevent a US economic doomsday, and they are one of the major forces preventing home-grown cheap labor conservatives from instigating one.
MS asked Michael to delay the release, after he gave them like 6 months to fix it. Google has nothing to do with this, outside of paying Michael's paycheck each month. MS sat on their hands for 5 months and then they just want to suppress the exploit? Fuck them, this is WHY we have full disclosure.
I wouldn't be so sure that this wouldnt work without popups if the implementation was changed.
n/t
http://uk.answers.yahoo.com/question/index?qid=20100420071422AABar3E
Foxconn is one of the better Chinese employers. There are a lot of employers that are a whole lot worse.
This is a meaningless statement. Primarily because saying there are a lot of companies that are worse is telling us something we already know about ANY country. Further, stating Foxconn is one of the better Chinese employers removes any context. I was at their Long Hua facility for two months a few years back. Foxconn is the running joke of the Shenzhen tech area: they pay much worse than almost all of their competitors, so employees work there for 6-12 months just to get enough experience so that the other guys will hire them...for 140-180% or more pay.
One wonders what your agenda was in making the claim in the first place.
No problem. I have Microsoft Security Essentials, which protects against exploitation of bugs in Microsoft products, so I don't have to worry about anything.
What the fuck has China got to do with anything? Can we stop the racist bullshit, please? Take your hate speech elsewhere!
One of the founders of Google is an ethnic russian. He is definitely must be a sworn FSB secret service agent for Russia and hell-bent on destroying USA and the free world. Silly web services flood our minds instead of actual industry, while China and Russia bends titanium by the megaton, for guns and armour. Microsoft was at least a white anglo-saxon protestant company, like IBM, that's why God blessed them!
America is very stupid to rely on foreign born traitors, it's a road to destruction. Why discriminate against white anglo-saxon protestant people in business and academia and enterprise, as opposed to immigrant hispanics, jews, negro and asians? The WASP will never betray America, but lesser races will and for much less than 30 billion silver coins!
"According to this dude's timeline. He contacted them on December 20th, and got a real reply the next day. However, things generally move pretty slowly over the last week of the year... They ask him to hold off a bit, and instead he releases his info on New Years Day. I repeat, if you base your tool release timeline over a major holiday, you are a dick. - by Anonymous Coward on Monday January 03, @01:20PM (#34745636)
The fact remains that he did, indeed, contact MS w/ this information & pointed it out to they, along with a tool that can be utilized to check or replicate said findings... better he, than some malware maker outta "the land of 'say-what'".
Imo, @ least?
Both parties (security researchers, and yes, EVEN MALWARE MAKERS) do MS a favor in pointing out what needs to be "shored up". I'd take Mr. Z's way, over that of a malware maker, any day of the week!
(Sure, it's a pain (to have to fix your wares): I've been there myself, & nobody LIKES to have flaws in their work pointed out, but the point is, CORRECTIONS CAN BE MADE @ THAT POINT!)
APK
P.S.=> Yes, MS does have somewhat of an "excuse" here, IF there was a holiday involved, but... that's when these "bad guys" (malware makers) REALLY "go-to-town" I've noticed...
E.G. - Everytime there is a holiday coming up, when folks "whip out their credit cards online to shop" etc./et al, OR, whenever a major event occurs (e.g. - Hurricane Katrina, & the relief for it (1/2 of those sites were indeed, malware scams etc.))...
These malware makers - They're like rust, & rust? Never sleeps... I know this from populating a custom HOSTS file for 15++ yrs. now vs. KNOWN BAD SITES/SERVERS. Rust, doesn't take days off, & neither do these malware making freaks! apk