Slashdot Mirror
Google Releases More Windows Bugs
An anonymous reader writes: Just days after Google angered Microsoft by releasing information about a Windows security flaw, they've now released two more. "The more serious of the two allows an attacker to impersonate an authorized user, and then decrypt or encrypt data on a Windows 7 or Windows 8.1 device. Google reported that bug to Microsoft on Oct. 17, 2014, and made some background information and a proof-of-concept exploit public on Thursday. Project Zero is composed of several Google security engineers who investigate not only the company's own software, but that of other vendors as well. After reporting a flaw, Project Zero starts a 90-day clock, then automatically publicly posts details and sample attack code if the bug has not been patched." Microsoft says there's no evidence these flaws have been successfully exploited.
Microsoft: "There's no evidence these flaws have been successfully exploited."
Google: "Then why are you wearing that fake mustache and goatee?"
Shouldn't that read:
Microsoft releases more windows bugs?
Google isn't writing code for Microsft, is it? :-)
Yay! (gets popcorn!)
And yes - Google is just as much an evil corporation as Microsoft. Hell, given Google's business model is selling YOUR privacy, they're probably MORE evil.
Free markets! Competition!! That is what made America, what it is.
I wish such fierce competition exists in all spheres of the economy.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
but in principle I agree with what Google is doing. In effect they are trying to destroy the market for zero day exploits and forcing the companies involved to not site on their hands and hope nobody uses them.. like cybercriminals and the various three letter agencies.
"Microsoft says there's no evidence these flaws have been successfully exploited."
And 5...4...3...2...1...
... I can't say that I am much amused by this.
Bad msft!
Bad goog!
*smacks with newspaper*
Talk about blatant extortion... Perhaps Google should be more concerned about patching the 1,001 vulnerabilities in Android before casting stones at others.
For example, how about this: http://www.extremetech.com/mobile/197346-google-throws-nearly-a-billion-android-users-under-the-bus-refuses-to-patch-os-vulnerability
This is degenerate behavior.
ya i gota admit, i was always oo oo android blahbalhbalh, but now, i would rather pay for an operating system and not have my data sold.
Microsoft says there's no evidence these flaws have been successfully exploited.
I mean the whole point of doing these types of investigations is to try and prevent exploits from getting out into the wild.
> Microsoft says there's no evidence these flaws have been successfully exploited.
How does sample attack code not count?
90 days is really long. The US CERT vulnerability disclosure policy is 45 days as described in http://www.cert.org/vulnerabil... (see that more more details). The problem is that you have to balance two conflicting needs; in the words of the CERT, "the need of the public to be informed of security vulnerabilities with vendors' need for time to respond effectively."
- David A. Wheeler (see my Secure Programming HOWTO)
"Google Releases More Windows Bugs"
Releasing bugs on a platform they didn't write, don't have the source code to and they did all this by means of a Computer World atricle.
How in the world did they put bugs in two Windows versions using a magazine? That's really a trick.
Oh wait...
Remember folks, socialism is for the people, not the socialists!
Not everyone wants to follow you're ridiculous upgrade cycle. Example: I like Google Chrome, I won't use it because its a pain in the ass to stop it from auto-updating, and if you stop it once, a month later it randomly starts upgrading itself again.
Why does Google think what its doing is any better than the people who sell exploits on the black market? They aren't asking for cash directly for them, but they are trying to hurt the competition.
Issue #128 might not even be a bug depending on your perspective, as noted in the report! The one that is 'the more serious of the two', WTF? And its not like MS hasn't patched it ... they've created a patch, that caused some compatibility issues so they delayed the patch so the compat issues can be resolved ... So Google publishes the exploit code just to be dicks about it.
The less serious ... lets a user view another users power control settings ... Seriously?
This is just Google mud slinging. Its starting to look more like Google is a politician running for elected office than being a good citizen.
Google: You're starting to look like an even bigger douche than Microsoft.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Uh, isn't that what Google's proof-of-concept does - demonstrate the flaw being successfully exploited? Does Microsoft need to see N. Korea exploiting it before they believe it's real?
I'm reminded of Neal Stephenson's description of Shanghai banks on the eve of World War 2:
Continue reading ...
