×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Did Microsoft Know About the IE Zero-Day Flaw In Advance?

samzenpus posted about a year and a half ago | from the is-this-a-feature? dept.

Microsoft 123

judgecorp writes "Microsoft issued an emergency patch for a flaw in the Internet Explorer browser on Friday, but there are hints that the firm may have known about the flaw two months ago. The notes to Microsoft's patch credit the TippingPoint Zero Day Initiative for finding the flaw, instead of Eric Romang, the researcher at Metasploit who made it public. ZDI's listings show its most recent report to Microsoft on 24 July, suggesting Microsoft may have known about this one for some time. The possibility raises questions about Microsoft's openness — as well as about the ethics of the zero day exploit market."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

123 comments

Of course Microsoft knew (3, Insightful)

s0446 (2737999) | about a year and a half ago | (#41439449)

I work in the field and can say there's tons of researchers who submit these flaws. Not all of them can be fixed instantly, and in some instances (like this) fixing them could actually create hints for hackers to use and exploit. That's why it's often better to be silent about them and make a fix ready in case they are publicly exploited. One of the worst case scenarios is if you patch something with huge notes about it and the hackers find out about the flaw that way.

And the bad hackers? They submit these to competitors like Google who then "leak" the news about competitors flaw.

Re:Of course Microsoft knew (2, Insightful)

Anonymous Coward | about a year and a half ago | (#41439633)

Security by obscurity is considered bad practice. You know, what would you think if AIRCRAFT/CAR/SHIPMANUFACTURER would wait 2 months before recalling defective parts (especially dicy stuff like brakes or stuff that's critical to the structure of the thing)... I don't think you would be pleased to know that you were riding around in a death trap.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41439681)

I'd rather drive around a car that few people know how to break than to drive around a car that everyone knows how to break.

Re:Of course Microsoft knew (1)

Anonymous Coward | about a year and a half ago | (#41439957)

Then please carry on. Noone stops you from killing/hurting yourself... Of course, if something does happen, then rest assured, there will be a Darwin Award on the other side in this case.

Re:Of course Microsoft knew (1)

sjames (1099) | about a year and a half ago | (#41441139)

Would you rather drive a car that some people know an easy way to break in to or would you prefer that one fine Tuesday the dealer quietly offers you free fix?

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41443419)

Or maybe the dealer just doesn't fix it at all and doesn't tell you how widespread the knowledge to break into your car is. In fact, the dealer probably has reasons to downplay the extent of the problem.

New kind of ethics in town (4, Interesting)

garyisabusyguy (732330) | about a year and a half ago | (#41439791)

and that is called, 'returning shareholder value'

Car manufacturers have always allowed defective products into the field, as long as the costs (lawsuits, bad press) do not outweigh the benefits (PROFIT!)

Of course, they already have lawyers on retainer, and 'good relationships' with the media outlets, so that can cover most complaints by simply quashing them with legal briefs and keeping the complainants from ever getting media coverage

There was a long period of time when MS seemed to follow that model, but they seemed to have gotten on their game in the past few years, hopefully this is not a sign that they are falling back to the lowest level of service that they can give to security issues without getting sued

Re:New kind of ethics in town (2)

icebike (68054) | about a year and a half ago | (#41442599)

Look, there is no such thing as a defect free product. Does not exist in any realm.

Given that, an instant recall of any product subsequently found to have a defect would shut down commerce totally. It would be completely unworkable in the real world. Its nothing about returning shareholder value. Its about keeping civilization running WHILE you fix infrastructure instead of running screaming back into the cave every time you discover a loose screw on a cabinet door.

Complex systems are complex to fix. But they work. Bugs and all. They hang together.
Loose axle bolts on a pickup truck, or an obscure vulnerability in a browser. 99.9999% of the users will not encounter the problem, and when they do the vast majority of them will not get hurt.
However, everybody gets hurt when idealists rush in, order all IE9 users to cease and desist using it, and all pickup trucks owners to park them until a fix is found. Its ridiculous.

Further, You can't "quash" anything these days. Don't even go there.
Bugs get fixed in order of priority. Triage. Look it up some time.

