12 ms·

Hackers exploited Word flaw for months while Microsoft investigated

174 points by T-A 10y ago

gwu78 10y ago
https://mobile.twitter.com/hashbreaker/status/853224169412206593?p=p https://mobile.twitter.com/hashbreaker/status/85322416941220... The strange "counterargument" I commonly see on HN to any suggestion that Microsoft closed source software could potentially be unsafe for use on an internet-connected computer is that the company has "improved" since some earlier 1990's/2000's time period. Are these commenters suggesting that other, open source operating system choices have not also improved since that time period? Should one consider how much did each respective system need to improve? (By "other, open source operating system choices", I mean the ones that were able to connect to the internet for years before Gates decided the www was something his company should be interested in and to copy the TCP/IP stack from an open source kernel into the Windows kernel). Are there convincing arguments why Microsoft deserves special treatment compared to the open source alternatives, i.e., why their users should not be permitted to freely evaluate the Windows kernel or Office source code via the public web? Are there compelling reasons why MS users should not be allowed i.e. given the option to edit/remove source code they are uncomfortable with and recompile? Consider the effects of limiting the number of people who can find and fix defects in a product. Does closed source status of Windows make Microsoft's software superior to the longstanding open source operating system alternatives?
- jmcdiesel 10y ago
  Their users don't need to be allowed to freely evaluate the source, period. When you write software, you control its distribution. What the users are free to do, however, is use an operating system/stack that they CAN evaluate the source of. If linux or any other open source alternative was a better actual product, it would find its way to the top of the market. In fact, it already has, on the server... by far. But linux wasn't made to be easy to use, to be quick and easy to install, to install other software onto, etc... and that has kept it back, and it kept it back long enough for microsoft to establish a de-facto standard on the home desktop market... The closed or open source status of a product has no bearing over its superiority at all. Again, in the world of geeks, it may, but in the world at large, it doesn't, and really, it shouldn't.
  - beagle3 10y ago
    The sentiment of "the better product will win" is understandable, but wrong as you present it. Microsoft managed to gain a monopoly (legally or illegally - doesn't matter) and has used it to illegally keep others out, and network effects now (and for the past 20 years) have been that "goodness" measure - technical mediocrity had been sufficient (although recently they have been doing a lot of excellent technical work since the horrible 2000's) In every single field Microsoft has not been able to leverage their monopoly (e.g. Phones) they are not in a dominant position, even though in some they maintain a competitive one (Xbox one, c#, SQL server)
    - csydas 10y ago
      This is very true, since the idea of meritocracy doesn't do a lot to overcome business inertia of being in a Microsoft Environment. If there is a Linux solution that in every way exceeds a Microsoft Solution from a technical and price standpoint, you still need to weigh in the transition costs, employee costs, and the long term effect of changing. It's not always as simple as "X is better than Microsoft's Y, people will use it." There are far more things that get considered, and you can get tied down pretty heavily when your entire workflow and operations rely on a single product or vendor. The longer you've been using a product, the harder it is to get away from it. It's not that Linux isn't good or making a lot of cool progress in all realms, it's that Microsoft does "good enough" and the transition isn't seamless enough for many use cases.
    - averagewall 10y ago
      Part of why they succeeded was by being first. Linux was certainly much worse than Windows in the early days when people still used DOS together with Windows. Being first means it was massively better for those people at that time. Plan9 lost out to Linux, perhaps partly by being too late. Do we blame Linux for being horrible?
      - beagle3 10y ago
        As a user of both circa 1994 - no, Linux was definitely not worse. It was about a thousand times more stable, though it lacked e.g. A word processor. When Microsoft produced win 2 and 3, they unfairly (and likely illegally) used their DOS and then Windows monopoly to stop competitors (DR DOS, BeOS, a few lesser known ones); they later used the Windows monopoly to embed IE and kill Netscape. It didn't matter that IE was, in fact, a better browser - everyone wanted Netscape, and it was only with the IE4 merge into the OS that Microsoft took the internet. I was involved with one of the smaller and less famous Microsoft victims at the time, and I can assure you that regardless of technical merits, MS made very significant progress by playing dirty. They paid billions in court for it, but economically it was worth it to them.
- jfoutz 10y ago
  Microsoft was really really bad at security. Then the internet became a popular thing. I think an fresh xp install would, on average survive 15 minutes before getting infected by blaster. Microsoft, to their credit, improved dramatically. I don't know if they're extraordinarily good compared to other software producers. Microsoft gets the mention because it was so very bad, back in the day. It's kind of like when a very lazy person turns into a marathon runner. They made huge changes.
