4 ms·

Google's behavior seems strange: http://www.theverge.com/2016/10/31/13481502/windows-vulnerability-sandbox-google-microsoft-disclosure http://www.theverge.com/

by acqq 10y ago

Google's behavior seems strange: http://www.theverge.com/2016/10/31/13481502/windows-vulnerability-sandbox-google-microsoft-disclosure http://www.theverge.com/2016/10/31/13481502/windows-vulnerab... "Google went public just 10 days after reporting the bug to Microsoft, before a patch could be coded and deployed. The result is that, while Google has already deployed a fix to protect Chrome users, Windows itself is still vulnerable — and now, everybody knows it."

DrewHintz 10y ago
https://security.googleblog.com/2013/05/disclosure-timeline-for-vulnerabilities.html https://security.googleblog.com/2013/05/disclosure-timeline-...
- acqq 10y ago
  I know about that post from 2013 and I still don't agree. Just like I don't agree with how Google implemented AMP, making google.com a link redirector that didn't exist before and was actually used in the fishing campaign, specifically: http://seclists.org/bugtraq/2016/Apr/70 http://seclists.org/bugtraq/2016/Apr/70 That is what was actively used to fish the logins from Podesta et al. Google's response: https://sites.google.com/site/bughunteruniversity/nonvuln/open-redirect https://sites.google.com/site/bughunteruniversity/nonvuln/op... "tooltips are not a reliable security indicator" Translation: "we don't look at that sh.t" "poses very little practical risk." See how Podesta et al. were tricked. "offers fairly clear benefits" Translation: "For us. Muahhaha."
kbenson 10y ago
IIRC from when this was originally reported, this was already being exploited in the wild prior to release. The only reason to not go public is to give the vendor a chance to patch it prior to general exploits being available. If exploits are already happening, waiting only endangers more people as they can't take actions to mitigate a danger themselves if they don't know about it.
- acqq 10y ago
  There's no need to know the actual details of exploit to provide workarounds, if they exist. If they don't, everybody has to wait for Microsoft anyway, but the malware authors get one now famous 0-day. Instead of being used exclusively, it get to be available to everybody before Microsoft publishes the fix. And that is only in the interest of Google, not the customers. When today's Google writes something "gives clear benefits" you can almost imagine them as the film villain saying to the camera with the wink afterwards "for us, muahhaha." In this case I actually agree with Microsoft and with what they write: "We believe responsible technology industry participation puts the customer first, and requires coordinated vulnerability disclosure. Google’s decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk." Edit: The distinction is important: the "malware authors" that have the access to the 0-day before Google publishes it are a minority of all malware authors: 0-days are carefully guarded and have high price. The moment Google publishes the details, the whole malware community has an access to something that is provably 0-day working exploit. The difference is huge, more orders of magnitude, up to every script kiddie.
  - tomp 10y ago
    > And that is only in the interest of Google, not the customers Long term, it's in the interest of the customers as well - that's the only way to encourage ocmpanies to be releasing fixes sooner!
  - kbenson 10y ago
    > but the malware authors get one now famous 0-day. They already had that. That's what active exploitation means. It's not a 0-day after it's known. > And that is only in the interest of Google, not the customers. Sure. Just like newspapers report misconduct and it's only in the interest of themselves, not their customers. You seem to be under the impression that companies will endeavor to fix the problems as quick as possible no matter what, and that public exposure won't change that timeline at all. History tells a different story Edit for your edit: > 0-days are carefully guarded and have high price. They are carefully guarded because every use risks discovery of the exploit which reduces its value. Being identified in the wild to the level seen here, or at least to the degree of importance here, indicates that the can't already out of the bag. You can assume being used in a high level attack like this effectively eliminates it as a zero day at some point, as forensics will be done. I wouldn't be surprised if the exploit was dumped to the general malware public as soon as the hack was made public, which also helps to obscure the origin slightly. > The moment Google publishes the details, the whole malware community has an access to something that is provably 0-day working exploit. The difference is huge, more orders of magnitude, up to every script kiddie. You act like we can reliably make predictions about what will happen if not released. It's entirely possible it could, would or has been dumped to the greater malware community already, and not releasing the details will just allow those same script kiddies access to a populace that hasn't had a chance to mitigate the attacks. When presented with the option to keep information about danger to the greater populace secret or take it live when taking it live allows people to take their own actions to protect themselves, you take it live. Preventing people from taking their safety into their own hands by hoarding the information is immoral. It actively prevents them from protecting themselves.

