Slashdot Mirror
Google Discloses Exploited Windows Vulnerability 10 Days After Telling Microsoft (venturebeat.com)
An anonymous reader writes: Google today shared details about a security flaw in Windows, just 10 days after disclosing it to Microsoft on October 21. To make matters worse, Google says it is aware that this critical Windows vulnerability is being actively exploited in the wild. That means attackers have already written code for this specific security hole and are using it to break into Windows systems.In a blog post, security researchers at Google write, "The Windows vulnerability is a local privilege escalation in the Windows kernel that can be used as a security sandbox escape. It can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD. Chrome's sandbox blocks win32k.sys system calls using the Win32k lockdown mitigation on Windows 10, which prevents exploitation of this sandbox escape vulnerability."
I found the final sentance a little confusing. Does this affect all versions of Windows, or just older ones?
With no exploit in the wild, Google should quietly inform MS. With an exploit in the wild, it has already been publicly disclosed, but to a limited audience, so Google should disclose widely, so everyone is informed of the exploits.
What in that behavior do you find unethical?
Learn to love Alaska
Interesting this comes mere days after the story that Google sat on an Apple vulnerability for 5-months? Though maybe given this is being actively exploited the treatment is justifiably different...
Everyone has vulnerabilities, because there are just too many inconceivable ways that protective measures might be bypassed. As such, teamwork between providers is the key; just because the other guy's platform is doesn't mean yours can't also be sunk, especially in this interconnected world of botnets.
If this vulnerability wasn't part of the fixes in last patch Tuesday Google - OR anyone - should keep their mouths shut until the provider has had a chance to patch it, and patch it right. There's nothing worse than a rushed patch that fixes the specific problem but leaves the family of vulnerability open, resulting in more exploits and patches down the road.
Google must think their computing platform is sitting pretty, what with Chromebooks seemingly not having these problems. I'm just waiting for the first ChromeOS/cloud propagated malware to make them look foolish.
g=
Not only that, the arguably ethical thing to do is to always disclose. In most cases the exploits are being actively used (see previous link).
Irresponsible disclosure is responsible
Vulns. already being exploited in the wild are published 7 days after reporting it to the vendor. This is nothing new and is Google's policy on this (dated 2013).
See: https://security.googleblog.com/2013/05/disclosure-timeline-for-vulnerabilities.html
Sleazy attempt to paint Google in a bad way. This flaw is already being exploited, the bad guys already know about it!
Apple Market Share: 3-5%
Windows Market Share: 90%
Everything else: Math%
Google wants to put as much pressure on MS to get them to fix the problem as quickly as possible as this vulnerability affects the largest market share of Google's Product.
We all know all those windows users will blame Chrome for infecting their machine Because Reasons(TM) so let Google force MS into fixing this issue ASAP.
Apple's vulnerability? Who cares, it affects a microcosm of Google's user base.
Wheel of Time: Book by Book and Sumview (summary review) Bigdady92 style: http://bigdady92.blogspot.com/
Oh, that's easy. When the companies audit their code to get their security ratings for government contracts, they report their findings to the NSA. Then, the Chinese and Russian hackers hack the NSA and download the reports. Then, when the Russian and Chinese hackers defect to Europe, they bring those reports and hand them over to the GHCQ. Along with, I'm going to say, plutonium. Hi guys! Anywhoo, then the GHCQ outsources writing the code to exploit the weaknesses detailed in the reports to India or Pakistan. You know, because why not? So basically by the time you hear about a security flaw being exploited, pretty much everyone in the world already knows about it anyway.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
My guess: they probably have the source code to Windows.
Yes, because if not for Google, no one would ever have heard that Windows has vulnerabilities.
Which thank goodness only means someone has to be ignorant enough to download & execute a malware for it to work
... proceeds to link to some EXE file ...
First it starts with having an understanding of what's going on. Then it continues with realizing that an assumption isn't necessarily true, and finishes with finding a means to force that assumption to be invalid.
One of my favorite exploits is a privilege-escalation issue on very old Linux systems. In short, you run a program that crashes and drops raw memory into cron's job folder, and when cron looks at the dump, it sees something that looks like a job spec, so cron happily runs whatever was in that memory dump, as root.
This exploit existed because Linux would assume that dropping a file would always be a safe thing to do, while cron assumed that only root would be able to drop files in its job folder. Together, they made a vulnerability.
You do not have a moral or legal right to do absolutely anything you want.
The VentureBeat article has been updated with a response from Microsoft:
"We believe in coordinated vulnerability disclosure, and today's disclosure by Google puts customers at potential risk," a Microsoft spokesperson told VentureBeat. "Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible. We recommend customers use Windows 10 and the Microsoft Edge browser for the best protection."
What the hell are they smoking? Apple, the various Linux distributions, and the BSDs all are committed to "investigating reported security issues and proactively updating impacted devices as soon as possible." They all routinely release immediate updates for critical exploits. I think even Cisco's IOS has a better track record than Windows in time-to-fix for critical vulnerabilities.
Probably because it's exploited.
If it wasn't exploited, Microsoft has a full 90 days. As it is exploited, well, telling doesn't really hurt anyone - they gave Microsoft a heads up and well, telling people about it doesn't really hurt anyone.
