Slashdot Mirror
Did Microsoft Know About the IE Zero-Day Flaw In Advance?
judgecorp writes "Microsoft issued an emergency patch for a flaw in the Internet Explorer browser on Friday, but there are hints that the firm may have known about the flaw two months ago. The notes to Microsoft's patch credit the TippingPoint Zero Day Initiative for finding the flaw, instead of Eric Romang, the researcher at Metasploit who made it public. ZDI's listings show its most recent report to Microsoft on 24 July, suggesting Microsoft may have known about this one for some time. The possibility raises questions about Microsoft's openness — as well as about the ethics of the zero day exploit market."
What's a "Internet Explorer" ?
And the bad hackers? They submit these to competitors like Google who then "leak" the news about competitors flaw.
I'm pretty sure that Google discretely notifies Microsoft of flaws that it is aware of.
No sig. Move along - nothing to see here.
Microsoft has a policy of "responsible disclosure" such that they credit the flaw to the first person who participates in that process. If that person reveals it before Microsoft, then the "responsible disclosure" did not take place and the next person is given credit. It is of no surprise that the one who made it public did not get credit from Microsoft.
and that is called, 'returning shareholder value'
Car manufacturers have always allowed defective products into the field, as long as the costs (lawsuits, bad press) do not outweigh the benefits (PROFIT!)
Of course, they already have lawyers on retainer, and 'good relationships' with the media outlets, so that can cover most complaints by simply quashing them with legal briefs and keeping the complainants from ever getting media coverage
There was a long period of time when MS seemed to follow that model, but they seemed to have gotten on their game in the past few years, hopefully this is not a sign that they are falling back to the lowest level of service that they can give to security issues without getting sued
Wherever You Go, There You Are
And why is that? Google would love to see Microsoft die.
You don't bring nukes to a knife fight. Sure, you win the knife fight, but now everyone else knows to nuke you first and ask questions later.
Range Voting: preference intensity matters
Not all of them can be fixed instantly, and in some instances (like this) fixing them could actually create hints for hackers to use and exploit
If you have knowledge of a critical exploit, and you can't fix it in months, then your software is not suitable for use in a production environment.
It is crucial to let system admins know as soon as you find an exploit, so they can defend themselves. You can't assume that blackhats will not find out, because they will, and you are putting your users at risk with such negligent behavior.
Your post mainly shows that you don't know what you're talking about.
This is utter bollocks. I used to run a large network and if you know there is a critical patch coming, you can plan for it. If you don't, and it gets released haphazardly (OOB), you're just fucked. There is no good way to get it on 200 servers and 2000 desktops in under 48 hours without causing major problems.
Nice offhand remark about Google leaking MS zero days. Got anything to back that up?
tl;dr - utter rubbish. Yes, I work in the field too and have done for over 10 years.
Lots of answers:
* If you inform Microsoft of a flaw in IE, then Microsoft in turn notifies you of a flaw in Chrome. ;)
* Chrome's Windows version actually uses a lot of IE components (ICS stands out, if I remember right), so a flaw in IE could potentially affect Chrome, depending on what the flaw is (e.g. an IE flaw that sets a stealth/fake proxy in IE ICS, which in turn affects Chrome...)
* Just because you want your competitors to die or be diminished, doesn't mean you have to be a dick about it.
Quo usque tandem abutere, Nimbus, patientia nostra?