MS Asks Google To Delay Fuzzer Tool

eldavojohn writes "Polish Google security white hat Michal Zalewski has announced concerns that one of a hundred vulnerabilities his fuzzer tool found in IE is well known to third party hackers in China. His simple explanation provides an interesting counter argument to Microsoft's usual request that security problems not be released until they can slowly investigate them. From the article, 'Microsoft asked Zalewski to delay cross_fuzz's release, but he declined, in part because of his fear the IE vulnerability was already being explored by Chinese hackers, but also because the company's security experts had not responded to information he provided.' You can read about and download cross_fuzz for your own use."

Comments

Microsoft losing their edge?

[Anonymous Coward]

Microsoft is the last among browser makers to react to the vulnerability. Everybody else has released patches to address some, if not all of the holes.

Seems the IE team is so small, they can only do is development on IE9; perhaps there is no other team. Maybe they're all working to make the latest Windows Mobile platform a rousing success.

Its a much slower, conservative company now that Bill Gates has left. And I don't mean that in a good way.

Re:Microsoft losing their edge?

[_Sprocket_]

Its a much slower, conservative company now that Bill Gates has left. And I don't mean that in a good way.

There was a point in time (not too long ago by normal standards - ancient history "Internet time") when Microsoft was very slow to respond to any security issue. That was very much in the Bill Gates era. The concept of full disclosure comes from that time. The subject of disclosure has been beat to death around here more than once so we'll avoid going down that path. However, some of the intents of the "full disclosure" concept is to shame the vendor and warn the user. Even "responsible disclosure" rules tend to have some breaking point where the bug gets exposed without vendor consent.

This is less of a turning point than a reminder of where we've been before.

Re:Microsoft losing their edge?

[Ustice]

Be careful what you wish for. We are more likely to end up with well-meaning legislation that does the opposite, where it punishes those that publish security holes as helping criminals.

Re:Microsoft losing their edge?

[Anonymous Coward]

They'd only start slapping a Beta tag on everything like Google does. That would buy them a few years of delays. Then they'd lobby to get the law modified so their liability was limited to the price of the software. Then they'd say the kernel is what costs and the rest is free bundled stuff. At every stage they'll lobby and start lawsuits to delay things. Eventually its 15 years later and you've got some silly obscure law that protects nobody unless they've got the money to fight a massive software company (something the US DoJ doesn't have).

Re:Microsoft losing their edge?

[Low Ranked Craig]

Ballmer has a hard-on for Apple and Google. Instead of focusing on their core business which is providing servers and office automation to businesses they are chasing Apple and google with WP7, chasing the iPad, the iPod, Google search, and the Sony playstation. Arguably they've been successful at the latter, the others not at all.

Look at WP7 vs Windows Mobile 6.5. WM6x is in dire need of an overhaul. WP7 cannot replace it in a business environment at this point. We use windows mobile powered devices for out warehouse management apps. The replacement for ActiveSync, Windows Mobile Device Center, is worse than AcviecSync (if you can believe that) and is more consumer focused than business focused. WP7 is not designed for business apps - there is a huge opportunity for Google to invade the embedded business app space.

Ballmer needs to cease his juvenile, masturbation fantasies of crushing Jobs and Schmidt and get back to focusing on their core business.

Re:Microsoft losing their edge?

[Gadget_Guy]

According to the timeline, Microsoft too has also released patches for some but not all the bugs. This final delay appears to be because they had problems reproducing the crashes, which I think is probably due to the nature of this tool which makes reproducing the exact circumstances difficult. I can sympathise because I have had to find hard to reproduce bugs is the past.

Still I think that is correct that it should be all made public now, considering that the bad guys have already got the code.

When

[Anonymous Coward]

When is someone going to DO something about the possibly government sponsored hacking taking place in China? It ought to be brought up at the UN, or trade meetings, or SOMETHING! If the Chinese government won't stop it, we need to cut them off.

Re:When

[jittles]

I think this would hurt China just as much as it would hurt the US or Europe.

Re:When

[RoFLKOPTr]

A trade embargo with China is not a thought to be taken lightly.

Slavery is not to be taken lightly.

That right there invalidates all your arguments, because that says you've been absorbing all the stupid propaganda and sensationalism about Chinese working conditions. Just because they don't make $50k a year doesn't mean they are slaves. Most of them are quite happy with their jobs.

Yeah, 14 Foxconn employees committed suicide in 2010. That's out of 920,000 employees total. So that's about 1.5 suicides out of every 100,000 employees. Wanna guess what the suicide rate in the United States was in 2007? 11.5 out of 100,000. That's EIGHT TIMES the suicide rate at Foxconn. And the suicide rate in all of China was 6.6 in 2008. One could argue that Foxconn, in fact, IMPROVES workers lives. Of course that's not necessarily true, because correlation does not imply causation, but that data is enough to make a big huge news story worthy of being approved by Slashdot's elite editorial team with which to draw a bunch of sheep to hark the benefits of working for Chinese electronics manufacturers.

Do some of your own research before believing the bullshit and comparing Chinese laborers to slaves.

Security through blissful ignorance...

[flyingfsck]

MS believes in security through ignorance, since it makes them money. As long as the common users don't know that their machines are infiltrated, stealing their bank information and sending spam, they are happy, since at worst, they will think their machine is worn out and slow and then go out and buy a new one, chock full of new versions of MS software.

Re:Security through blissful ignorance...