  - deleted 10y ago
    [deleted]
  - kbenson 10y ago
    There were versions of windows, 2000 if not XP, that could and would get infected in-between the time the network stack initialized and the local software firewall initialized a second or two later. This was actually addressed and fixed, because it was not a unique experience. That's how pervasive and wild the exploit network traffic was before MS got their act together. Edit: My google-fu is failing me, and I can't find the right keywords to find a reference to this, but I distinctly remember it. Back in the days when firewalls weren't quite as pervasive, and especially not for small colo deployments.
    - ConceptJunkie 10y ago
      I saw this first-hand when installing Windows 2000 using Parallels circa 2006. I mistakenly believed the configuration I had chosen had the VM behind the Mac's firewall, but it wasn't. The VM was infected before Windows 2000 could install the latest updates... just a matter of minutes. This is not as extreme as you are describing, but it was also on the corporate network of a large company, not the open internet.
  - secstate 10y ago
    Indeed. But becoming a marathon runner who finishes in 7 hours, after the finish line has closed, and doesn't get a medal because the cut off was 6:30 :) No, it's a great achievement, but there's still room for improvement.
- schoen 10y ago
  I don't support anyone hiding source code from users (and have given conference talks about hard-to-detect ways of backdooring binaries), and so I don't mean this to be an excuse for the secrecy of the source code, but every single person I know who's worked in the security industry agrees that Microsoft made a major qualitative improvement in their security at every level, based on spending a lot of money and giving security people power in the development process. Most people feel Microsoft is managing security better than the main Linux-based operating systems do, in terms of auditing, coding standards, code reviews, and developer security education. (That doesn't mean that they're doing this better than each and every individual open source project.) Some of the people agitating for giving Microsoft more credit about this have personally seen the results, as in-house or contracted developers or auditors. It can be hard to make an apples-to-apples comparison about what this means for the security of deployed systems because people are potentially using the systems in different ways with kind of different attack surfaces. (For example, quite a few Windows desktop users may still be downloading unsigned binaries from HTTP sites, which Linux users would be less likely to do because of the prevalence of package managers -- though maybe some of those Linux users will do the curl | sh thing from an HTTP site too.) I don't think that a typical open source project has improved to the extent that Microsoft has during this timeframe, though, again, it's hard to know exactly what to compare or how to compare it.
  - secstate 10y ago
    That's a really complete argument. But there's still the elephant in the room of the whole operation being closed source, and the inability to do quantitative analysis into the improving security of a closed source system. People on the inside can say there have been qualitative improvements, but that's not measurable on the outside and so is no better than hearsay and conjecture. Meanwhile in the GNU/Linux world, you can browse the git repositories and see and audit every step in the development process if needed. Is it possible that typical open source projects didn't NEED to improve their security over the same timeframe, given that the F/OSS world didn't fuck users over for two decades with unfixed 0days? Meanwhile, the OP here is talking about Word which is likely a world away from the improving security team working on Windows. Hell, I'm surprised they've got more than a skeleton crew working on the desktop version of Word anymore. People in my community 60+ have been using Google Docs for the last five years already.
- doggydogs94 10y ago
  We will never know the answer to your assertion until more than 1% of the OS market is open source.
- emmelaich 10y ago
  Only four minutes according to Kevin Mitnick. https://en.wikipedia.org/wiki/Microsoft_Windows#Third-party_analysis https://en.wikipedia.org/wiki/Microsoft_Windows#Third-party_...
scarybeast 10y ago
And _this_, ladies and gentlemen, is why we have disclosure deadlines for security vulnerabilities. For example, Project Zero expects vendors to fix security vulnerabilities within 90 days of notification. Looking at this story, it's possible that 90 days is almost too long and should be shortened. As time goes on, it's becoming more and more common for multiple parties to become aware of the same vulnerabilities. Not all of those parties have good intentions, as we see here. Shortening the window of exposure is key.
- nikanj 10y ago
  Next up on HN: extreme outrage after a botched security update breaks hundreds of millions of machines. Not all bugs can be fixed with a simple one-line fix, and the faster patches need to be cranked out, the lower quality they'll be.
  - flukus 10y ago
    Well yeah, if a patch for a single application broke machines then the outrage would be deserved.
