7 ms·

Googler Drops Windows Zero-Day, Microsoft Unhappy

73 points by ukdm 16y ago

epochwolf 16y ago
I hardly think 5 days is enough time for Microsoft to patch this. The guy could have given them two weeks before releasing the exploit.
- davidcuddeback 16y ago
  The article says "Ormandy said protocol handlers are a popular source of vulnerabilities and argued that 'hcp://' itself has been the target of attacks multiple times in the past." I'm not defending his actions, but I think he's arguing that it's likely that black-hats already know about the vulnerability because it occurs in a heavily targeted attack vector. Therefor, releasing details gives IT professionals the knowledge they need to setup firewalls or do whatever they have to do to protect against the vulnerability while waiting for an official patch from Microsoft. With that said, perhaps there's a better way to accomplish that goal.
  - tptacek 16y ago
    You can make that same argument about a whole lot of different vulnerabilities, for what it's worth. The core issue is that a lot of people practice "responsible disclosure" by custom but don't really buy into the principle of it. Can't blame 'em.
  - kenjackson 16y ago
    That's an absurd excuse for Ormandy. As, I'm sure Ormandy knows, IT pros are a LOT less likely to implement a workaround to this problem than are hackers likely to exploit it. Furthermore, MS stated that the provided workaround is insufficient and easily circumvented. And, he provides no evidence that any blackhats know about this at all. To me this clearly looked like a way for Google to try to attack MS's security -- this goes hand in hand with their PR stunt of moving Google employees off of Windows due to security.
    - d4rt 16y ago
      How do you know that IT pros are less likely to implement a workaround than hackers are to exploit it? How prevalent is deploying workarounds and mitigations versus deploying patches? I don't know of any research in this area; it would be very interesting to know.
      - kenjackson 16y ago
        Based on history. There have been several known exploits that have been exploited where a Windows Update patch has been available for months, and admins didn't update. Now, take it a step further and now you have an exploit where is no Windows Update package, but each server has to be manually updated following a procedure from a webpage. This is a no-brainer to me. Of course if you're looking for double-blind randomized control studies to prove this, well I'm afraid you're in the wrong field.
btilly 16y ago
The article links to http://threatpost.com/en_us/blogs/does-google-have-double-standard-full-disclosure-061010 http://threatpost.com/en_us/blogs/does-google-have-double-st... which discusses the ethics of this situation, and makes unspecified allegations that Google does "all sorts of hinky things behind your back" that justifies doing full disclosure against them. Does anyone have any idea of what their beef is with Google?
- tptacek 16y ago
  Tavis works for Google. He's one of their best-known security researchers. Tavis published a Microsoft remote. Without waiting for a patch. That is unusual. Most researchers, Tavis included in other situations, don't do that. Not at all surprising Microsoft took it personally. That doesn't mean it's constructive for MSFT to complain. But, there you go.
  - gojomo 16y ago
    I understand the anger over this quick-publish. But I also wonder what Robert Hansen was alluding to with the "all sorts of hinky things behind your back" statement. It seems to be about Google's behavior in prior situations.
    - tptacek 16y ago
      I don't know, but just bear in mind that Microsoft and Google deal with a lot of vulnerability reports, and these things can turn into soap operas even on good days.
  - btilly 16y ago
    You gave an excellent answer to the question I didn't ask. I don't need to be told why MSFT is unhappy. I want to know why Robert Hansen is upset enough at Google's practices that he wants full disclosure used against them.
    - tptacek 16y ago
tptacek 16y ago
Before anyone starts talking about full disclosure or Microsoft or whatnot, just know that whether you agree with Tavis' logic or not, not giving Microsoft a couple weeks to patch a remote is a breach of protocol. Tavis is one of my favorite researchers to watch and I'm not going to say anything negative about him or how he played this. But if I was Google, I'd be treading very, very, very carefully here. Google's gotten a lot of talent lately, but Microsoft has them way outgunned. We don't need these two companies setting up opposition labs because of a document that ends with "greetz". Or, maybe we do. Depends on your politics. (For what it's worth: http://twitter.com/taviso/status/15887290335S http://twitter.com/taviso/status/15887290335S)
- sayrer 16y ago
  security "researcher" does something questionable in order to generate publicity, news at 11
  - deleted 16y ago
    [deleted]
  - tptacek 16y ago
    Tavis is the real deal, Robert.
    - ghshephard 16y ago
      His actions indicate otherwise. Surely any halfways mature security researcher realizes the following two facts: #1 - In excess of 95% of all security patches/updates/workarounds implemented on a windows platform are those that come through the automatic update process #2 - Upon disclosure, the universe of script kiddies which never, ever, would have discovered this security exploit on their own have now been handed a gift which they will exploit with their rudimentary skills. I'm a strong proponent of responsible disclosure, and really believe that it has made our platforms much, much more secure, obviously in an absolute sense, but also, in a relative sense. But, responsible disclosure involves giving the vendor a reasonable amount of time - typically one or two patch cycles, prior to releasing the exploit. Anything other than that is juvenile and besmirches the community of responsible security researchers.
ww8520 16y ago
That was a dick move. 5 days are not enough to go through debugging, coding, reviewing, testing, and deployment of a complicate software like Windows. 2 weeks to 4 weeks are more reasonable.
- count 16y ago
  Or, 5 days is enough time, because people need to know it's out there, and the developers have had years to get this particular type of bug right.
metamemetics 16y ago
Reavey confirmed that the issue affects Windows XP and Windows Server 2003 only. It's 2010, no one should willingly still be using windows XP unless they like hosting botnets. Can't say windows is the most intelligent choice for a server platform either.
- hboon 16y ago
  Some server software only runs on Windows.
grannyg00se 16y ago
In this case the exploit is fairly likely to already be in the hands of evildoers which is why he released details so quickly. I have to agree with his logic.