[mcgrew]

From the co,puterworld link:

"I have a conference call with MSRC [Microsoft Security Response Center]," Zalewski said in the timeline's note for Dec. 28. "The team expresses concern over PR impact, suggests that the changes made to my fuzzer code between July and December might have uncovered additional issues, which would explain why they were unable to reproduce them earlier."

MS, if you want better PR, stop worrying about PR and start worrying about code quality. For what your software costs, its performance is abysmal. You have Yugo software with a Lexus price.

Re:Security through blissful ignorance...

[bluefoxlucid]

Right, which is why most users are overly concerned about "credit card theft" when most infections are about spamming the shit out of people; and a large number of people who succumb to identity theft are actually taken by malware that installs itself as an "anti-virus" program but secretly records your bank transactions.

It's like walking through Baltimore City alone at night. As much as people are terrified by it, not everyone is out to kill you; that said, if you walk through Baltimore City alone at night regularly, you'll meet someone who is out to kill you. Paranoia is when you think they're all out to get you; rational sense is when you realize, no, they're not, but there's a significant risk of encountering someone eventually and it only takes one knife to stop your heart.

Browse at your own risk...

[Anonymous Coward]

Last year I attended a conference where one of the talks was about browser security. The speaker demonstrated how easy it was to gain access to someone's PC when the machine was being specifically targeted. Some of the things he did:

1) Set up a rogue access point with open access and SSID name similar to the venue..

2) Set up a rogue DNS.

3) Set up a redirect page that installed demo software...

One of the things he mentioned was that if you are being targeted specifically, your system will likely be compromised. If you are not targeted specifically, it's trivially easy to find machines that can automatically be compromised.

Adding any apps increasing your exposure.

The number of unpatched vulnerabilities is staggering and it's only a numbers game when a slew of machines are needed.

Re:Browse at your own risk...

[bluefoxlucid]

Sitting in a Starbucks is a low-risk method because it's hard to trace. Hell, you can load automated software onto a hand-held PDA (iPaq? I ran Linux on one...) to do all the raping and infecting. The packets can be tagged with a different MAC address than your real device, making it physically untraceable; it's all in your pocket, and can auto-connect to wifi and do whatever, so picking you out of a crowd is harder than "find the suspicious person" since you just carry it around and don't go out sniping.

This works for MP3s and child porn and whatever the hell else too, btw. Assuming you know where and what to search (I assume torrents for MP3s, who knows for kiddy porn), you could have an automated program do all the relevant searches and store the results. When you get home, pop the device out and browse through the cached results... pick what you want, and next time you're out it'll find those things and download them.

For the obvious flaw, you can ban your own Wifi network and your neighbors', or have the program automatically search for certain networks (yours, your neighbors', etc) and decide you're "too close to home" and shut down. You could even have a separate daemon that handles wifi, and when it sees you're "too close to home" it prevents any wifi connections at all.

There's a lot of "I can have this here with me, but never physically do anything while connected to the network, and never use my own network" that can be done to hide your online presence. The same can be done for chatting on forums, sending e-mail, etc. The only thing you can't hide that way is real-time chat like instant messaging or IRC, because you have to twiddle the device; but for answering a forums post or blogs, you can have a program smart enough to deal with phpBB and V-Bulletin and Wordpress... it could let you record what you want to post, who to reply to, which post ID to reply to, the works... then when you're out somewhere, post.

Basically you're interacting from an alternate reality, one where you're pulled out of the real world; that interaction is transferred into the real world physically somewhere, but you're not present at that point and there's no cable running from there to here to draw a path to you. You'd have to use an innocuous device (a PDA most likely, bought in cash) and download the software from a MAC-shifted device on a public link to have absolutely zero trail (i.e. no evidence that you're even capable of this), but it'd be doable. Completely. It'd make for some interesting shit... maybe I'll write a sci-fi novella about the idea.

Re:Can't blame him

[Securityemo]

Yes. There's a list right at the bottom link of other browsers it managed to break, including firefox and opera. It apparently works by stressing the garbage collection mechanisms through creating and destroying DOM objects/references; I don't know what that means really, but he's written a step-by-step of the mechanisms that seems easy enough to follow.

MS denied accusations

[should_be_linear]

"We consider all Mr. Zalewski claims invalid. Obviously he didn't contact Security Experts for IE in reality just like you cannot contact Santa".

Re:Article is dupe

[Abstrackt]

It's actually a follow-up. He finally got his response from MS but it was just them asking him to delay releasing the tool indefinitely.

Re:Any release over a holiday is a dick move!

[99BottlesOfBeerInMyF]

According to this dude's timeline [coredump.cx]. He contacted them on December 20th, and got a real reply the next day.

You fail to note that the contact in December was a reminder that he was releasing the tool. He sent them the original crash reports in July and then more detailed info in August. MS security researchers were apparently unable, unwilling, or just too lazy to do the work to replicate the bugs or contact Mr. Zalewski for the next four months until he reminds them twice more in December about the issues.

By December Mr. Zalewski was no longer wiling to give MS extra time, not because he was looking for publicity, but because he had real indications that the exploits were already known to other parties and the situation had become one that needed immediate action on the part of users and sys admins to defend themselves pending a fix from MS. I have to disagree with you about him being a dick. He was very responsible on this one, even when dealing with a vendor that ha an abysmal track record of making timely fixes for periods lasting years, right until there is public disclosure.