Slashdot Mirror
MS Asks Google To Delay Fuzzer Tool
eldavojohn writes "Polish Google security white hat Michal Zalewski has announced concerns that one of a hundred vulnerabilities his fuzzer tool found in IE is well known to third party hackers in China. His simple explanation provides an interesting counter argument to Microsoft's usual request that security problems not be released until they can slowly investigate them. From the article, 'Microsoft asked Zalewski to delay cross_fuzz's release, but he declined, in part because of his fear the IE vulnerability was already being explored by Chinese hackers, but also because the company's security experts had not responded to information he provided.' You can read about and download cross_fuzz for your own use."
Microsoft is the last among browser makers to react to the vulnerability. Everybody else has released patches to address some, if not all of the holes.
Seems the IE team is so small, they can only do is development on IE9; perhaps there is no other team. Maybe they're all working to make the latest Windows Mobile platform a rousing success.
Its a much slower, conservative company now that Bill Gates has left. And I don't mean that in a good way.
When is someone going to DO something about the possibly government sponsored hacking taking place in China? It ought to be brought up at the UN, or trade meetings, or SOMETHING! If the Chinese government won't stop it, we need to cut them off.
MS believes in security through ignorance, since it makes them money. As long as the common users don't know that their machines are infiltrated, stealing their bank information and sending spam, they are happy, since at worst, they will think their machine is worn out and slow and then go out and buy a new one, chock full of new versions of MS software.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Last year I attended a conference where one of the talks was about browser security. The speaker demonstrated how easy it was to gain access to someone's PC when the machine was being specifically targeted. Some of the things he did:
1) Set up a rogue access point with open access and SSID name similar to the venue..
2) Set up a rogue DNS.
3) Set up a redirect page that installed demo software...
One of the things he mentioned was that if you are being targeted specifically, your system will likely be compromised. If you are not targeted specifically, it's trivially easy to find machines that can automatically be compromised.
Adding any apps increasing your exposure.
The number of unpatched vulnerabilities is staggering and it's only a numbers game when a slew of machines are needed.
Yes. There's a list right at the bottom link of other browsers it managed to break, including firefox and opera. It apparently works by stressing the garbage collection mechanisms through creating and destroying DOM objects/references; I don't know what that means really, but he's written a step-by-step of the mechanisms that seems easy enough to follow.
Emotions! In your brain!
Definitely can't blame him. Considering Microsoft's track record for investigating serious security concerns in it's operating system and browser series, and the total number of people using these products across the world, he acted properly.
vos nescitis quicquam, nec cogitatis quia expedit nobis ut unus moriatur homo pro populo et non tota gens pereat.
"We consider all Mr. Zalewski claims invalid. Obviously he didn't contact Security Experts for IE in reality just like you cannot contact Santa".
839*929
It's actually a follow-up. He finally got his response from MS but it was just them asking him to delay releasing the tool indefinitely.
They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
The summary made it sound like IE had 100 vulnerabilities, while the article stated that there was 100 vulnerabilities between 5 browsers ...
First, this article is basically a dupe of one from a couple days ago. Second, Zalewski was working on his own and MS asked him, in his personal capacity, not to release the tool. I had all this in my PCMag article referenced in the previous /.
A /. reader that dose not have control over their own computer at work. Lols.
Why is it so hard to only have politicians for a few years, then have them go away?
Microsoft's edge has always been their ability to buy companies' products (and companies themselves) and sell them at profit and the locked-in nature of their clients. They are a business company that deals in technology rather then a technology company doing business.
There are exceptions, like their entry into the gaming arena, but don't forget their primary nature.
Dumping the currency, or the embargo? Because the answer is still "yes", either way. Globalization means we're all in this together. You can't hurt the othe without hurting yourself.
And, consequently, if they fuck up with say, a huge housing bubble or some such, it'll mean we have to share the pain.
According to this dude's timeline [coredump.cx]. He contacted them on December 20th, and got a real reply the next day.
You fail to note that the contact in December was a reminder that he was releasing the tool. He sent them the original crash reports in July and then more detailed info in August. MS security researchers were apparently unable, unwilling, or just too lazy to do the work to replicate the bugs or contact Mr. Zalewski for the next four months until he reminds them twice more in December about the issues.
By December Mr. Zalewski was no longer wiling to give MS extra time, not because he was looking for publicity, but because he had real indications that the exploits were already known to other parties and the situation had become one that needed immediate action on the part of users and sys admins to defend themselves pending a fix from MS. I have to disagree with you about him being a dick. He was very responsible on this one, even when dealing with a vendor that ha an abysmal track record of making timely fixes for periods lasting years, right until there is public disclosure.