Re:New kind of ethics in town (0)

Anonymous Coward | about a year and a half ago | (#41443309)

Look, there is no such thing as a defect free product. Does not exist in any realm.

Given that, an instant recall of any product subsequently found to have a defect would shut down commerce totally. It would be completely unworkable in the real world. Its nothing about returning shareholder value. Its about keeping civilization running WHILE you fix infrastructure instead of running screaming back into the cave every time you discover a loose screw on a cabinet door.

Complex systems are complex to fix. But they work. Bugs and all. They hang together.
Loose axle bolts on a pickup truck, or an obscure vulnerability in a browser. 99.9999% of the users will not encounter the problem, and when they do the vast majority of them will not get hurt.
However, everybody gets hurt when idealists rush in, order all IE9 users to cease and desist using it, and all pickup trucks owners to park them until a fix is found. Its ridiculous.

Further, You can't "quash" anything these days. Don't even go there.
Bugs get fixed in order of priority. Triage. Look it up some time.

Oh, the difference here is that exploits once discovered work almost 100% of the time on a board variety of systems. And because the pc market is mostly a monoculture, these exploits effect every system in the block!. In fact this has been observed a number of timer: Or who can forget CodeRed, iloveyou, blaster; conficker/downup, stuxnet, duqu, flame, ... All these had some major impact on the computing community, so you can't compare that with the odd broken axel or loose bolts.

Re:New kind of ethics in town (4, Interesting)

icebike (68054) | about a year and a half ago | (#41443677)

Oh, the difference here is that exploits once discovered work almost 100% of the time on a board variety of systems. And because the pc market is mostly a monoculture, these exploits effect every system in the block!. In fact this has been observed a number of timer: Or who can forget CodeRed, iloveyou, blaster; conficker/downup, stuxnet, duqu, flame, ... All these had some major impact on the computing community, so you can't compare that with the odd broken axel or loose bolts.

Actually, they don't work 100% of the time.
Its a browser bug.
It only affects IE 6-9. Not Safari, Chrome, or Firefox.
It only appears on a few dodgy websites.
The fact that this is unheard of pretty much means its not close to affecting 100%.

But hey, thanks for reminding me about all those other exploits,

who can forget CodeRed, iloveyou, blaster; conficker/downup, stuxnet, duqu, flame,

I had indeed forgotten about these.
Probably because they never affected me.
Or anyone that I knew.

Because they got blocked by Anti Virus software on windows well before they became epidemic in scope.
And of course none of them bothered linux.

Re:New kind of ethics in town (1)

Wes Beckwith (2738081) | about a year and a half ago | (#41443097)

It does not surprise me about MS software and IE. But what is weird to me is how people jump on MS and not others. I am sure Firefox has made mistakes... Wes Beckwith

Re:Of course Microsoft knew (1)

Anonymous Coward | about a year and a half ago | (#41440899)

No, it's only bad if the secret is a vital piece of the security of the system. As Bruce Schneier said [schneier.com]:

Just because security does not require that something be kept secret, it doesn't mean that it is automatically smart to publicize it.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41440913)

Security by obscurity is considered bad practice. You know, what would you think if AIRCRAFT/CAR/SHIPMANUFACTURER would wait 2 months before recalling defective parts (especially dicy stuff like brakes or stuff that's critical to the structure of the thing)... I don't think you would be pleased to know that you were riding around in a death trap.

You are also a moron. IE will not kill you (not that I have found yet). Bad breaks will. Terrible comparison.

Re:Of course Microsoft knew (1)

dcollins117 (1267462) | about a year and a half ago | (#41441249)

You are also a moron. IE will not kill you (not that I have found yet). Bad breaks will. Terrible comparison.

Bad brakes can kill you. That would be a bad break. Terrible spelling.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41441849)

Security by obscurity is considered bad practice. You know, what would you think if AIRCRAFT/CAR/SHIPMANUFACTURER would wait 2 months before recalling defective parts (especially dicy stuff like brakes or stuff that's critical to the structure of the thing)... I don't think you would be pleased to know that you were riding around in a death trap.

You are also a moron. IE will not kill you (not that I have found yet). Bad breaks will. Terrible comparison.

