Slashdot Mirror
Did Microsoft Know About the IE Zero-Day Flaw In Advance?
judgecorp writes "Microsoft issued an emergency patch for a flaw in the Internet Explorer browser on Friday, but there are hints that the firm may have known about the flaw two months ago. The notes to Microsoft's patch credit the TippingPoint Zero Day Initiative for finding the flaw, instead of Eric Romang, the researcher at Metasploit who made it public. ZDI's listings show its most recent report to Microsoft on 24 July, suggesting Microsoft may have known about this one for some time. The possibility raises questions about Microsoft's openness — as well as about the ethics of the zero day exploit market."
I work in the field and can say there's tons of researchers who submit these flaws. Not all of them can be fixed instantly, and in some instances (like this) fixing them could actually create hints for hackers to use and exploit. That's why it's often better to be silent about them and make a fix ready in case they are publicly exploited. One of the worst case scenarios is if you patch something with huge notes about it and the hackers find out about the flaw that way.
And the bad hackers? They submit these to competitors like Google who then "leak" the news about competitors flaw.
How many times have you made a quick demo/proof of concept code, only to be rushed to market besides you express statement that it isn't complete yet. Because your boss doesn't understand what it takes harden your code, or pressures you to just fix the UI to prevent the bad stuff from happening.
For example if you see a website that had javascript that clears out Single Quotes before sending the data over, it may mean that it is ripe for a SQL injection attack.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
What's a "Internet Explorer" ?
If I've learned anything from my current position it's that if a single person find a problem, they're usually whacked on the head and told to keep their mouths shut.
The person who knew was probably a grunt worker in microsoft who was hushed by his manager.
What do I know, I'm just an idiot, right?
Microsoft has a policy of "responsible disclosure" such that they credit the flaw to the first person who participates in that process. If that person reveals it before Microsoft, then the "responsible disclosure" did not take place and the next person is given credit. It is of no surprise that the one who made it public did not get credit from Microsoft.
Sometimes is good to remember that are involved people instead of big companies. Did the "company" knew about it or the people that received initially the report didn't escalated it? Who knows how much vulnerability reports they get every day, and how much of them are taken as dupes, already known, or plain sold to the biggest bidder, without the upper layers knowing about them.
Anyway, they are playing their role. It's supposed to be security by obscurity, so let put a shadow on all hints of insecurity. With a bit of luck the only aware of it will be the researcher that sent the report instead of the bad guys, so will be plenty of time to fix and schedule a deploy without anyone else knowing that it happened.
and that is called, 'returning shareholder value'
Car manufacturers have always allowed defective products into the field, as long as the costs (lawsuits, bad press) do not outweigh the benefits (PROFIT!)
Of course, they already have lawyers on retainer, and 'good relationships' with the media outlets, so that can cover most complaints by simply quashing them with legal briefs and keeping the complainants from ever getting media coverage
There was a long period of time when MS seemed to follow that model, but they seemed to have gotten on their game in the past few years, hopefully this is not a sign that they are falling back to the lowest level of service that they can give to security issues without getting sued
Wherever You Go, There You Are
Microsoft released this flaw on themselves so they'd have an excuse to invade multiple innocent computers with security essentials. You're living in a policed antivirus society. Wake up! There was actually a third exploit that you can see being silently removed by Norton before anything hit. You think this is a coincidence?
Most companies know of flaws before they are made public.
I'm sure it exists, as long as the balance sheet is OK. A "market" (and the ZD exploit market, being largely unregulated, TTBOMK) doesn't have any ethics per-se.
Windows 2000 - from the guys who brought us edlin
The possibility raises questions about Microsoft [...] as well as about the ethics of the zero day exploit market.
You're kidding me, right? You expect ethics on a market whose primary customers are spies and criminals? Selling to manufacturer is only the sale of the last resort.....
1.) Guy reports exploit to M$ in February
2.) They do nothing
3.) Guy asks for progress in May
4.) They do nothing
5.) Guy asks for progress in July
6.) They do nothing
7.) Guy asks for progress in October
8.) They do nothing
9.) Guy releases exploit to public
10.) MS bitches loudly about "Google trying to smear us"
11.) MS does nothing for three days
12.) Two low-level guys are told to fix it ASAP on Monday
13.) On Tuesday they are grilled by Sinofski about progress
14.) On Wednesday Ballmer throws a chair at them
15.) On the deathbed (from the Ballmer-inflicted wounds), they fix the issue
16.) On Friday MS releases the patch
If Microsoft knew about it, it wasn't a zero-day vulnerability
Have you analyzed the typical time for Mozilla, or Google to fix such issue?
If you need web hosting, you could do worse than here
So if they knew in advance it would not be a "zero-day" right? I dunno, maybe I am missing something here, carry on.
MS knew about an exploit and tried keeping it under wraps until it was patched. It just so happens that the exploit became widely known before they could release it with their normal update cycle so they pushed out an early update. I'm glad they don't post all the potential new exploits they become aware of until they are able to address the problems. If they were relying on outside help to maintain their security then I could see the need to make exploits known right away but as this is not the case, it doesn't make sense to tell the world about security holes like this if they are going to be able to fix it before it becomes a problem.
http://interserver.net/
Really I can just sense the hate. That and the ridiculous assertion made that MS purposely let it in as an inside job. ... of course if I had to write websites optimized for quirks mode all day for ancient versions I could see the angry reaction to any IE news :-)
IE 6 and 7 could be dead fast enough.
http://saveie6.com/
Except that you're talking shit. Microsoft has been credited with informing their competitors of vulnerabilities as often as Microsoft's competitors have been credited with informing them of vulnerabilities.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Well, I had a quick look at some other CVEs for the hell of it.
Mozilla:
CVE-2012-3980 - 48 days - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3980 (Bugzilla entry concealed from public)
CVE-2012-3979 - 48 days - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3979 (Bugzilla entry concealed from public)
CVE-2012-3968 - 48 days - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3968 (Bugzilla entry concealed from public)
Google:
CVE-2012-2869 - 103 days - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2869 (Bug tracker issue concealed from public)
CVE-2012-2864 - 94 days - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2864 (Bug tracker issue concealed from public)
CVE-2012-2859 - 73 days - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2859 (Bug tracker issue concealed from public)
So, Microsoft is not unique in sucking at getting patches out promptly. It's pretty abundantly clear that "Marc" is just another anti-Microsoft shill ranting about how Microsoft perpetuated every evil in history. (Really, if Open Source is the paragon of transparency, why are all of the bug tracker entries detailing these now fixed bugs private?)
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
This process was developed/implemented by HexView a few years ago (I worked for them at that time): Whoever finds the vulnerability likely has enough knowledge to roughly estimate what it takes to fix it and test the fix. He/she supplies all details to the vendor and gives them a hard time frame, e.g.: "I will release this data to the public 30 days from now". At the same time, vulnerability alert without details to prevent/delay re-discovery may be released to the public. If the vendor fails to resolve the vulnerability in a timely manner -- too bad, you were given enough time for fixing and testing.