  - geocar 10y ago
    Or maybe people stop shipping dogshit?
  - bitexploder 10y ago
    There was a simple settings change for a temp fix on this one too. When there is even a remote chance a bug is being exploited in the wild it needs to be disclosed. Corp IT can work around it almost always. Individuals can as well. This argument that "it's complex to patch" is a non-starter at best. We the users deserve the option to decide how to deal with it. Silent exploitation is how we all lose, even the vendor.
  - BearGoesChirp 10y ago
    In which case the users need to be informed of the security risks they are taking by using that software. Hiding risks is not the answer.
doggydogs94 10y ago
Vendors, even ones as large as Microsoft, do not have infinite resources available to evaluate vulnerabilities. There are only so many of the issues you can work on at once. They have to evaluate each issue and prioritize the fix. In this case, they merely did not recognize the potential scope of the problem at hand.
- DanielBMarkham 10y ago
  That's true, but it doesn't matter. It's still broken. That's why we have automatic release after a set time. Because it's a problem for the public even if the vendor has zero resources. The ability of the vendor to fix the problem is not related at all to the potential damage the problem can cause. Worst-case scenario? The software is shutdown and/or withdrawn from the market because the vendor can't fix it. Not that the vulnerability isn't announced. What we need is a public and open way to do this that doesn't involved walled gardens.
  - adrianN 10y ago
    I don't want anyone to be able to shutdown and/or withdraw software that I'm using for any reason. That cure is worse than the disease.
    - DanielBMarkham 10y ago
      Personally I don't want you to have to. As far as I'm concerned, if you're notified in big, red letters (perhaps every time the software starts)? Works for me. As long as you know -- and are reminded. (That's because different people use the same software. If the notice only appeared once, a new person might start using the software/machine and not be aware of what's going on) But if you had a piece of software with a terrible vulnerability that was currently being exploited to do some sort of terrible harm? Beats me. Does my right to use the internet without being DDOSed override your right to use unsafe software if you want?
      - stupidhn 10y ago
stesch 10y ago
Microsoft should hire this programmer: https://i.redd.it/sd72mfmj7ety.jpg https://i.redd.it/sd72mfmj7ety.jpg
- MikusR 10y ago
  Microsoft doesn't make software for Boeing planes.
  - stesch 10y ago
    You are funny.
    - sctb 10y ago
      Please comment civilly and substantively on Hacker News. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
HenryBemis 10y ago
I thought that it is the norm for M$ to hand out the zero-days to the 3-letter-agencies for "a while" and patches them ONLY when someone else gets hold and starts using the same vuln.. so it makes PERFECT sense that they would do something like that. Also who in their right mind allow Word/Excel/Powerpoint to access the internet? (oh yes it's called "365" and it makes software, that is completely unfit for the task, to access the internet)
- HappyTypist 10y ago
  Not sure why you're being downvoted. This is literally the company that built in "_NSAKEY" into the kernel, which is still present (just called "_KEY2" now.
  - kevingadd 10y ago
    Putting some sort of security backdoor or snooping feature into your software (likely by government order) is pretty different from 'M$ gives 0days to spy agencies and delays fixing them'. _NSAKEY, whatever it is, doesn't resemble the situation the original article is describing.
  - repples 10y ago
    If "_key2" is an public key embedded within Windows, then presumably there exists one or more holders of the private key somewhere - what exactly are they able to do with this key? I've seen a lot of concern about "_key2" and "_NSAKEY" being expressed over the years, but scant technical detail.
HappyTypist 10y ago
We need civil penalties for failing to patch any serious vulnerability (that can be defined as RCE, priv. escalation, etc) within 30 days of disclosure. If you can't patch it, you must issue a patch that announces the vuln and disables the minimal set of functionality that enables it. Even if that's the whole program.
- throwanem 10y ago
  So, turn a nontrivial set of vulns into successful DoS attacks?
  - aurelianito 10y ago
    Yes. That, in turn, will give the economic incentive to not have the vulnerabilities in the first place.
    - kobeya 10y ago
      Or for software not to get written in the first place.
      - goodplay 10y ago
        >Or for [buggy] software not to get written in the first place. FTFY We place too much trust and rely too much on computer systems these days to have the luxury to write software like we used to.
        kobeya 10y ago
        No don't twist my words. I meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. It would kill innovation.
        goodplay 10y ago
        > meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. And I'm arguing that not doing so might be a good thing. I shudder to think how we'd be off if other infrastructure disciplines took the same approach we take to develop software. If you build something that people use in important infrastructure, prepare to be on the hook if it fails.
yitchelle 10y ago
