3 ms·

There's no need to know the actual details of exploit to provide workarounds, if they exist. If they don't, everybody has to wait for Microsoft anyway, but the

by acqq 10y ago

There's no need to know the actual details of exploit to provide workarounds, if they exist. If they don't, everybody has to wait for Microsoft anyway, but the malware authors get one now famous 0-day. Instead of being used exclusively, it get to be available to everybody before Microsoft publishes the fix. And that is only in the interest of Google, not the customers. When today's Google writes something "gives clear benefits" you can almost imagine them as the film villain saying to the camera with the wink afterwards "for us, muahhaha." In this case I actually agree with Microsoft and with what they write: "We believe responsible technology industry participation puts the customer first, and requires coordinated vulnerability disclosure. Google’s decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk." Edit: The distinction is important: the "malware authors" that have the access to the 0-day before Google publishes it are a minority of all malware authors: 0-days are carefully guarded and have high price. The moment Google publishes the details, the whole malware community has an access to something that is provably 0-day working exploit. The difference is huge, more orders of magnitude, up to every script kiddie.

tomp 10y ago
> And that is only in the interest of Google, not the customers Long term, it's in the interest of the customers as well - that's the only way to encourage ocmpanies to be releasing fixes sooner!
kbenson 10y ago
> but the malware authors get one now famous 0-day. They already had that. That's what active exploitation means. It's not a 0-day after it's known. > And that is only in the interest of Google, not the customers. Sure. Just like newspapers report misconduct and it's only in the interest of themselves, not their customers. You seem to be under the impression that companies will endeavor to fix the problems as quick as possible no matter what, and that public exposure won't change that timeline at all. History tells a different story Edit for your edit: > 0-days are carefully guarded and have high price. They are carefully guarded because every use risks discovery of the exploit which reduces its value. Being identified in the wild to the level seen here, or at least to the degree of importance here, indicates that the can't already out of the bag. You can assume being used in a high level attack like this effectively eliminates it as a zero day at some point, as forensics will be done. I wouldn't be surprised if the exploit was dumped to the general malware public as soon as the hack was made public, which also helps to obscure the origin slightly. > The moment Google publishes the details, the whole malware community has an access to something that is provably 0-day working exploit. The difference is huge, more orders of magnitude, up to every script kiddie. You act like we can reliably make predictions about what will happen if not released. It's entirely possible it could, would or has been dumped to the greater malware community already, and not releasing the details will just allow those same script kiddies access to a populace that hasn't had a chance to mitigate the attacks. When presented with the option to keep information about danger to the greater populace secret or take it live when taking it live allows people to take their own actions to protect themselves, you take it live. Preventing people from taking their safety into their own hands by hoarding the information is immoral. It actively prevents them from protecting themselves.
- acqq 10y ago
  How do you imagine any company actively "protecting" from this specific attack vector by knowing exactly these details? I am able to extract the details for making the attack and I just can't imagine. The attackers are faster, exactly during the time between the publishing by Google and the patch by Microsoft it's the attackers who are better off by the orders of magnitude. Unless you give some specific examples, I assume you don't know what you're talking about.
  - kbenson 10y ago
    > How do you imagine any company actively "protecting" from this specific attack vector by knowing exactly these details? Adobe patched flash before it public. Chrome protects from the specific Windows problem. Using Chrome for the time between the announcement and a fix would mitigate the attack. This course of action would leave anyone who was not already donig it safer, and in this case is easy to do. > The attackers are faster, exactly during the time between the publishing by Google and the patch by Microsoft it's the attackers who are better off by the orders of magnitude. As I said above, an easy mitigation exists above. Using Chrome for a few days if you weren't already if all you have to do to protect yourself from remote execution of this until it's patched. It's not any one person or organization's place to decide the course of action for everyone else because they have secret information. The responsible thing to do if people have the the ability to change how it affects them is to disclose this information. To do otherwise is to make everyone's decision for them. It's the same principle that leads to the freedom of press. The people have aright to know about information that affects them when their choices matter.
    - acqq 10y ago
      > Using Chrome for the time between the announcement and a fix would mitigate the attack. This example you gave supports my claim, not yours: "they can use Chrome" is exactly something for what the public doesn't need to know exactly which API in which system DLL contains the bug when invoked under which circumstances, knowledge of which can be used to develop new attacks.
sangnoir 10y ago
> There's no need to know the actual details of exploit to provide workarounds Your premise is wrong - there is a need. The details can be used to create signatures for anti-malware software and IDSes by 3rd parties who are nimbler than Microsoft. Additionally, there is more to be worried about than just workarounds: some organisations do full-take packet capture archiving and might be interested to know if they were hacked via this flaw (retrospectively) before (more) data is exfiltrated, the sooner they are made aware of an actively-exploited bug, the better. > ... If they don't, everybody has to wait for Microsoft anyway, but the malware authors get one now famous 0-day Wrong again: there is no need to wait for Microsoft for the reasons I mentioned above. Before this, only the bad guys knew about the exploit, now the good guys also know about it and may work to mitigate it. We have no idea how well-known this exploit was in underground forums, so it is hard to quantify how many more bad guys know it for certain.
- acqq 10y ago
  > The details can be used to create signatures for anti-malware software and IDSes by 3rd parties who are nimbler than Microsoft. No, you don't need to publish the details of the vulnerability to the public in order to cooperate among the anti-virus vendors. > some organisations do full-take packet capture archiving and might be interested to know if they were hacked via this flaw Observing full packets has nothing to do with giving to the public the details of which system API flaw was used for the attack.