Have you worked in the fields? Because if something goes wrong because malware is running wild thanks to such an perfect exploit, then no matter what "IT'S YOUR HEAD. WE MIGHT NOT KNOW WHAT WE ARE DOING, BUT YOU GET PAID FOR THAT". So please tell me again, why is this a terrible comparision?

Re:Of course Microsoft knew (1)

abigsmurf (919188) | about a year and a half ago | (#41442105)

2 months? Aircraft can go for YEARS still using parts known to be a risk. Grounding aircraft is extremely expensive, it only happens in extremely serious cases (usually where an issue has been identified as causing a crash). Otherwise the fixes can wait until the next piece of scheduled maintenance on the aircraft or even it's next major refit. Sometimes they decide not to bother.

The Concorde crash springs to mind. They'd been warned for a long time that the fuel tanks lacked shielding and were at risk yet didn't address it on the plane that crashed.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41442319)

2 months? Aircraft can go for YEARS still using parts known to be a risk. Grounding aircraft is extremely expensive, it only happens in extremely serious cases (usually where an issue has been identified as causing a crash). Otherwise the fixes can wait until the next piece of scheduled maintenance on the aircraft or even it's next major refit. Sometimes they decide not to bother.

  The Concorde crash springs to mind. They'd been warned for a long time that the fuel tanks lacked shielding and were at risk yet didn't address it on the plane that crashed.

Quite right! And we talking here about a "zero-day" flaw... which really is: "as worse as it can get".
SysAdmins usually bare the full force of these issues, that is until there's some sort of a (hot-)fix.

Re:Of course Microsoft knew (2)

fustakrakich (1673220) | about a year and a half ago | (#41442421)

Aircraft can go for YEARS still using parts known to be a risk.

Four to be exact [nzherald.co.nz]. I'm sure a cost/benefit agreement was reached. Brings little comfort to the passengers.

As for the Concorde, about as freaky as accidents get. More than one airliner has been brought down by a popped tire.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41443203)

Sadly, even if the pilots had *immediately* noticed and correctly diagnosed the issue which led to the crash of the Concorde (which is physically impossible given what happened), it was too late for any difference to be made for that particular airliner. They were already past the point of no return (not enough room left to brake and come to a full stop), and the airframe didn't survive long enough to get turned around and land.

All because of a small piece of debris, unnoticed on the runway, fallen off a flight which had used that runway earlier.

Re:Of course Microsoft knew (2)

jmerlin (1010641) | about a year and a half ago | (#41444329)

This isn't security by obscurity. And to point out, all current security is based on obscurity. The fact that all you need is a key to get access to something is, by definition, securing something by obscurity (the key is obscured). A measure of the quality of a security system is how local the obscurity is, which makes it easier to measure the strength. So if ALL of the obscurity is in the key, and there isn't an attack to weaken the key space, it's pretty easy to determine just how secure something is.

This, on the other hand, is not telling the criminals that the armored truck accidentally broke down on its route. The point of security here isn't "we have flaws but if nobody ever knows about them, we're fine", it's "we have flaws that were reported, we're working to fix them, and we'd rather not publicly announce them until they're fixed." There's a huge difference.

Re:Of course Microsoft knew (4, Informative)

Antony T Curtis (89990) | about a year and a half ago | (#41439647)

And the bad hackers? They submit these to competitors like Google who then "leak" the news about competitors flaw.

I'm pretty sure that Google discretely notifies Microsoft of flaws that it is aware of.

Re:Of course Microsoft knew (0)

s0446 (2737999) | about a year and a half ago | (#41439713)

And why is that? Google would love to see Microsoft die.

Re:Of course Microsoft knew (5, Insightful)

CTachyon (412849) | about a year and a half ago | (#41440089)

And why is that? Google would love to see Microsoft die.

You don't bring nukes to a knife fight. Sure, you win the knife fight, but now everyone else knows to nuke you first and ask questions later.

Typical Case Of M$ Paranioa (0)

Anonymous Coward | about a year and a half ago | (#41440569)

"Google would love to see Microsoft die"

That is how M$ operates: Kill every competitor at all cost and by all means. You expect your competitors to have the same Sickness of Mind.