"A quick change in the settings on Word by customers would do the trick, but if Microsoft notified customers about the bug and the recommended changes, it would also be telling hackers about how to break in." In their monthly update, couldn't Microsoft have released a patch to have this setting to the correct configuration? Of course this would only be the short term solution, rather than waiting for 9 months for the permanent solution.
- teh_klev 10y ago
  I guess the reason is that by studying the patch, even a short term workaround such as this, you can deduce what the vulnerability is and quickly knock out a working exploit. I'm not suggesting that security-through-obscurity was the correct choice by MS, or the time taken to build a comprehensive fix was acceptable, but from the article it seems that this has been a bit of a gnarly issue to solve properly and even a cursory fix might reveal deeper seated issues. I'm not defending MS here, but I imagine that Word's codebase is a helluva pile of cards to work on. Especially given that it can still open document formats such as WordPerfect 5 which date back to 1988. Add in all the legacy OLE automation stuff, a VBA environment and all those shims and backwards compatibility things that MS are known for (see Old New Thing blog) that translates as "One Does Not Simply Patch Word".
bitexploder 10y ago
This is why what McAfee did is ok. It was already being exploited. This got it patched and let Corp IT roll out a settings change to fix it immediately. Google's 90 day policy from its team is also sane. Letting bad bugs live on in the dark after submitting to a vendor is clearly more dangerous for everyone.
- grub5000 10y ago
  Not really, according to the article the sequence of events went * Microsoft warned in March of active attacks * Microsoft schedules patch for April 11th * McAfee sees attacks on April 6th * McAfee publicly explains how to use the exploit on April 7th * April 9th attack-kits are publicly for sale * April 11th Microsoft releases public patch as scheduled McAfee fucked up here.
  - rando444 10y ago
    Microsoft was formally notified of the vulnerability in October 2016. Why leave this out of the timeline? The researcher that found the vulnerability first noticed it in July 2016. Between July and October he had gathered even more information about the vulnerability, presumably in his interest to demonstrate how serious the matter is, as well as a likely attempt to procure as large a bug bounty as possible. If Microsoft was presented with such a serious vulnerability and didn't address it properly for over half a year, I would say that they are the owners of the lion's share of the responsibility here.
  - BearGoesChirp 10y ago
    I don't see why. The whole thing seems wrong. Having privacy and keeping secrets seems to only encourage the bad security practices. If instead every vulnerability discovered was immediately shared, our society as a whole, and especially the IT sub culture, would work quite differently. We would value security far more. Right now, it is easier to justify having less focus on security because when someone does find an exploit they'll help you patch it up before it is out of control. On a very fundamental level, someone engaging in the free exchange of information, and this information being useful to people wanting to know what is or is not secure, cannot be a fuck up. Microsoft had a security flaw. That's a fuck up. People used that flaw for immoral actions. That's a double fuck up. McAfee shared information letting people know about active security threats. That isn't a fuck up.
averagewall 10y ago
What's more interesting than vulnerabilities being found is vulnerabilities being created. I used to think they were progressively eliminated so older software is safer. But is that true? Is MS accidentally creating new ones faster than they're patching old ones? Same goes for any software.
- emodendroket 10y ago
  I'd imagine the rate is more or less constant, with the exception of very new software.
- mtgx 10y ago
  The answer is yes: > Despite being Microsoft’s newest and ‘most secure’ operating system, Windows 10 was found to have the highest proportion of vulnerabilities of any OS (395), 46% more than Windows 8 and Windows 8.1 (265 each). https://www.avecto.com/news-and-events/news/94-of-critical-microsoft-vulnerabilities-mitigated-by-removing-admin-rights https://www.avecto.com/news-and-events/news/94-of-critical-m... And if you've used Windows 10, you'd already know that. Windows 10 has added a ton of new features/crap. The Q&A has suffered, too, and Windows 10 has been quite buggy so far, ruining some people's computers, etc. And since we were talking about Word, here's another tidbit from the same source: > Microsoft Office products were the subject of 79 vulnerabilities, up from 62 last year. This represents a 295% increase in Office vulnerabilities since 2014. The amount of bugs likely increases in general, too, because more code = more complexity = more bugs and bigger attack surface, especially if we're talking about "improving" or adding on top of an old codebase, as is the case with Windows and Office, as opposed to writing something from scratch (which may benefit from safer languages sometimes, newer safer architectures, etc).
jokoon 10y ago
Even though there is a lot of work in computer security, those stories really scare me and I wonder if I would dare working in this field. I wonder if hackers already lost their life due to their work in computer security, and I would not like to fall in the crosshair of russia right now.

