3 ms·

At least now you know what to defend against. Also, how do you know that only one bad guy knows about it? If it's in a wild, all the bad guys will know about it

by kbart 10y ago

At least now you know what to defend against. Also, how do you know that only one bad guy knows about it? If it's in a wild, all the bad guys will know about it sooner rather than later anyway.

forgottenpass 10y ago
How do I turn the specific knowledge of the exploit into a more meaningful defense than if I had vague knowledge there is a windows zero-day actively in the wild? I'm not asking snidely. I legit want to know how this is leveraged in defense and what/how I can do. Is it common practice in the pre-patch period to enable some sort of system call tracing that monitors for (and/or kills) processes that use the vulnerable call in a way described by the google blogpost? Or is there a sandboxing solution where I can blacklist filter certain uses of system calls?
- EdHominem 10y ago
  > How do I turn the specific knowledge of the exploit into a more meaningful defense than if [...] By being able to raise an alarm and allocate actual time to fixing/mitigating it, unlike if it was only a vague warning. We know that there's never been a day where Windows didn't have a critical, remote-code execution, security flaw. Obviously if you're still using it management isn't doing anything proactive to improve security so you need these motivators.
cm2187 10y ago
> At least now you know what to defend against Who is "you"? Do you realistically think the hundred of millions of Windows Servers out there are actively managed by a team of security experts who have the expertise to go under the skin of new security vulnerabilities in a matter of hours and deploy a mitigating strategy?
- Bartweiss 10y ago
  I mean, no, but you can't actually account for the worst security results. Heartbleed is still unpatched in a lot of places, but there's really no disclosure strategy capable of improving that. Even a low-skilled maintenance team can be on heightened lookout for compromised accounts and illicit connections. I'm not sure I back Google here, though. Generally, I think active exploits are reasonable to disclose, but Microsoft had a specific patching plan that would have been up in another week. It seems reasonable to accommodate requests like that when the vulnerable product is actively being fixed.
  - EdHominem 10y ago
    > Microsoft had a specific patching plan We've given Microsoft too much deference over the years. This can be a kick in their pants to make them come up with a better plan. > up in another week Sure, that's what they always say. And then the patch misses that window and it's another 90 days away. Hopefully they'll realizing the days they get to call the shots are over and they'll be driven to improve.

by kbart 10y ago

At least now you know what to defend against. Also, how do you know that only one bad guy knows about it? If it's in a wild, all the bad guys will know about it sooner rather than later anyway.

forgottenpass 10y ago

How do I turn the specific knowledge of the exploit into a more meaningful defense than if I had vague knowledge there is a windows zero-day actively in the wild? I'm not asking snidely. I legit want to know how this is leveraged in defense and what/how I can do. Is it common practice in the pre-patch period to enable some sort of system call tracing that monitors for (and/or kills) processes that use the vulnerable call in a way described by the google blogpost? Or is there a sandboxing solution where I can blacklist filter certain uses of system calls?

EdHominem 10y ago
> How do I turn the specific knowledge of the exploit into a more meaningful defense than if [...] By being able to raise an alarm and allocate actual time to fixing/mitigating it, unlike if it was only a vague warning. We know that there's never been a day where Windows didn't have a critical, remote-code execution, security flaw. Obviously if you're still using it management isn't doing anything proactive to improve security so you need these motivators.

cm2187 10y ago

> At least now you know what to defend against Who is "you"? Do you realistically think the hundred of millions of Windows Servers out there are actively managed by a team of security experts who have the expertise to go under the skin of new security vulnerabilities in a matter of hours and deploy a mitigating strategy?

Bartweiss 10y ago
I mean, no, but you can't actually account for the worst security results. Heartbleed is still unpatched in a lot of places, but there's really no disclosure strategy capable of improving that. Even a low-skilled maintenance team can be on heightened lookout for compromised accounts and illicit connections. I'm not sure I back Google here, though. Generally, I think active exploits are reasonable to disclose, but Microsoft had a specific patching plan that would have been up in another week. It seems reasonable to accommodate requests like that when the vulnerable product is actively being fixed.
- EdHominem 10y ago
  > Microsoft had a specific patching plan We've given Microsoft too much deference over the years. This can be a kick in their pants to make them come up with a better plan. > up in another week Sure, that's what they always say. And then the patch misses that window and it's another 90 days away. Hopefully they'll realizing the days they get to call the shots are over and they'll be driven to improve.