Slashdot Mirror
Google Releases More Windows Bugs
An anonymous reader writes: Just days after Google angered Microsoft by releasing information about a Windows security flaw, they've now released two more. "The more serious of the two allows an attacker to impersonate an authorized user, and then decrypt or encrypt data on a Windows 7 or Windows 8.1 device. Google reported that bug to Microsoft on Oct. 17, 2014, and made some background information and a proof-of-concept exploit public on Thursday. Project Zero is composed of several Google security engineers who investigate not only the company's own software, but that of other vendors as well. After reporting a flaw, Project Zero starts a 90-day clock, then automatically publicly posts details and sample attack code if the bug has not been patched." Microsoft says there's no evidence these flaws have been successfully exploited.
Microsoft: "There's no evidence these flaws have been successfully exploited."
Google: "Then why are you wearing that fake mustache and goatee?"
Free markets! Competition!! That is what made America, what it is.
I wish such fierce competition exists in all spheres of the economy.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
but in principle I agree with what Google is doing. In effect they are trying to destroy the market for zero day exploits and forcing the companies involved to not site on their hands and hope nobody uses them.. like cybercriminals and the various three letter agencies.
Like Bing doesn't sell data it collected either.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
90 days is really long. The US CERT vulnerability disclosure policy is 45 days as described in http://www.cert.org/vulnerabil... (see that more more details). The problem is that you have to balance two conflicting needs; in the words of the CERT, "the need of the public to be informed of security vulnerabilities with vendors' need for time to respond effectively."
- David A. Wheeler (see my Secure Programming HOWTO)
"And that fact negates the OPs comment how?"
By stating that since Microsoft business practices equal those of Google and then more, it can't be followed that Google is any more evil than Microsoft.
Signed: Captain "So I thought" Obvious
Because the claim was "they're probably MORE evil" which is a relative claim and hence "they do it too" is in fact a valid argument.
I'm reminded of Neal Stephenson's description of Shanghai banks on the eve of World War 2:
Continue reading ...
-kgj
I mean the whole point of doing these types of investigations is to slap the competition in the face.
It little behooves the best of us to comment on the rest of us.
It should read "Google discloses more Windows bugs."
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
"Oh that's an old version, we aren't going to patch the bug." Really? That's an acceptable response that something that's 3 years old is too old to patch? But somehow, taking 100 days to patch a product that's 5 years old (in 7's case) is too long? Much easier to deal with patch issues if you just declare you only support the latest greatest and require everyone to upgrade all the time, no matter the issues.
MS's response is particularly understandable given the complexity of doing regression testing on the wide variety of hardware, software, and patch sets the patch might need to be applied against. If they released it and it caused issues, well then people would cry even more about how shitty they were for not testing it.
I think you are right about the mud slinging/political office: What with Chrome books Google now wishes to directly attack MS. They want to make Windows look bad, and thus make their own product look good by comparison. This isn't motivated by being a good citizen, it is motivated by something else.
For that matter one can get all conspiracy theorist and say maybe they chose their reporting date knowing MS's patch cycle to try and create just such a situation.
From the bug link:
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public
.
Mod me down, my New Earth Global Warmingist friends!
But to my knowledge that is the only way Google makes any money at all, and, since Google has a higher market cap than Microsoft who also sells a lot of for profit software, I can only assume that Google sells a lot more information. Every tool Google provides for consumers is a data mining tool that is funded solely by data mining. Microsoft actually sells stuff that you can buy and use without agreeing to allow your data to be mined.
This is degenerate behavior.
Years (decades, now) ago, it was normal to publish vulnerabilities and exploits and discuss them and (try to) force vendors to act.
What is happening now is degenerate.
Talk about blatant extortion... Perhaps Google should be more concerned about patching the 1,001 vulnerabilities in Android before casting stones at others.
For example, how about this: http://www.extremetech.com/mob...
That's a inappropriate comparison.
To patch that vulnerability would require the ability to update Android on existing handsets.
For this to work, the handset manufacturers would have to provide a new version of Android for the given handset.
For this to work, the Android development model of "partner, not Google, productizes Android" would have to change.
For this to work, there would have to be ongoing development on an older hardware platform.
For this to work, there would have to be carrier involvement in certification.
For this to work, the carrier revenue model of locking you into a two year contract every 18 months would have to change.
--
It's in absolutely no ones financial interest to provide updates to Android in already shipped handsets, and Google is not in a position, as an OS supplier, rather than a phone vendor (which is what Apple is), to force changes in operational model into the carrier or the partner device vendor.
U.S. Carriers are *NOT* going to change their revenue model just so people can buy ala carte devices that will work with any carrier, and cost more up front for you to go with their service, rather than rolling it into the monthly payment when you go with a competitors service. Everyone would have to change at once (collusion, a violation of both the Sherman Antitrust Act and the RICO Statutes, and definitely something that would be prosecuted), or the carrier that tried to move to the European model would find itself out of business.
Likewise, the handset vendors, whose revenue model is completely built on thin margins, but selling a new handset every 18 months, instead of you buying one and keeping it for 10 years, would have to charge higher margin on their device sales in order to keep their revenue numbers up, and to pay for the R&D ongoing on the already-sold platform. And then they'd need to change their FAS accounting to match that of Apple's, or face charges under Sarbanes-Oxley, which is what Apple had to do before it could give away the WiFi updates to 802.11g/n for iPods. You'll (maybe) remember that they got a percentage of the monthly wireless fee from the carrier for iPhones, but realized their income at time of sale on iPod Touch and non-3G iPads, and so they had to charge $5 for the update.
And seriously, would you be willing to pay $5 for a bug fix for a bug you were pretty sure wasn't impacting you anyway, and was just some security "researcher" throwing a hissy fit to get their company name in the news so they got audit contracts out of it?
> Microsoft says there's no evidence these flaws have been successfully exploited.
Cleverly worded sentence intended to leave the reader with the impression:
"We don't know that there has been a breach, therefore there hasn't been a breach"
when it really means...
"We don't know squat about whether there has been a breach. Maybe all hell has broken lose, and there's no evidence to contradict that either."
MS still holds a lot of Android patents. They can easily do an Apple and forbid use of them, which will completely paralyze Android.
What you mean all those patents that the Chinese outted and nearly the entire tech world found to be not relevant save about as many as you can count on your hands? Yeah, that's really going to stop Android...
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
I can only assume that Google sells a lot more information.
Google collects information. Google uses that information to determine what ads to show users. But unlike other companies, Google does NOT sell that information.
I'm a leaf on the wind. Watch how I soar.