The Apple one probably wasn't exploited so Google gave extra time knowing it's a tricky bug to fix.
But once a bug is exploited, there's no advantage to holding back. Microsoft got 10 days to find a mitigation (and for an active exploit, probably reasonable) before it would be revealed to all.
Unlike the Apple vulnerability, Google knew that the Microsoft vulnerability was currently being exploited. This looks like it's more of a case of making an active exploit known to the public at large, instead of disclosing an otherwise unknown vulnerability.
I notice you failed to answer the question. I take it to mean you've never worked in a company that gave their programmers time to make sure the software was secure.
In most companies it's the opposite: the "rush to market" is so important that security can "wait until later."
"First they came for the slanderers and i said nothing."
No, the difference is that the Windows exploit is being actively used in the wild by malware. It's better to know about it so we can mitigate the risk as much as possible.
In Apple's case no-one was taking advantage of the flaw, as far as we know, so it was better to keep it quiet while they fixed it.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Once actively exploited, the proper response is to publicly announce the exploit. This is standard and acceptable practice. Someone is grinding an anti-google axe on this non-story.
OT: Which version of Firefox did you say was safe? Version 43? 44? or 45?
Thanks.
Remember there are companies who store passwords in plaintext. That is not only idiotic, anyone with half a brain knows not to do that.
My mind always boggles when I click a recover password link, and get my old password emailed to me in plain-text.
The goal of keeping mum on security vulnerability until the vendor fixes it is to prevent potential attackers from learning about the vulnerability. The discoverer decides that users of the software are better off not knowing about the problem because they'd rather attackers don't know either.
Here, according to TFA, there are already exploits in the wild. In that situation MS users are already at risk; Google keeping mum can only hurt them (by keeping them ignorant of the vulnerability) but won't help (because the attackers already know).
If you disagree, and you're a programmer, then answer this: do your managers give you extra time on your tasks to make sure your code is secure? Have they ever encouraged you to care about security, or is it the opposite? Do the encourage you to treat user-input carefully, and as a potential exploit?
Yes, yes and yes.
Further, there are explicit security review processes at the concept, design and implementation stages (there are also privacy reviews which have a similar structure but a different focus). There are mandatory internal training courses that all developers must attend which train developers about user input validation as well as considerably more sophisticated security issues. There are teams whose entire focus is security, to build secure infrastructural components which make it difficult for the general developer population to build insecure software. There are other teams whose whole job is to find vulnerabilities. There are large systems that do nothing but automated fuzz testing of our products. Third party penetration testing teams are regularly hired to attempt to find vulnerabilities, and those teams are given the wholehearted support of the development teams, and full access to all relevant information. External researchers are paid hefty bug bounties for reports of vulnerabilities in our products. Discovery of security vulnerabilities provokes a post-mortem process to analyze how the vulnerability was created and to identify what changes to tooling, processes or training could have prevented the vulnerability from being created.
And you know what? There are still security bugs.
Yes, software companies should make a serious attempt to write secure code. No, it is not reasonable to expect that they'll succeed, not in the general case, not without increasing the cost of software by two or three orders of magnitude. Reasonable effort in design and implementation, defense in depth, actively seeking vulnerabilities and aggressive patch deployment are the best we know how to do in the general case.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
It's that or someone is "impersonating me" again (no 1st by any means, lol).
If only there were some way to "authenticate" a user on a forum website, so everybody could be sure that a particular person is posting...
APK
Back in the mid 80s, I did some work at JPL with the late Dan Alderson. Generally speaking, an if/else if sequence ends without another if because all possible cases have been listed. Dan, however, would use a final if, specifying what should be the only possible situation, with an else aborting the program with the comment "1 = 2" to indicate an unexpected situation rather than continue. I never saw it come up, but he did tell me once that it had happened a few times.
Good, inexpensive web hosting
See again: I'm mildy retarded
APK
P.S.=> lol
Apple Market Share: 3-5% Windows Market Share: 90% Everything else: Math%
Not in phones, tablets, servers, supercomputers, etc.
FTA: "A source close to the company also shared that the exploit Google describes requires the Adobe Flash vulnerability. Since Flash has been patched, the Windows vulnerability is mitigated."
OK, thanks for the clarification. Must have been another AC. :-/
How does that make matters worse? Exploit being used in the wild is the standard reason to expedite public disclosure. If the bad guys already know about the bug, there is no sense in keeping the legitimate users in the dark.
Shachar
Even if the software developer took every precaution and followed current methodologies to prevent vulnerabilities in their software, there is still a chance that a vulnerability exists.
My point is that when disclosing, you should take into consideration whether the software developers were following best practices or not. 99% of the time, the answer is: not.
Irresponsible disclosure is responsible
this security issue is found, reported, confirmed to be exploited in the wild.
yet MS will release a patch next week...
no comments on this? i mean, that local exploit on linux (dirty cow) was patched in an instant and every major distro had the patch available within a day.
On a long enough timeline, the survival rate for everyone drops to zero.
Depends on how widespread it seems to be really, if there are relatively few instances then it might make sense to not publish it make the entire world aware of it.