5 ms·
> Microsoft Says Russian Hackers Exploited Flaw In Windows > (And Blames Google) Jedd Says Microsoft Should Have Fixed The Exploit Yes, it sounds like a shor
by Jedd 10y ago
> Microsoft Says Russian Hackers Exploited Flaw In Windows
> (And Blames Google)
Jedd Says Microsoft Should Have Fixed The Exploit
Yes, it sounds like a short notice period (5 days or so?).
But ... from the chronology it's sounding like this particular exploit was performed long before Google revealed the vulnerability, and indeed a goodly time before Google reported that vulnerability on the hush to Microsoft, so I can't see how it's Google's fault.
EDIT: And, as per sentiment expressed by world+dog in previous threads about this particular event, Google's observation that exploits were already in the wild is the most important aspect of this story. If a vulnerability exists for some software I'm using, and I don't know about it but the bad guys do ... I want to be told. I may not be able to patch, but I can mitigate.
- mordocai 10y ago> Yes, it sounds like a short notice period (5 days or so?). 7 day notice period as per google's usual policy.
- celticninja 10y agoI imagine that applies if there is no evidence that the bug is being exploited. When evidence exists that it is being exploited perhaps it doesn't apply.
- CiPHPerCoder 10y agoOther way around. Actively exploited: 7 days. Generally: 90 days. There are probably other caveats, but they're not interesting here.
- mtgx 10y agoAnd Google actually revealed it 10 days later (after the weekend, I guess).
- cm2187 10y agoSo you think you are safer now that every single bad guy knows about it instead of one bad guy?
- CaptSpify 10y agoIt's safer because now users/administrators know about the issue and can watch for the exploit being abused.
- NetStrikeForce 10y agoApparently it was only exploited by a single state actor. Now anyone can exploit it. Thousands of small companies with no DPI are screwed up until the patch arrives. Way to go, Google.
- CaptSpify 10y agoDPI? Anyone could have exploited it before. Now people know it's exploitable. I'm still on Google's side here (as much as it pains me to say it). Making the vuln known is the best course of action.
- EdHominem 10y ago> Thousands of small companies with no DPI are screwed They were anyways. > Apparently it was only exploited by a single state actor. We don't actually know that. In fact, it's amazingly unlikely. > Way to go, Google. Suck it up and use the vulnerability as an excuse to implement better procedures. It'll only be worse tomorrow...
- NetStrikeForce 10y agoAll the reports I've read point to only GRU using the exploit, which invalidates your comment completely. And the downvote I got.
- CaptSpify 10y ago