3 ms·
Seems like all the good zero days are in highly vintage components such as SMB, NFS, True Type Fonts and Windows Fax If I were a security researcher I would lo
by rougka 4y ago
Seems like all the good zero days are in highly vintage components such as SMB, NFS, True Type Fonts and Windows Fax
If I were a security researcher I would look at anything that came from win 3.11, probably full of holes
- sofixa 4y agoNFS 4.1 isn't "highly vintage", the RFC is from 2010.
- capableweb 4y agoThey're obviously not talking about specific versions, but the heritage of the protocols.
- xorcist 4y agoThe heritage of a protocol doesn't matter much when it is implemented. Every web browser carries the "heritage" of http. But NFS probably isn't the top priority for Microsoft, the implementation of NFS 3 felt sketchy, so in that way it's not overly surprising.
- rougka 4y agoMaybe this example was not the best as it is only in Windows for 10 years, NFS however as a component exists since at least NT 4. Even if this exploit only touches completely new code, my point still stands that windows has multiple layers of archeology which were designed when security was an afterthought. Some of these are preinstalled with Windows, use networking and run as SYSTEM (WMI, spool) others are used by enough components in windows they will never be removed yet it doesn’t seem they are undergoing any development (COM/OLE)
- saagarjha 4y agoBrand new code often has vulnerabilities in it too.