by acqq 10y ago

tomp 10y ago

> And that is only in the interest of Google, not the customers Long term, it's in the interest of the customers as well - that's the only way to encourage ocmpanies to be releasing fixes sooner!

kbenson 10y ago

> but the malware authors get one now famous 0-day. They already had that. That's what active exploitation means. It's not a 0-day after it's known. > And that is only in the interest of Google, not the customers. Sure. Just like newspapers report misconduct and it's only in the interest of themselves, not their customers. You seem to be under the impression that companies will endeavor to fix the problems as quick as possible no matter what, and that public exposure won't change that timeline at all. History tells a different story Edit for your edit: > 0-days are carefully guarded and have high price. They are carefully guarded because every use risks discovery of the exploit which reduces its value. Being identified in the wild to the level seen here, or at least to the degree of importance here, indicates that the can't already out of the bag. You can assume being used in a high level attack like this effectively eliminates it as a zero day at some point, as forensics will be done. I wouldn't be surprised if the exploit was dumped to the general malware public as soon as the hack was made public, which also helps to obscure the origin slightly. > The moment Google publishes the details, the whole malware community has an access to something that is provably 0-day working exploit. The difference is huge, more orders of magnitude, up to every script kiddie. You act like we can reliably make predictions about what will happen if not released. It's entirely possible it could, would or has been dumped to the greater malware community already, and not releasing the details will just allow those same script kiddies access to a populace that hasn't had a chance to mitigate the attacks. When presented with the option to keep information about danger to the greater populace secret or take it live when taking it live allows people to take their own actions to protect themselves, you take it live. Preventing people from taking their safety into their own hands by hoarding the information is immoral. It actively prevents them from protecting themselves.

acqq 10y ago
How do you imagine any company actively "protecting" from this specific attack vector by knowing exactly these details? I am able to extract the details for making the attack and I just can't imagine. The attackers are faster, exactly during the time between the publishing by Google and the patch by Microsoft it's the attackers who are better off by the orders of magnitude. Unless you give some specific examples, I assume you don't know what you're talking about.
- kbenson 10y ago
  > How do you imagine any company actively "protecting" from this specific attack vector by knowing exactly these details? Adobe patched flash before it public. Chrome protects from the specific Windows problem. Using Chrome for the time between the announcement and a fix would mitigate the attack. This course of action would leave anyone who was not already donig it safer, and in this case is easy to do. > The attackers are faster, exactly during the time between the publishing by Google and the patch by Microsoft it's the attackers who are better off by the orders of magnitude. As I said above, an easy mitigation exists above. Using Chrome for a few days if you weren't already if all you have to do to protect yourself from remote execution of this until it's patched. It's not any one person or organization's place to decide the course of action for everyone else because they have secret information. The responsible thing to do if people have the the ability to change how it affects them is to disclose this information. To do otherwise is to make everyone's decision for them. It's the same principle that leads to the freedom of press. The people have aright to know about information that affects them when their choices matter.
  - acqq 10y ago
    > Using Chrome for the time between the announcement and a fix would mitigate the attack. This example you gave supports my claim, not yours: "they can use Chrome" is exactly something for what the public doesn't need to know exactly which API in which system DLL contains the bug when invoked under which circumstances, knowledge of which can be used to develop new attacks.

sangnoir 10y ago

> There's no need to know the actual details of exploit to provide workarounds Your premise is wrong - there is a need. The details can be used to create signatures for anti-malware software and IDSes by 3rd parties who are nimbler than Microsoft. Additionally, there is more to be worried about than just workarounds: some organisations do full-take packet capture archiving and might be interested to know if they were hacked via this flaw (retrospectively) before (more) data is exfiltrated, the sooner they are made aware of an actively-exploited bug, the better. > ... If they don't, everybody has to wait for Microsoft anyway, but the malware authors get one now famous 0-day Wrong again: there is no need to wait for Microsoft for the reasons I mentioned above. Before this, only the bad guys knew about the exploit, now the good guys also know about it and may work to mitigate it. We have no idea how well-known this exploit was in underground forums, so it is hard to quantify how many more bad guys know it for certain.

acqq 10y ago
> The details can be used to create signatures for anti-malware software and IDSes by 3rd parties who are nimbler than Microsoft. No, you don't need to publish the details of the vulnerability to the public in order to cooperate among the anti-virus vendors. > some organisations do full-take packet capture archiving and might be interested to know if they were hacked via this flaw Observing full packets has nothing to do with giving to the public the details of which system API flaw was used for the attack.