174 points by T-A 10y ago

gwu78 10y ago

https://mobile.twitter.com/hashbreaker/status/853224169412206593?p=p https://mobile.twitter.com/hashbreaker/status/85322416941220... The strange "counterargument" I commonly see on HN to any suggestion that Microsoft closed source software could potentially be unsafe for use on an internet-connected computer is that the company has "improved" since some earlier 1990's/2000's time period. Are these commenters suggesting that other, open source operating system choices have not also improved since that time period? Should one consider how much did each respective system need to improve? (By "other, open source operating system choices", I mean the ones that were able to connect to the internet for years before Gates decided the www was something his company should be interested in and to copy the TCP/IP stack from an open source kernel into the Windows kernel). Are there convincing arguments why Microsoft deserves special treatment compared to the open source alternatives, i.e., why their users should not be permitted to freely evaluate the Windows kernel or Office source code via the public web? Are there compelling reasons why MS users should not be allowed i.e. given the option to edit/remove source code they are uncomfortable with and recompile? Consider the effects of limiting the number of people who can find and fix defects in a product. Does closed source status of Windows make Microsoft's software superior to the longstanding open source operating system alternatives?

jmcdiesel 10y ago
Their users don't need to be allowed to freely evaluate the source, period. When you write software, you control its distribution. What the users are free to do, however, is use an operating system/stack that they CAN evaluate the source of. If linux or any other open source alternative was a better actual product, it would find its way to the top of the market. In fact, it already has, on the server... by far. But linux wasn't made to be easy to use, to be quick and easy to install, to install other software onto, etc... and that has kept it back, and it kept it back long enough for microsoft to establish a de-facto standard on the home desktop market... The closed or open source status of a product has no bearing over its superiority at all. Again, in the world of geeks, it may, but in the world at large, it doesn't, and really, it shouldn't.
- beagle3 10y ago
  The sentiment of "the better product will win" is understandable, but wrong as you present it. Microsoft managed to gain a monopoly (legally or illegally - doesn't matter) and has used it to illegally keep others out, and network effects now (and for the past 20 years) have been that "goodness" measure - technical mediocrity had been sufficient (although recently they have been doing a lot of excellent technical work since the horrible 2000's) In every single field Microsoft has not been able to leverage their monopoly (e.g. Phones) they are not in a dominant position, even though in some they maintain a competitive one (Xbox one, c#, SQL server)
  - csydas 10y ago
    This is very true, since the idea of meritocracy doesn't do a lot to overcome business inertia of being in a Microsoft Environment. If there is a Linux solution that in every way exceeds a Microsoft Solution from a technical and price standpoint, you still need to weigh in the transition costs, employee costs, and the long term effect of changing. It's not always as simple as "X is better than Microsoft's Y, people will use it." There are far more things that get considered, and you can get tied down pretty heavily when your entire workflow and operations rely on a single product or vendor. The longer you've been using a product, the harder it is to get away from it. It's not that Linux isn't good or making a lot of cool progress in all realms, it's that Microsoft does "good enough" and the transition isn't seamless enough for many use cases.
  - averagewall 10y ago
    Part of why they succeeded was by being first. Linux was certainly much worse than Windows in the early days when people still used DOS together with Windows. Being first means it was massively better for those people at that time. Plan9 lost out to Linux, perhaps partly by being too late. Do we blame Linux for being horrible?
    - beagle3 10y ago
      As a user of both circa 1994 - no, Linux was definitely not worse. It was about a thousand times more stable, though it lacked e.g. A word processor. When Microsoft produced win 2 and 3, they unfairly (and likely illegally) used their DOS and then Windows monopoly to stop competitors (DR DOS, BeOS, a few lesser known ones); they later used the Windows monopoly to embed IE and kill Netscape. It didn't matter that IE was, in fact, a better browser - everyone wanted Netscape, and it was only with the IE4 merge into the OS that Microsoft took the internet. I was involved with one of the smaller and less famous Microsoft victims at the time, and I can assure you that regardless of technical merits, MS made very significant progress by playing dirty. They paid billions in court for it, but economically it was worth it to them.
jfoutz 10y ago
Microsoft was really really bad at security. Then the internet became a popular thing. I think an fresh xp install would, on average survive 15 minutes before getting infected by blaster. Microsoft, to their credit, improved dramatically. I don't know if they're extraordinarily good compared to other software producers. Microsoft gets the mention because it was so very bad, back in the day. It's kind of like when a very lazy person turns into a marathon runner. They made huge changes.
- deleted 10y ago
  [deleted]
- kbenson 10y ago