73 points by ukdm 16y ago

I hardly think 5 days is enough time for Microsoft to patch this. The guy could have given them two weeks before releasing the exploit.

davidcuddeback 16y ago
The article says "Ormandy said protocol handlers are a popular source of vulnerabilities and argued that 'hcp://' itself has been the target of attacks multiple times in the past." I'm not defending his actions, but I think he's arguing that it's likely that black-hats already know about the vulnerability because it occurs in a heavily targeted attack vector. Therefor, releasing details gives IT professionals the knowledge they need to setup firewalls or do whatever they have to do to protect against the vulnerability while waiting for an official patch from Microsoft. With that said, perhaps there's a better way to accomplish that goal.
- tptacek 16y ago
  You can make that same argument about a whole lot of different vulnerabilities, for what it's worth. The core issue is that a lot of people practice "responsible disclosure" by custom but don't really buy into the principle of it. Can't blame 'em.
- kenjackson 16y ago
  That's an absurd excuse for Ormandy. As, I'm sure Ormandy knows, IT pros are a LOT less likely to implement a workaround to this problem than are hackers likely to exploit it. Furthermore, MS stated that the provided workaround is insufficient and easily circumvented. And, he provides no evidence that any blackhats know about this at all. To me this clearly looked like a way for Google to try to attack MS's security -- this goes hand in hand with their PR stunt of moving Google employees off of Windows due to security.
  - d4rt 16y ago
    How do you know that IT pros are less likely to implement a workaround than hackers are to exploit it? How prevalent is deploying workarounds and mitigations versus deploying patches? I don't know of any research in this area; it would be very interesting to know.
    - kenjackson 16y ago
      Based on history. There have been several known exploits that have been exploited where a Windows Update patch has been available for months, and admins didn't update. Now, take it a step further and now you have an exploit where is no Windows Update package, but each server has to be manually updated following a procedure from a webpage. This is a no-brainer to me. Of course if you're looking for double-blind randomized control studies to prove this, well I'm afraid you're in the wrong field.

btilly 16y ago

The article links to http://threatpost.com/en_us/blogs/does-google-have-double-standard-full-disclosure-061010 http://threatpost.com/en_us/blogs/does-google-have-double-st... which discusses the ethics of this situation, and makes unspecified allegations that Google does "all sorts of hinky things behind your back" that justifies doing full disclosure against them. Does anyone have any idea of what their beef is with Google?

tptacek 16y ago
Tavis works for Google. He's one of their best-known security researchers. Tavis published a Microsoft remote. Without waiting for a patch. That is unusual. Most researchers, Tavis included in other situations, don't do that. Not at all surprising Microsoft took it personally. That doesn't mean it's constructive for MSFT to complain. But, there you go.
- gojomo 16y ago
  I understand the anger over this quick-publish. But I also wonder what Robert Hansen was alluding to with the "all sorts of hinky things behind your back" statement. It seems to be about Google's behavior in prior situations.
  - tptacek 16y ago
    I don't know, but just bear in mind that Microsoft and Google deal with a lot of vulnerability reports, and these things can turn into soap operas even on good days.
- btilly 16y ago
  You gave an excellent answer to the question I didn't ask. I don't need to be told why MSFT is unhappy. I want to know why Robert Hansen is upset enough at Google's practices that he wants full disclosure used against them.
  - tptacek 16y ago

tptacek 16y ago

Before anyone starts talking about full disclosure or Microsoft or whatnot, just know that whether you agree with Tavis' logic or not, not giving Microsoft a couple weeks to patch a remote is a breach of protocol. Tavis is one of my favorite researchers to watch and I'm not going to say anything negative about him or how he played this. But if I was Google, I'd be treading very, very, very carefully here. Google's gotten a lot of talent lately, but Microsoft has them way outgunned. We don't need these two companies setting up opposition labs because of a document that ends with "greetz". Or, maybe we do. Depends on your politics. (For what it's worth: http://twitter.com/taviso/status/15887290335S http://twitter.com/taviso/status/15887290335S)

sayrer 16y ago
security "researcher" does something questionable in order to generate publicity, news at 11
- deleted 16y ago
  [deleted]
- tptacek 16y ago
  Tavis is the real deal, Robert.
  - ghshephard 16y ago
    His actions indicate otherwise. Surely any halfways mature security researcher realizes the following two facts: #1 - In excess of 95% of all security patches/updates/workarounds implemented on a windows platform are those that come through the automatic update process #2 - Upon disclosure, the universe of script kiddies which never, ever, would have discovered this security exploit on their own have now been handed a gift which they will exploit with their rudimentary skills. I'm a strong proponent of responsible disclosure, and really believe that it has made our platforms much, much more secure, obviously in an absolute sense, but also, in a relative sense. But, responsible disclosure involves giving the vendor a reasonable amount of time - typically one or two patch cycles, prior to releasing the exploit. Anything other than that is juvenile and besmirches the community of responsible security researchers.

ww8520 16y ago

That was a dick move. 5 days are not enough to go through debugging, coding, reviewing, testing, and deployment of a complicate software like Windows. 2 weeks to 4 weeks are more reasonable.

count 16y ago
Or, 5 days is enough time, because people need to know it's out there, and the developers have had years to get this particular type of bug right.

metamemetics 16y ago

Reavey confirmed that the issue affects Windows XP and Windows Server 2003 only. It's 2010, no one should willingly still be using windows XP unless they like hosting botnets. Can't say windows is the most intelligent choice for a server platform either.

hboon 16y ago
Some server software only runs on Windows.

grannyg00se 16y ago

In this case the exploit is fairly likely to already be in the hands of evildoers which is why he released details so quickly. I have to agree with his logic.