Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google Releases More Windows Bugs

Posted by Soulskill on from the speak-softly-and-carry-a-big-bugtracker dept.

An anonymous reader writes: Just days after Google angered Microsoft by releasing information about a Windows security flaw, they've now released two more. "The more serious of the two allows an attacker to impersonate an authorized user, and then decrypt or encrypt data on a Windows 7 or Windows 8.1 device. Google reported that bug to Microsoft on Oct. 17, 2014, and made some background information and a proof-of-concept exploit public on Thursday. Project Zero is composed of several Google security engineers who investigate not only the company's own software, but that of other vendors as well. After reporting a flaw, Project Zero starts a 90-day clock, then automatically publicly posts details and sample attack code if the bug has not been patched." Microsoft says there's no evidence these flaws have been successfully exploited.

6 of 263 comments (clear)

  1. Hope the trend continues. by 140Mandak262Jamuna · · Score: 5, Interesting
    I wish Apple would also pitch in and find and publish bugs in both Windows and Android. And Microsoft to retaliate by finding and reporting bugs in Android and Apple. In the end we as consumers will benefit. This should be come the norm. No longer minor players report possible bugs and the clock does not run till the company "accepts" that there is a bug.

    Free markets! Competition!! That is what made America, what it is.

    I wish such fierce competition exists in all spheres of the economy.

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
    1. Re:Hope the trend continues. by turbidostato · · Score: 5, Insightful

      "Except without the public posting of them."

      Except the menace of the public posting seems to be the only way for the vendor to move forward.

      Is my bet that if Microsoft were doing their best effort to patch the bug and keep informed Google about it and the expected resolution time, they wouldn't have released the information.

  2. 90 days may be a little short by Lawrence_Bird · · Score: 5, Insightful

    but in principle I agree with what Google is doing. In effect they are trying to destroy the market for zero day exploits and forcing the companies involved to not site on their hands and hope nobody uses them.. like cybercriminals and the various three letter agencies.

    1. Re:90 days may be a little short by Anonymous Coward · · Score: 5, Insightful

      This is a situation where the "slippery slope" argument really does apply. If Google is just going to sit on bugs until the vendor patches... they're going to end up with bedsores. And no one likes bedsores.

      Instead, they embarass the vendors a couple times, and once heads are pulled out of asses and people realize they're not screwing around, they start taking these things seriously.

      That's my guess, anyway.

  3. 90 days is really long by dwheeler · · Score: 5, Informative

    90 days is really long. The US CERT vulnerability disclosure policy is 45 days as described in http://www.cert.org/vulnerabil... (see that more more details). The problem is that you have to balance two conflicting needs; in the words of the CERT, "the need of the public to be informed of security vulnerabilities with vendors' need for time to respond effectively."

    --
    - David A. Wheeler (see my Secure Programming HOWTO)
  4. Re:No evidence by RelaxedTension · · Score: 5, Insightful

    "Microsoft says there's no evidence these flaws haven't been successfully exploited."

    FTFY.