-kgj
>> Microsoft says there's no evidence these flaws have been successfully exploited.
if this is supposed to be a new economy, how come they still want my old fashioned money?
"he did it! he did it!" yeah, they're taught that song at birth.
if this is supposed to be a new economy, how come they still want my old fashioned money?
I mean the whole point of doing these types of investigations is to slap the competition in the face.
It little behooves the best of us to comment on the rest of us.
Your metaphor does not hold. As you put it, Google is inserting itself into other's business, when they should be concentrating on their own issues. In kindergarden, there are teachers and other staff to oversee the children and resolve conflicts. That does not exist here. Google has stepped up and is trying to improve their whole business environment, both in and around their area of stewardship. When researching an issue, bug, or flaw (such as security issues in this case) sometimes you find that the system you are working on does not contain the flaw, but the environment where it is being used. Normally, we accept it as a limitation and attempt to build around the flaw, leaving it for a pitfall to others. Google is calling out such flaws and letting the stewards over those flawed systems know, and giving them 90 days to fix it before they tell everyone else. This isn't whining, it's community responsibility, and I hope more companies follow suit.
You don't point out others mistakes when you don't take care of your own problems.
"Microsoft says there's no evidence these flaws have been successfully exploited."
a.k.a. WONTFIX. I wonder if Lennart has been advising them.
Google is inserting itself into other's business, when they should be concentrating on their own issues.
When Microsoft fails at security, it impacts Google's core business...
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The need to reassure their customers that the bad guys did not already know about this particular exploit.
"Oh that's an old version, we aren't going to patch the bug." Really? That's an acceptable response that something that's 3 years old is too old to patch? But somehow, taking 100 days to patch a product that's 5 years old (in 7's case) is too long? Much easier to deal with patch issues if you just declare you only support the latest greatest and require everyone to upgrade all the time, no matter the issues.
MS's response is particularly understandable given the complexity of doing regression testing on the wide variety of hardware, software, and patch sets the patch might need to be applied against. If they released it and it caused issues, well then people would cry even more about how shitty they were for not testing it.
I think you are right about the mud slinging/political office: What with Chrome books Google now wishes to directly attack MS. They want to make Windows look bad, and thus make their own product look good by comparison. This isn't motivated by being a good citizen, it is motivated by something else.
For that matter one can get all conspiracy theorist and say maybe they chose their reporting date knowing MS's patch cycle to try and create just such a situation.
90 days is really long. The US CERT vulnerability disclosure policy is 45 days as described in http://www.cert.org/vulnerabil... (see that more more details). The problem is that you have to balance two conflicting needs; in the words of the CERT, "the need of the public to be informed of security vulnerabilities with vendors' need for time to respond effectively."
It's definitely a fine balancing act, and regardless your opinion on the Google vs Microsoft disclosure debate, I am glad that we are having a public debate about it.
Vulnerabilities cannot really be effectively categorized (look at the attempts from MITRE, for example). Some are due to simple programming errors and can be fixed and rolled out immediately. Some are deeper architectural problems that, even if an "easy" fix, have a whole ecosystem of software built around that wrong behavior. A one-size-fits-all disclosure plan is not necessarily in the public benefit, and I'm glad discussion is being had on what a reasonable timeline looks like, as well as what are extenuating circumstances for changing that timeline.
"The licensing quest is largely a byproduct of Microsoft's unique position -- or perhaps more bluntly put, failure in the market" ref.
I think that Microsoft has better intentions in this than Google does. Microsoft acknowledged the bugs and requested that Google delay the public release slightly so that they could patch. Google to me seems to be simply slamming Microsoft. All the while Google has extremely vulnerable versions of it's old stock browser on older but not out of support Android phones that it openly states that it will not patch.
Talk about blatant extortion... Perhaps Google should be more concerned about patching the 1,001 vulnerabilities in Android before casting stones at others.
For example, how about this: http://www.extremetech.com/mob...
That's a inappropriate comparison.
To patch that vulnerability would require the ability to update Android on existing handsets.
For this to work, the handset manufacturers would have to provide a new version of Android for the given handset.
For this to work, the Android development model of "partner, not Google, productizes Android" would have to change.
For this to work, there would have to be ongoing development on an older hardware platform.
