3 ms·

NSA doesn't need to ask anti-virus companies to ignore certain malware, as long as Microsoft is handing them lists of fresh Windows vulnerabilities months befor

by salient 13y ago

NSA doesn't need to ask anti-virus companies to ignore certain malware, as long as Microsoft is handing them lists of fresh Windows vulnerabilities months before they even begin working on fixing them. http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-to-swap-data-with-thousands-of-firms.html http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-t... Until that policy changes at Microsoft, at least 90 percent of the PC users will never be truly safe.

freehunter 13y ago
Microsoft does that publicly all the time. I work for a large enterprise organization, and we get notifications from Microsoft of vulnerabilities that have not been patched yet. The point is that we can mitigate the risk while waiting for the patch. We're not running out to exploit the vulnerability in our competitor's system. The NSA or other malicious actors may be, sure, but I have doubts that this is what Microsoft wants to have happen. The goal is to mitigate the risk while a patch is being made. Microsoft doesn't want their software to be exploited, period.
eliteraspberrie 13y ago
That program is MAPP (Microsoft Active Protections Program). [1] All governments (except Iran, Syria, etc.) are part of it, as well as hundreds of private companies internationally. Of course, vulnerabilities are routinely leaked. [2] Other programs include the SSI (Shared Source Initiative) [3] by which governments get access to the Windows source code, and the GSP (Government Security Program) [3] which helps governments find vulnerabilities in said source code. Not to mention COFEE [4] -- I wonder how many antivirus detect that, especially since its source code was leaked... [1] http://technet.microsoft.com/en-us/security/dn467918 http://technet.microsoft.com/en-us/security/dn467918 [2] http://www.zdnet.com/blog/security/microsoft-kicks-chinese-company-out-of-vulnerability-sharing-program/11853 http://www.zdnet.com/blog/security/microsoft-kicks-chinese-c... [3] https://www.microsoft.com/en-us/sharedsource/default.aspx https://www.microsoft.com/en-us/sharedsource/default.aspx [4] https://wikileaks.org/wiki/Microsoft_COFEE_(Computer_Online_Forensics_Evidence_Extractor)_tool_and_documentation,_Sep_2009 https://wikileaks.org/wiki/Microsoft_COFEE_(Computer_Online_...

by salient 13y ago

freehunter 13y ago

Microsoft does that publicly all the time. I work for a large enterprise organization, and we get notifications from Microsoft of vulnerabilities that have not been patched yet. The point is that we can mitigate the risk while waiting for the patch. We're not running out to exploit the vulnerability in our competitor's system. The NSA or other malicious actors may be, sure, but I have doubts that this is what Microsoft wants to have happen. The goal is to mitigate the risk while a patch is being made. Microsoft doesn't want their software to be exploited, period.

eliteraspberrie 13y ago

That program is MAPP (Microsoft Active Protections Program). [1] All governments (except Iran, Syria, etc.) are part of it, as well as hundreds of private companies internationally. Of course, vulnerabilities are routinely leaked. [2] Other programs include the SSI (Shared Source Initiative) [3] by which governments get access to the Windows source code, and the GSP (Government Security Program) [3] which helps governments find vulnerabilities in said source code. Not to mention COFEE [4] -- I wonder how many antivirus detect that, especially since its source code was leaked... [1] http://technet.microsoft.com/en-us/security/dn467918 http://technet.microsoft.com/en-us/security/dn467918 [2] http://www.zdnet.com/blog/security/microsoft-kicks-chinese-company-out-of-vulnerability-sharing-program/11853 http://www.zdnet.com/blog/security/microsoft-kicks-chinese-c... [3] https://www.microsoft.com/en-us/sharedsource/default.aspx https://www.microsoft.com/en-us/sharedsource/default.aspx [4] https://wikileaks.org/wiki/Microsoft_COFEE_(Computer_Online_Forensics_Evidence_Extractor)_tool_and_documentation,_Sep_2009 https://wikileaks.org/wiki/Microsoft_COFEE_(Computer_Online_...