3 ms·

The article says "Ormandy said protocol handlers are a popular source of vulnerabilities and argued that 'hcp://' itself has been the target of attacks multiple

The article says "Ormandy said protocol handlers are a popular source of vulnerabilities and argued that 'hcp://' itself has been the target of attacks multiple times in the past." I'm not defending his actions, but I think he's arguing that it's likely that black-hats already know about the vulnerability because it occurs in a heavily targeted attack vector. Therefor, releasing details gives IT professionals the knowledge they need to setup firewalls or do whatever they have to do to protect against the vulnerability while waiting for an official patch from Microsoft. With that said, perhaps there's a better way to accomplish that goal.

tptacek 16y ago
You can make that same argument about a whole lot of different vulnerabilities, for what it's worth. The core issue is that a lot of people practice "responsible disclosure" by custom but don't really buy into the principle of it. Can't blame 'em.
kenjackson 16y ago
That's an absurd excuse for Ormandy. As, I'm sure Ormandy knows, IT pros are a LOT less likely to implement a workaround to this problem than are hackers likely to exploit it. Furthermore, MS stated that the provided workaround is insufficient and easily circumvented. And, he provides no evidence that any blackhats know about this at all. To me this clearly looked like a way for Google to try to attack MS's security -- this goes hand in hand with their PR stunt of moving Google employees off of Windows due to security.
- d4rt 16y ago
  How do you know that IT pros are less likely to implement a workaround than hackers are to exploit it? How prevalent is deploying workarounds and mitigations versus deploying patches? I don't know of any research in this area; it would be very interesting to know.
  - kenjackson 16y ago
    Based on history. There have been several known exploits that have been exploited where a Windows Update patch has been available for months, and admins didn't update. Now, take it a step further and now you have an exploit where is no Windows Update package, but each server has to be manually updated following a procedure from a webpage. This is a no-brainer to me. Of course if you're looking for double-blind randomized control studies to prove this, well I'm afraid you're in the wrong field.

tptacek 16y ago

You can make that same argument about a whole lot of different vulnerabilities, for what it's worth. The core issue is that a lot of people practice "responsible disclosure" by custom but don't really buy into the principle of it. Can't blame 'em.

kenjackson 16y ago

That's an absurd excuse for Ormandy. As, I'm sure Ormandy knows, IT pros are a LOT less likely to implement a workaround to this problem than are hackers likely to exploit it. Furthermore, MS stated that the provided workaround is insufficient and easily circumvented. And, he provides no evidence that any blackhats know about this at all. To me this clearly looked like a way for Google to try to attack MS's security -- this goes hand in hand with their PR stunt of moving Google employees off of Windows due to security.

d4rt 16y ago
How do you know that IT pros are less likely to implement a workaround than hackers are to exploit it? How prevalent is deploying workarounds and mitigations versus deploying patches? I don't know of any research in this area; it would be very interesting to know.
- kenjackson 16y ago
  Based on history. There have been several known exploits that have been exploited where a Windows Update patch has been available for months, and admins didn't update. Now, take it a step further and now you have an exploit where is no Windows Update package, but each server has to be manually updated following a procedure from a webpage. This is a no-brainer to me. Of course if you're looking for double-blind randomized control studies to prove this, well I'm afraid you're in the wrong field.