  There were versions of windows, 2000 if not XP, that could and would get infected in-between the time the network stack initialized and the local software firewall initialized a second or two later. This was actually addressed and fixed, because it was not a unique experience. That's how pervasive and wild the exploit network traffic was before MS got their act together. Edit: My google-fu is failing me, and I can't find the right keywords to find a reference to this, but I distinctly remember it. Back in the days when firewalls weren't quite as pervasive, and especially not for small colo deployments.
  - ConceptJunkie 10y ago
    I saw this first-hand when installing Windows 2000 using Parallels circa 2006. I mistakenly believed the configuration I had chosen had the VM behind the Mac's firewall, but it wasn't. The VM was infected before Windows 2000 could install the latest updates... just a matter of minutes. This is not as extreme as you are describing, but it was also on the corporate network of a large company, not the open internet.
- secstate 10y ago
  Indeed. But becoming a marathon runner who finishes in 7 hours, after the finish line has closed, and doesn't get a medal because the cut off was 6:30 :) No, it's a great achievement, but there's still room for improvement.
schoen 10y ago
I don't support anyone hiding source code from users (and have given conference talks about hard-to-detect ways of backdooring binaries), and so I don't mean this to be an excuse for the secrecy of the source code, but every single person I know who's worked in the security industry agrees that Microsoft made a major qualitative improvement in their security at every level, based on spending a lot of money and giving security people power in the development process. Most people feel Microsoft is managing security better than the main Linux-based operating systems do, in terms of auditing, coding standards, code reviews, and developer security education. (That doesn't mean that they're doing this better than each and every individual open source project.) Some of the people agitating for giving Microsoft more credit about this have personally seen the results, as in-house or contracted developers or auditors. It can be hard to make an apples-to-apples comparison about what this means for the security of deployed systems because people are potentially using the systems in different ways with kind of different attack surfaces. (For example, quite a few Windows desktop users may still be downloading unsigned binaries from HTTP sites, which Linux users would be less likely to do because of the prevalence of package managers -- though maybe some of those Linux users will do the curl | sh thing from an HTTP site too.) I don't think that a typical open source project has improved to the extent that Microsoft has during this timeframe, though, again, it's hard to know exactly what to compare or how to compare it.
- secstate 10y ago
  That's a really complete argument. But there's still the elephant in the room of the whole operation being closed source, and the inability to do quantitative analysis into the improving security of a closed source system. People on the inside can say there have been qualitative improvements, but that's not measurable on the outside and so is no better than hearsay and conjecture. Meanwhile in the GNU/Linux world, you can browse the git repositories and see and audit every step in the development process if needed. Is it possible that typical open source projects didn't NEED to improve their security over the same timeframe, given that the F/OSS world didn't fuck users over for two decades with unfixed 0days? Meanwhile, the OP here is talking about Word which is likely a world away from the improving security team working on Windows. Hell, I'm surprised they've got more than a skeleton crew working on the desktop version of Word anymore. People in my community 60+ have been using Google Docs for the last five years already.
doggydogs94 10y ago
We will never know the answer to your assertion until more than 1% of the OS market is open source.
emmelaich 10y ago
Only four minutes according to Kevin Mitnick. https://en.wikipedia.org/wiki/Microsoft_Windows#Third-party_analysis https://en.wikipedia.org/wiki/Microsoft_Windows#Third-party_...

scarybeast 10y ago

And _this_, ladies and gentlemen, is why we have disclosure deadlines for security vulnerabilities. For example, Project Zero expects vendors to fix security vulnerabilities within 90 days of notification. Looking at this story, it's possible that 90 days is almost too long and should be shortened. As time goes on, it's becoming more and more common for multiple parties to become aware of the same vulnerabilities. Not all of those parties have good intentions, as we see here. Shortening the window of exposure is key.

nikanj 10y ago
Next up on HN: extreme outrage after a botched security update breaks hundreds of millions of machines. Not all bugs can be fixed with a simple one-line fix, and the faster patches need to be cranked out, the lower quality they'll be.
- flukus 10y ago
  Well yeah, if a patch for a single application broke machines then the outrage would be deserved.
- geocar 10y ago
  Or maybe people stop shipping dogshit?
- bitexploder 10y ago
  There was a simple settings change for a temp fix on this one too. When there is even a remote chance a bug is being exploited in the wild it needs to be disclosed. Corp IT can work around it almost always. Individuals can as well. This argument that "it's complex to patch" is a non-starter at best. We the users deserve the option to decide how to deal with it. Silent exploitation is how we all lose, even the vendor.
- BearGoesChirp 10y ago
  In which case the users need to be informed of the security risks they are taking by using that software. Hiding risks is not the answer.