For this to work, there would have to be carrier involvement in certification.
For this to work, the carrier revenue model of locking you into a two year contract every 18 months would have to change.
--
It's in absolutely no ones financial interest to provide updates to Android in already shipped handsets, and Google is not in a position, as an OS supplier, rather than a phone vendor (which is what Apple is), to force changes in operational model into the carrier or the partner device vendor.
U.S. Carriers are *NOT* going to change their revenue model just so people can buy ala carte devices that will work with any carrier, and cost more up front for you to go with their service, rather than rolling it into the monthly payment when you go with a competitors service. Everyone would have to change at once (collusion, a violation of both the Sherman Antitrust Act and the RICO Statutes, and definitely something that would be prosecuted), or the carrier that tried to move to the European model would find itself out of business.
Likewise, the handset vendors, whose revenue model is completely built on thin margins, but selling a new handset every 18 months, instead of you buying one and keeping it for 10 years, would have to charge higher margin on their device sales in order to keep their revenue numbers up, and to pay for the R&D ongoing on the already-sold platform. And then they'd need to change their FAS accounting to match that of Apple's, or face charges under Sarbanes-Oxley, which is what Apple had to do before it could give away the WiFi updates to 802.11g/n for iPods. You'll (maybe) remember that they got a percentage of the monthly wireless fee from the carrier for iPhones, but realized their income at time of sale on iPod Touch and non-3G iPads, and so they had to charge $5 for the update.
And seriously, would you be willing to pay $5 for a bug fix for a bug you were pretty sure wasn't impacting you anyway, and was just some security "researcher" throwing a hissy fit to get their company name in the news so they got audit contracts out of it?
Go to connect.microsoft.com and file a bug report.
> Microsoft says there's no evidence these flaws have been successfully exploited.
Cleverly worded sentence intended to leave the reader with the impression:
"We don't know that there has been a breach, therefore there hasn't been a breach"
when it really means...
"We don't know squat about whether there has been a breach. Maybe all hell has broken lose, and there's no evidence to contradict that either."
MS still holds a lot of Android patents. They can easily do an Apple and forbid use of them, which will completely paralyze Android.
What you mean all those patents that the Chinese outted and nearly the entire tech world found to be not relevant save about as many as you can count on your hands? Yeah, that's really going to stop Android...
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
Uh, isn't that what Google's proof-of-concept does - demonstrate the flaw being successfully exploited? Does Microsoft need to see N. Korea exploiting it before they believe it's real?
If you personally create a remote account for a North Korean spy and he uses this exploit to see you power control settings. You really were asking for it, not sure what but something.
I’m reminded of the old “blackmail” skit from Monty Python. Just with less of Terry Jones’ ass hanging out at the piano. I like it!
A countdown clock is great but at least a few weeks before it expires a human needs to review it and send a "red flag alert" to the vendor that will fix it and ask if they are working on it and if so ask when they expect to have it fixed.
If the answer is "yes" the estimated fix-it date is in the near future, keep quiet but pester them if the date passes without a fix.
If the answer is "yes, we've been working on this but it is hard" or "no, but we'll get started right away" then keep pestering them and don't release it as long as they are making good progress (you may have to take their word on whether they are making good progress though, sigh).
If the answer is silence or a plain "no" or some other indication that there is no fix coming soon, then release it on the original date.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Off topic much? What the fuck does that have to do with a Windows security flaw?
I know Google isn't all roses and sunshine, but Microsoft is less of a tech company and more of a marketing and public relations firm.
I guess years of Ballmer, entrenched monopoly and security by obfuscation does this to you.
For those who remember: Microsoft spent plenty of resources just to bash Google in negative attack ads. Examples include Googlighting Stranger, Gmail Man, Scroogled. If only Microsoft would use all that time/money/energy to improve its products or fix bugs, eh?
I just can't wait for Google smart home to be in every house so Google can publish when I forget to lock my door at night.
If only Google would put this much effort into their own products, like they used to, then maybe we wouldn't be relying on Microsoft at all anymore for their OS.
When Google finds security bugs in Android do they publish it along with proof of concept after 90 days?
You have Google confused with Facebook.
"Microsoft says there's no evidence these flaws haven't been successfully exploited."
