3 ms·

Microsoft not only not acknowledging security problems, but asking them not to be disclosed after several months of inaction. Search engine hits to this guy's

by ximeng 16y ago

Microsoft not only not acknowledging security problems, but asking them not to be disclosed after several months of inaction. Search engine hits to this guy's site indicate that these problems are being independently discovered by people based in China. http://lcamtuf.coredump.cx/cross_fuzz/known_vuln.txt http://lcamtuf.coredump.cx/cross_fuzz/known_vuln.txt Bugs in all other browsers, although with better responses it seems. Interesting problems to solve here, both technically and socially. --- This guy's blog is great, read more of it! Some recent articles: http://lcamtuf.coredump.cx/electronics/ http://lcamtuf.coredump.cx/electronics/ - geek's guide to electronics for programmers who don't know this stuff http://lcamtuf.coredump.cx/word/ http://lcamtuf.coredump.cx/word/ - cool physical project - threat level indicator --- Author Wikipedia page: http://en.wikipedia.org/wiki/Micha%C5%82_Zalewski http://en.wikipedia.org/wiki/Micha%C5%82_Zalewski

viraptor 16y ago
I heard about the MS inaction from many sources now. For example IKVM.net developer wrote a couple of times: "P.S. By my new policy, I won't be filing a bug with Microsoft since they have amply demonstrated not to care about external bug reports."
robin_reala 16y ago
I’d also highly recommend his 'Silence on the Wire' book ( http://lcamtuf.coredump.cx/silence.shtml http://lcamtuf.coredump.cx/silence.shtml ), it’s a really readable full-stack overview of potential security problems. In fact, I’m going to dig my copy out and read it again.
- m0nastic 16y ago
  He's also the author of Skipfish (a fairly new web scanner), which I've been making a lot of use of the past few months. It's still fairly beta, but already I find it to be more useful than WebInspect in many cases.
  - tptacek 16y ago
    That's a pretty horrible indictment of WebInspect, because Skipfish virtually never finds anything for us (we ban scanners on our teams, but I like Zalewski and tend to run Skipfish just for kicks).
    - m0nastic 16y ago
      I suppose it's somewhat of a backhanded compliment. I honestly wouldn't pay money for the results I get from WebInspect (we have licenses for it, so we use it). I swear that WebInspect has gotten noticeably worse the past year and a half or so. Prior to that, it would at least occasionally find something interesting; but I honestly can't remember the last time it found something that wasn't a false positive. As to SkipFish, I would say that the past three applications I've run it against it's found at least one interesting thing (which is high praise for automated tools in our industry).
    - viraptor 16y ago
      Any specific reasons you don't use them? It's a pretty interesting view from a security guy really... most of those I heard before say something like "it doesn't hurt to leave it running, while we do our stuff manually - sometimes it works". Also, did you mean fuzzers in general or only web scanners?
      - tptacek 16y ago
        Just scanners. Everyone uses Burp's fuzzer. And in the rare cases we end up doing network pentests, we will use Nessus. Scanners make testers stupider. Even if you are conscientious about using them responsibly†, they still work to turn off the part of your brain that thinks about the kinds of flaws they do a good job of detecting. If you say you'll only run them at the end of a engagement to see if there's anything you missed, now you're working with a safety net. † And we've worked on plenty of projects that had previous runs from teams that weren't responsible about scanners, with predictably horrific results.
        16y ago

by ximeng 16y ago

viraptor 16y ago

I heard about the MS inaction from many sources now. For example IKVM.net developer wrote a couple of times: "P.S. By my new policy, I won't be filing a bug with Microsoft since they have amply demonstrated not to care about external bug reports."

robin_reala 16y ago

I’d also highly recommend his 'Silence on the Wire' book ( http://lcamtuf.coredump.cx/silence.shtml http://lcamtuf.coredump.cx/silence.shtml ), it’s a really readable full-stack overview of potential security problems. In fact, I’m going to dig my copy out and read it again.

m0nastic 16y ago
He's also the author of Skipfish (a fairly new web scanner), which I've been making a lot of use of the past few months. It's still fairly beta, but already I find it to be more useful than WebInspect in many cases.
- tptacek 16y ago
  That's a pretty horrible indictment of WebInspect, because Skipfish virtually never finds anything for us (we ban scanners on our teams, but I like Zalewski and tend to run Skipfish just for kicks).
  - m0nastic 16y ago
    I suppose it's somewhat of a backhanded compliment. I honestly wouldn't pay money for the results I get from WebInspect (we have licenses for it, so we use it). I swear that WebInspect has gotten noticeably worse the past year and a half or so. Prior to that, it would at least occasionally find something interesting; but I honestly can't remember the last time it found something that wasn't a false positive. As to SkipFish, I would say that the past three applications I've run it against it's found at least one interesting thing (which is high praise for automated tools in our industry).
  - viraptor 16y ago
    Any specific reasons you don't use them? It's a pretty interesting view from a security guy really... most of those I heard before say something like "it doesn't hurt to leave it running, while we do our stuff manually - sometimes it works". Also, did you mean fuzzers in general or only web scanners?
    - tptacek 16y ago
      Just scanners. Everyone uses Burp's fuzzer. And in the rare cases we end up doing network pentests, we will use Nessus. Scanners make testers stupider. Even if you are conscientious about using them responsibly†, they still work to turn off the part of your brain that thinks about the kinds of flaws they do a good job of detecting. If you say you'll only run them at the end of a engagement to see if there's anything you missed, now you're working with a safety net. † And we've worked on plenty of projects that had previous runs from teams that weren't responsible about scanners, with predictably horrific results.
      - 16y ago