Re:Typical Case Of M$ Paranioa (0)

Anonymous Coward | about a year and a half ago | (#41443757)

Um, when its Google? Yes. Google is as evil as Microsoft, Apple, and anyone else as big.

Re:Of course Microsoft knew (4, Insightful)

Penguinisto (415985) | about a year and a half ago | (#41440783)

Lots of answers:

* If you inform Microsoft of a flaw in IE, then Microsoft in turn notifies you of a flaw in Chrome.
* Chrome's Windows version actually uses a lot of IE components (ICS stands out, if I remember right), so a flaw in IE could potentially affect Chrome, depending on what the flaw is (e.g. an IE flaw that sets a stealth/fake proxy in IE ICS, which in turn affects Chrome...)
* Just because you want your competitors to die or be diminished, doesn't mean you have to be a dick about it. ;)

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41442215)

And, of course, you might want to check your own code. For example, the HTTPS certificate chaning vunerablilty where the SSL certificate chaining did check that signatures were correct on the certificates, but did not actually check the signing certificate was trusted by its signer for signing certificates. I could get a legit SSL certificate for any domain (easy enough) and then use that certificate to sign another fake "amazon.com" certificate.

From memory, KDE / Konqurer (the KDE web browser) and Internet Explorer were vunerable to this, among many other browsers - completely different code-bases, nothing (code wise) in common, but both shared the same fault.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41442161)

Tavis Ormandy, CVE 2010-1885.

Discretely notified indeed.

(wow, that was two years ago? Feels like just yesterday...)

Re:Of course Microsoft knew (1)

Anonymous Coward | about a year and a half ago | (#41439783)

I work in the field

Then you should exploit your expertise. Go back and comment on the gummi-cow-feed item.

Ba-dump.

Re:Of course Microsoft knew (0, Flamebait)

Anonymous Coward | about a year and a half ago | (#41439831)

I work in the field and can say there's tons of researchers who submit these flaws. Not all of them can be fixed instantly, and in some instances (like this) fixing them could actually create hints for hackers to use and exploit. That's why it's often better to be silent about them and make a fix ready in case they are publicly exploited. One of the worst case scenarios is if you patch something with huge notes about it and the hackers find out about the flaw that way.

And the bad hackers? They submit these to competitors like Google who then "leak" the news about competitors flaw.

Your shill status is identifiable from miles away. First user post, first post, and Google bashing (not arguing that google is better but what's the point in this comment). So why do you keep posting? You're not doing a good job. For a person like me who is responsible for decisions about OS installs in hundreds of computers, this type of astrosurfing actually makes me not believe anything good about Microsoft clames, Microsoft advertising, or even Microsoft 3th party "independent" product reviews.

The only possible way I could visualize a scenario in witch astrosurfing is needed is if there weren't actually any truthful "good honest reviews" since this actually mines the credibility of them.

Also, since this spam actually annoys me, I've developed a very bad emotional response to Microsoft, making me want to say: Go the Fuck away.

Re:Of course Microsoft knew (4, Insightful)

Anonymous Coward | about a year and a half ago | (#41440129)

Not all of them can be fixed instantly, and in some instances (like this) fixing them could actually create hints for hackers to use and exploit

If you have knowledge of a critical exploit, and you can't fix it in months, then your software is not suitable for use in a production environment.

It is crucial to let system admins know as soon as you find an exploit, so they can defend themselves. You can't assume that blackhats will not find out, because they will, and you are putting your users at risk with such negligent behavior.

Your post mainly shows that you don't know what you're talking about.

Not entirely correct (0)

Anonymous Coward | about a year and a half ago | (#41440663)

I think he is giving away what kind of inflexible and sluggish bureaucracy M$ nowadays is. They shit into their pants when it comes to bugfixing, because they don't really know what their code does.

There was a story of two M$ guys being tasked to find out how Stuxnet worked. I got the impression that all of that was lots of fumbling, they did not have adequate support and certainly they did not enjoy criticism from the open source community. If M$ is only willing to put two guys on something like Stuxnet, you can clearly see what really is important for them. It's New Product Revenue. NOT Fixing Bugs For Valued Customers.