doggydogs94 10y ago

Vendors, even ones as large as Microsoft, do not have infinite resources available to evaluate vulnerabilities. There are only so many of the issues you can work on at once. They have to evaluate each issue and prioritize the fix. In this case, they merely did not recognize the potential scope of the problem at hand.

DanielBMarkham 10y ago
That's true, but it doesn't matter. It's still broken. That's why we have automatic release after a set time. Because it's a problem for the public even if the vendor has zero resources. The ability of the vendor to fix the problem is not related at all to the potential damage the problem can cause. Worst-case scenario? The software is shutdown and/or withdrawn from the market because the vendor can't fix it. Not that the vulnerability isn't announced. What we need is a public and open way to do this that doesn't involved walled gardens.
- adrianN 10y ago
  I don't want anyone to be able to shutdown and/or withdraw software that I'm using for any reason. That cure is worse than the disease.
  - DanielBMarkham 10y ago
    Personally I don't want you to have to. As far as I'm concerned, if you're notified in big, red letters (perhaps every time the software starts)? Works for me. As long as you know -- and are reminded. (That's because different people use the same software. If the notice only appeared once, a new person might start using the software/machine and not be aware of what's going on) But if you had a piece of software with a terrible vulnerability that was currently being exploited to do some sort of terrible harm? Beats me. Does my right to use the internet without being DDOSed override your right to use unsafe software if you want?
    - stupidhn 10y ago

stesch 10y ago

Microsoft should hire this programmer: https://i.redd.it/sd72mfmj7ety.jpg https://i.redd.it/sd72mfmj7ety.jpg

MikusR 10y ago
Microsoft doesn't make software for Boeing planes.
- stesch 10y ago
  You are funny.
  - sctb 10y ago
    Please comment civilly and substantively on Hacker News. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

HenryBemis 10y ago

I thought that it is the norm for M$ to hand out the zero-days to the 3-letter-agencies for "a while" and patches them ONLY when someone else gets hold and starts using the same vuln.. so it makes PERFECT sense that they would do something like that. Also who in their right mind allow Word/Excel/Powerpoint to access the internet? (oh yes it's called "365" and it makes software, that is completely unfit for the task, to access the internet)

HappyTypist 10y ago
Not sure why you're being downvoted. This is literally the company that built in "_NSAKEY" into the kernel, which is still present (just called "_KEY2" now.
- kevingadd 10y ago
  Putting some sort of security backdoor or snooping feature into your software (likely by government order) is pretty different from 'M$ gives 0days to spy agencies and delays fixing them'. _NSAKEY, whatever it is, doesn't resemble the situation the original article is describing.
- repples 10y ago
  If "_key2" is an public key embedded within Windows, then presumably there exists one or more holders of the private key somewhere - what exactly are they able to do with this key? I've seen a lot of concern about "_key2" and "_NSAKEY" being expressed over the years, but scant technical detail.

HappyTypist 10y ago

We need civil penalties for failing to patch any serious vulnerability (that can be defined as RCE, priv. escalation, etc) within 30 days of disclosure. If you can't patch it, you must issue a patch that announces the vuln and disables the minimal set of functionality that enables it. Even if that's the whole program.

throwanem 10y ago
So, turn a nontrivial set of vulns into successful DoS attacks?
- aurelianito 10y ago
  Yes. That, in turn, will give the economic incentive to not have the vulnerabilities in the first place.
  - kobeya 10y ago
    Or for software not to get written in the first place.
    - goodplay 10y ago
      >Or for [buggy] software not to get written in the first place. FTFY We place too much trust and rely too much on computer systems these days to have the luxury to write software like we used to.
      - kobeya 10y ago
        No don't twist my words. I meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. It would kill innovation.
        goodplay 10y ago
        > meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. And I'm arguing that not doing so might be a good thing. I shudder to think how we'd be off if other infrastructure disciplines took the same approach we take to develop software. If you build something that people use in important infrastructure, prepare to be on the hook if it fails.