Regardless of their meaning that's a ridiculous things to say, obtaining evidence to show the flaws haven't been exploited is infeasible. It's like saying there is no evidence proving that god does not exist.
If that was true, then they would be working with Microsoft to improve their security, not making it worse by automatically disclosing vulnerabilities when the patch is forthcoming. And if you don't believe they should have to, then I fail to see why Microsoft should have to be beholden to Google's asinine 90-day cut-off when even Google doesn't fix it's security bugs within 90 days in many cases.
If that was true, then they would be working with Microsoft to improve their security, not making it worse by automatically disclosing vulnerabilities when the patch is forthcoming.
I think waiting 90 days for the company whose last CEO said he would "fucking kill" google to fix their shit software is pretty generous.
then I fail to see why Microsoft should have to be beholden to Google's asinine 90-day cut-off when even Google doesn't fix it's security bugs within 90 days in many cases.
Yes, Google's 90-day cut-off is asinine: It's twice CERT's standard, for example. If we really want these bugs fixed, Google should be disclosing them much earlier.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Since Google is behaving in an irresponsible manner they are walking a fine line between legal and illegal activity.
Perhaps it is about time that Google be sued, or possibly indicted on criminal charges for their behavior. Aiding and abetting is still a crime last I knew.
Microsoft says there's no evidence these flaws have been successfully exploited.
Maybe that's because to successfully exploit these flaws would mean you must leave no evidence that anything has been exploited.
Funny semantics begs for some kudos here.
Now if Google would just spend some time fixing bugs in Android, like the VPN bug in 4.4 and 4.3 that prevent most people from using VPNs on their phone.
Uh huh. Because some jackass CEO blustered, Google has the right to fuck over MS end-users by arbitrarily demanding that MS prioritize their security reports over all others? Apparently you care more about Google's reputation and rushing out fixes than actually solving the problem. What will happen here? Google will make even more people vulnerable, all for what? To try to force MS to push their in-progress patch before it's even ready? And of course only MS deserves this treatment, because they're MS! Google's vulnerabilities can languish for over 90 days without being disclosed, because they're Google. They're never badmouthed other companies like idiots before.
Because some jackass CEO blustered, Google has the right to fuck over MS end-users by arbitrarily demanding that MS prioritize their security reports over all others?
Well, no. Because some jackass CEO blustered, I will rub my hands together and chuckle with glee every time Google releases an old, old bug report with security ramifications for their stack of crap. It's Microsoft fucking over the end users, by dropping such a stack of crap on them and then refusing to be responsible about security. If Google can find these bugs, then so can dedicated attackers.
And of course only MS deserves this treatment, because they're MS! Google's vulnerabilities can languish for over 90 days without being disclosed, because they're Google.
If Microsoft wants to find security holes in Google software, and report them after 90 days, then I'm sure Google will make sure that someone fixes them within 90 days, or perhaps even 45. That's easy for Google to do, apparently. They roll out a new version of Play Services at the slightest opportunity.
They're never badmouthed other companies like idiots before.
Microsoft showed how they would like to be treated, and now Google is doing that: treating them like idiots. If Microsoft wants to step up their game and act responsibly with regards to security holes, they have that option available to them. Google isn't stopping them.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Releasing Windows bugs is Microsoft's job.
Im all for bring this up. We need much more of it. Its long time overdue bugs where kept secret for the few.
Don't be evil, bros!
Good to see Google living up to their motto by drumming up the same typical bullshit FUD about Microsoft to scare people away from Windows and onto Chromebooks and Android devices.
Because I'm REALLY sure Google gives a tin shit about my grandma's security. Right. That's the only reason they're drumming so hard on Windows. This isn't pre-emptive strikes on Microsoft because suddenly Microsoft is playing seriously in the datacenter, cloud, and mobile space where Google wants to make money...
Both vulnerabilities are weak. One it's a simple info disclosure without any potential dangerous information being disclosed and the other one doesn't really get you much unless you use it with at least another exploit. So big deal, it was priority 50 on their list. There's no evidence Microsoft acted irresponsibly. For all you guys know Microsoft patched other 50 serious security flaws and they've dragged their feet on 2 measly ones.