Re:Of course Microsoft knew (2)

man_of_mr_e (217855) | about a year and a half ago | (#41441283)

Everyone embargoes security bug details. Everyone. Mozilla, Red Hat, Canonical, Google... Everyone does it. And many times critical bugs are embargoed for several weeks, sometimes even 6 or more months.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41442131)

Alright, then please prove it. If you fail to produce any reasonable response (note: if you need more time, then let us know) within 2 days then this is nothing more than just empty words and we will hunt and mod you down! Note: If you are able to provide a reasonable source, you'll get of course "+1".

Re:Of course Microsoft knew (3, Informative)

man_of_mr_e (217855) | about a year and a half ago | (#41442507)

Prove what, specifically? If you're going to be a dick, you should be specific about it. But here's a recent example.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3965 [mitre.org]

The CVE was created on July 11th, 2012. However, the existence of the flaw were not announced until August 29th, 2012.

There are many many more, and I will leave it as an exercise for anyone that wants more proof. Just look at the date the CVE was created (the assigned date) and look at the date of the announcement.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41443127)

Prove what, specifically? If you're going to be a dick, you should be specific about it. But here's a recent example.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3965 [mitre.org]

The CVE was created on July 11th, 2012.

Didn't you said: "Mozilla, Red Hat, Canonical, Google..." ?
So, if you comment should hold any value, then where's one from Red Hat, Canonical and of course Google?
(I don't care about the "Everyone does it". Since that's really tough to prove... or do you know of any CVE that
has been neglected for any stuff that comes standard with OpenBSD default installation?)

Re:Of course Microsoft knew (1)

man_of_mr_e (217855) | about a year and a half ago | (#41443285)

Nice of you to quote that part, but leave off the part that answers the question you're asking. That's seriously fucked up, dude.

Do it yourself. I told you how to prove it. It's very easy.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41442191)

Details, yes, are often embargoed until after a patch is released. Notification that the bug/exploit exists within a particular system, however, is generally shared with the public by such companies as Mozilla, Red Hat, Canonical, and Google... you are completely wrong about that. An admin need not know the specifics of the exploit to inform users to restrict all IE activity to local intranet servers until further notice, or to justify forcing said countermeasure in highly-secure environments. Microsoft is quite simply on the wrong side of logic here.

And here I thought they had gotten better in recent years. Shame...

Re:Of course Microsoft knew (2)

man_of_mr_e (217855) | about a year and a half ago | (#41442389)

Wrong. Mozilla, Red Hat, Canonical and Google embargo the details, including the existence of, critical security bugs until a patch is available... UNLESS the exploit is publicly known already.

It's very easy to prove. Just find any critical security flaw in the CVE database and look at the date the CVE was created. Then look at the date of the official announcement, it's quite frequently weeks to months in between.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41442623)

No, they don't. I routinely get updates from Red Hat about security flaws for which there is no fix, which allows us to mitigate risk in our highly-secured environment. HP does the same, and has even been known to develop on-the-spot fixes for some high-profile customers. Mozilla and Canonical both make good efforts at being transparent, though they have been shown to have some problems in that department from time to time. Google, like any corporation, wants to protect its image, but it has never sat on a glaring rights-elevation bug for six months, as you claimed, and as Microsoft has been known to do.

You are not speaking the truth, sir.

Re:Of course Microsoft knew (1)

man_of_mr_e (217855) | about a year and a half ago | (#41442829)

Yes, Red Hat will announce bugs with no patch *IF* the flaw is already publicly being exploited. Just like Microsoft.

Are those critical flaws that give remote or local privilege escalations? Let's take an example. I looked for important security flaws and found this one.

Notice the date on the announcement, it specifically says the word "Public" date. That date is 2012-01-18, however the CVE it references was created on December 7th, 2011.

So here's a critical privilege escalation bug, that was kept secret for almost 6 weeks.

The public announcement was

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41440173)

-1, Ms. Shill

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41440301)

No, MS only claims they've known about the bug for two months, because, as everyone knows, 0-day bugs are way more dangerous than two month old ones. They wouldn't let it happen.