yitchelle 10y ago

"A quick change in the settings on Word by customers would do the trick, but if Microsoft notified customers about the bug and the recommended changes, it would also be telling hackers about how to break in." In their monthly update, couldn't Microsoft have released a patch to have this setting to the correct configuration? Of course this would only be the short term solution, rather than waiting for 9 months for the permanent solution.

teh_klev 10y ago
I guess the reason is that by studying the patch, even a short term workaround such as this, you can deduce what the vulnerability is and quickly knock out a working exploit. I'm not suggesting that security-through-obscurity was the correct choice by MS, or the time taken to build a comprehensive fix was acceptable, but from the article it seems that this has been a bit of a gnarly issue to solve properly and even a cursory fix might reveal deeper seated issues. I'm not defending MS here, but I imagine that Word's codebase is a helluva pile of cards to work on. Especially given that it can still open document formats such as WordPerfect 5 which date back to 1988. Add in all the legacy OLE automation stuff, a VBA environment and all those shims and backwards compatibility things that MS are known for (see Old New Thing blog) that translates as "One Does Not Simply Patch Word".

bitexploder 10y ago

This is why what McAfee did is ok. It was already being exploited. This got it patched and let Corp IT roll out a settings change to fix it immediately. Google's 90 day policy from its team is also sane. Letting bad bugs live on in the dark after submitting to a vendor is clearly more dangerous for everyone.

grub5000 10y ago
Not really, according to the article the sequence of events went * Microsoft warned in March of active attacks * Microsoft schedules patch for April 11th * McAfee sees attacks on April 6th * McAfee publicly explains how to use the exploit on April 7th * April 9th attack-kits are publicly for sale * April 11th Microsoft releases public patch as scheduled McAfee fucked up here.
- rando444 10y ago
  Microsoft was formally notified of the vulnerability in October 2016. Why leave this out of the timeline? The researcher that found the vulnerability first noticed it in July 2016. Between July and October he had gathered even more information about the vulnerability, presumably in his interest to demonstrate how serious the matter is, as well as a likely attempt to procure as large a bug bounty as possible. If Microsoft was presented with such a serious vulnerability and didn't address it properly for over half a year, I would say that they are the owners of the lion's share of the responsibility here.
- BearGoesChirp 10y ago
  I don't see why. The whole thing seems wrong. Having privacy and keeping secrets seems to only encourage the bad security practices. If instead every vulnerability discovered was immediately shared, our society as a whole, and especially the IT sub culture, would work quite differently. We would value security far more. Right now, it is easier to justify having less focus on security because when someone does find an exploit they'll help you patch it up before it is out of control. On a very fundamental level, someone engaging in the free exchange of information, and this information being useful to people wanting to know what is or is not secure, cannot be a fuck up. Microsoft had a security flaw. That's a fuck up. People used that flaw for immoral actions. That's a double fuck up. McAfee shared information letting people know about active security threats. That isn't a fuck up.

averagewall 10y ago

What's more interesting than vulnerabilities being found is vulnerabilities being created. I used to think they were progressively eliminated so older software is safer. But is that true? Is MS accidentally creating new ones faster than they're patching old ones? Same goes for any software.

emodendroket 10y ago
I'd imagine the rate is more or less constant, with the exception of very new software.
mtgx 10y ago
The answer is yes: > Despite being Microsoft’s newest and ‘most secure’ operating system, Windows 10 was found to have the highest proportion of vulnerabilities of any OS (395), 46% more than Windows 8 and Windows 8.1 (265 each). https://www.avecto.com/news-and-events/news/94-of-critical-microsoft-vulnerabilities-mitigated-by-removing-admin-rights https://www.avecto.com/news-and-events/news/94-of-critical-m... And if you've used Windows 10, you'd already know that. Windows 10 has added a ton of new features/crap. The Q&A has suffered, too, and Windows 10 has been quite buggy so far, ruining some people's computers, etc. And since we were talking about Word, here's another tidbit from the same source: > Microsoft Office products were the subject of 79 vulnerabilities, up from 62 last year. This represents a 295% increase in Office vulnerabilities since 2014. The amount of bugs likely increases in general, too, because more code = more complexity = more bugs and bigger attack surface, especially if we're talking about "improving" or adding on top of an old codebase, as is the case with Windows and Office, as opposed to writing something from scratch (which may benefit from safer languages sometimes, newer safer architectures, etc).

jokoon 10y ago

Even though there is a lot of work in computer security, those stories really scare me and I wonder if I would dare working in this field. I wonder if hackers already lost their life due to their work in computer security, and I would not like to fall in the crosshair of russia right now.