by acqq 10y ago

DrewHintz 10y ago

https://security.googleblog.com/2013/05/disclosure-timeline-for-vulnerabilities.html https://security.googleblog.com/2013/05/disclosure-timeline-...

acqq 10y ago
I know about that post from 2013 and I still don't agree. Just like I don't agree with how Google implemented AMP, making google.com a link redirector that didn't exist before and was actually used in the fishing campaign, specifically: http://seclists.org/bugtraq/2016/Apr/70 http://seclists.org/bugtraq/2016/Apr/70 That is what was actively used to fish the logins from Podesta et al. Google's response: https://sites.google.com/site/bughunteruniversity/nonvuln/open-redirect https://sites.google.com/site/bughunteruniversity/nonvuln/op... "tooltips are not a reliable security indicator" Translation: "we don't look at that sh.t" "poses very little practical risk." See how Podesta et al. were tricked. "offers fairly clear benefits" Translation: "For us. Muahhaha."

kbenson 10y ago

IIRC from when this was originally reported, this was already being exploited in the wild prior to release. The only reason to not go public is to give the vendor a chance to patch it prior to general exploits being available. If exploits are already happening, waiting only endangers more people as they can't take actions to mitigate a danger themselves if they don't know about it.

acqq 10y ago
There's no need to know the actual details of exploit to provide workarounds, if they exist. If they don't, everybody has to wait for Microsoft anyway, but the malware authors get one now famous 0-day. Instead of being used exclusively, it get to be available to everybody before Microsoft publishes the fix. And that is only in the interest of Google, not the customers. When today's Google writes something "gives clear benefits" you can almost imagine them as the film villain saying to the camera with the wink afterwards "for us, muahhaha." In this case I actually agree with Microsoft and with what they write: "We believe responsible technology industry participation puts the customer first, and requires coordinated vulnerability disclosure. Google’s decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk." Edit: The distinction is important: the "malware authors" that have the access to the 0-day before Google publishes it are a minority of all malware authors: 0-days are carefully guarded and have high price. The moment Google publishes the details, the whole malware community has an access to something that is provably 0-day working exploit. The difference is huge, more orders of magnitude, up to every script kiddie.
- tomp 10y ago
  > And that is only in the interest of Google, not the customers Long term, it's in the interest of the customers as well - that's the only way to encourage ocmpanies to be releasing fixes sooner!
- kbenson 10y ago
  > but the malware authors get one now famous 0-day. They already had that. That's what active exploitation means. It's not a 0-day after it's known. > And that is only in the interest of Google, not the customers. Sure. Just like newspapers report misconduct and it's only in the interest of themselves, not their customers. You seem to be under the impression that companies will endeavor to fix the problems as quick as possible no matter what, and that public exposure won't change that timeline at all. History tells a different story Edit for your edit: > 0-days are carefully guarded and have high price. They are carefully guarded because every use risks discovery of the exploit which reduces its value. Being identified in the wild to the level seen here, or at least to the degree of importance here, indicates that the can't already out of the bag. You can assume being used in a high level attack like this effectively eliminates it as a zero day at some point, as forensics will be done. I wouldn't be surprised if the exploit was dumped to the general malware public as soon as the hack was made public, which also helps to obscure the origin slightly. > The moment Google publishes the details, the whole malware community has an access to something that is provably 0-day working exploit. The difference is huge, more orders of magnitude, up to every script kiddie. You act like we can reliably make predictions about what will happen if not released. It's entirely possible it could, would or has been dumped to the greater malware community already, and not releasing the details will just allow those same script kiddies access to a populace that hasn't had a chance to mitigate the attacks. When presented with the option to keep information about danger to the greater populace secret or take it live when taking it live allows people to take their own actions to protect themselves, you take it live. Preventing people from taking their safety into their own hands by hoarding the information is immoral. It actively prevents them from protecting themselves.