Re:Of course Microsoft knew (5, Insightful)

buglista (1967502) | about a year and a half ago | (#41440351)

This is utter bollocks. I used to run a large network and if you know there is a critical patch coming, you can plan for it. If you don't, and it gets released haphazardly (OOB), you're just fucked. There is no good way to get it on 200 servers and 2000 desktops in under 48 hours without causing major problems.
Nice offhand remark about Google leaking MS zero days. Got anything to back that up?
tl;dr - utter rubbish. Yes, I work in the field too and have done for over 10 years.

Re:Of course Microsoft knew (1)

DarkOx (621550) | about a year and a half ago | (#41443039)

I used to run a large network

Things have changed and are changing rapidly. Dev opps means that on a well run large network (at least one under central control, like a corporate one) it should be possible to put a patch on 200 servers, and probably 80%+ of those desktops in as much time. Actually you should be do the deployment work in about the 4-6 hours it takes to test patch, and patch process on the representative test machines, the rest of the 48 hours should be waiting for clients to check in and servers to hit reboot schedules.

The Voice Of Redmond (0)

Anonymous Coward | about a year and a half ago | (#41440541)

..and it's irrational behaviour. Nice to have these specimens here for examination.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41440961)

Indeed. In fact, it's not just Microsoft that embargoes details of security flaws for weeks. Take a close look at pretty much any Firefox CVE and you'll notice it was likely created at least a month earlier, sometimes several months earlier. Details of the flaw were not made public until a patch was made public.

For example:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3965

The CVE was created on July 11th, 2012. However, the details of the flaw were not released until August 29th, 2012.

So please, save the "Ethics" arguments when even open source does the exact same thing.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41440967)

That's why it's often better to be silent about them and make a fix ready in case they are publicly exploited.

Wrong in so many ways..
For one, you assume that only one person discovered or knows about the flaw, that same person is a "good" person and not using the flaw to their advantage for hacking/cracking, and the only other people they told about it was MS.

There are way too many software flaws and good and bad people are doing research to find and use them for your assumptions to considered good for everyone and every situation.

FOAD SHILL.

     

Re:Of course Microsoft knew (1)

man_of_mr_e (217855) | about a year and a half ago | (#41441247)

Perhaps you would like to explain why Mozilla regularly embargoes details of critical security bugs for months as well then?

The answer is that it's irresponsible to release details of a bug when no patch yet exists.

Re:Of course Microsoft knew (1)

icebike (68054) | about a year and a half ago | (#41442657)

Wrong in so many ways..
For one, you assume that only one person discovered or knows about the flaw, that same person is a "good" person and not using the flaw to their advantage for hacking/cracking, and the only other people they told about it was MS.

And you assume announcing a flaw well before you have a fix in hand won't send two thousand hackers rushing in to try to exploit it.
Or maybe you think all hackers are honorable and wouldn't try to exploit something they read about but for which there is no current fix?

Do you even read the shit you post?

Re:Of course Microsoft knew (1)

sjames (1099) | about a year and a half ago | (#41441071)

They could have slipped the patch in on any patch Tuesday without tipping their hand (it wouldn't be the first time a security fix was slipped in).

Re:Of course Microsoft knew (1)

icebike (68054) | about a year and a half ago | (#41442727)

And they may have done just that, by slipping in a signature into the millions of machines running Microsoft Security Essentials, looking for the droppings of the exploit even when they haven't found the actual hole.

They may have known it wasn't being widely exploited (Eric Romang didn't discover it till Sept 17), just because they were not getting hits in MSE, and had time to seek a complete patch.

Re:Of course Microsoft knew (1)

sjames (1099) | about a year and a half ago | (#41443011)

Checking for the signature of an actual attack is not at all the same as shipping a patch to PREVENT that attack from succeeding AT ALL.

Re:Of course Microsoft knew (1)

icebike (68054) | about a year and a half ago | (#41443219)

Checking for the signature of an actual attack is not at all the same as shipping a patch to PREVENT that attack from succeeding AT ALL.

Exactly. But it does provide a measurement of how fast (it at all) the exploit is spreading, and prevents the currently known payloads from being installed while a solution is found that would allow the vulnerability to be permanently closed.

It allows you to triage the various exploits that need the most immediate attention.

Re:Of course Microsoft knew (1)

sjames (1099) | about a year and a half ago | (#41443581)

It prevented nothing. If they had the patch, they should have shipped it. If they didn't (they do take time to develop and test) they should be honest about that.

Re:Of course Microsoft knew (1)

icebike (68054) | about a year and a half ago | (#41443723)

Being honest about it does not include advertising a vulnerability you have no solution for.
How would that possibly make the problem better?

Its like hanging a big sign on your front door that says your lock is broken.

Re:Of course Microsoft knew (1)

sjames (1099) | about a year and a half ago | (#41444323)

They have a patch now don't they?

Re:Of course Microsoft knew (1)

icebike (68054) | about a year and a half ago | (#41444369)

Probably you do as well, if you have auto-updates applied.

Quote first sentence of Summary:

Microsoft issued an emergency patch for a flaw in the Internet Explorer browser on Friday,... the notes to Microsoft's patch credit the TippingPoint Zero Day Initiative for finding the flaw,

So problem solved.

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41441267)

This is a pretty silly rationale, because either way you see people who don't update vulnerable, but by not releasing you also leave people that would have updated vulnerable to a flaw as well in the misguided hope that nobody else will figure it out.

Re:Of course Microsoft knew (1)

X0563511 (793323) | about a year and a half ago | (#41441273)

There's no need for the CVE or whatever to be so explicit as to say "HACKERS GO HERE."

Hell most of the MS security patches say something entirely useless like "a security flaw has been identified in Windows that may...."

Re:Of course Microsoft knew (0)

Anonymous Coward | about a year and a half ago | (#41442015)

This is only a hypothetical, but there could also be other implications - we all know that some of the more recent network intrusions used Windows 0-days. We also know that el Goog has some communication with agencies such as the NSA...and perhaps I missed an open source article about MS as well. I would assume MS would at least consider holding back public release or the fix of a Windows based 0-day (offensive and defensive related reasons) if a certain government agency requested a short and reasonable delay.

[sarcasm]Not that MS should even think about considering government requests when it comes to actions which may imperil shareholders. Patriotism takes a backseat to Capitalism, amirite?[/sarcasm]

Re:Of course Microsoft knew (3, Insightful)

icebike (68054) | about a year and a half ago | (#41442383)

I work in the field and can say there's tons of researchers who submit these flaws. Not all of them can be fixed instantly, and in some instances (like this) fixing them could actually create hints for hackers to use and exploit. That's why it's often better to be silent about them and make a fix ready in case they are publicly exploited. One of the worst case scenarios is if you patch something with huge notes about it and the hackers find out about the flaw that way. .

The summary makes it seem like Microsoft did something underhanded by attributing the bug report to a source that pre-dates the publishing by Eric Romang.
All this says is TippingPoint Zero Day Initiative acted responsibly, and Romang didn't.

As for how long it took, one can't make any judgement with no idea of the scope of the problem, or the testing they had to do in order to make sure the fix was proper, and didn't hurt anything else, and worked on every variety of their platform, the number of parts of the system needing the patch, etc.

Nor can we be positive that temporary measures may have been put in place until a formal patch was found, (such as a signature added to Security Essentials and shared with other security companies).

The last thing you want to do is announce you have a patch coming before you really have a patch in hand.

Rush to market. (3, Insightful)

jellomizer (103300) | about a year and a half ago | (#41439547)

How many times have you made a quick demo/proof of concept code, only to be rushed to market besides you express statement that it isn't complete yet. Because your boss doesn't understand what it takes harden your code, or pressures you to just fix the UI to prevent the bad stuff from happening.

For example if you see a website that had javascript that clears out Single Quotes before sending the data over, it may mean that it is ripe for a SQL injection attack.

Re:Rush to market. (1)

Anonymous Coward | about a year and a half ago | (#41439787)

Geez, are we still talking about the iOS 6 maps?

Clarification Needed (please) (5, Funny)

Anonymous Coward | about a year and a half ago | (#41439645)

What's a "Internet Explorer" ?

Re:Clarification Needed (please) (1)

Anonymous Coward | about a year and a half ago | (#41439949)

What's a "Internet Explorer" ?

A liability.

Next question.

It's a typo (0)

Anonymous Coward | about a year and a half ago | (#41440183)

It's spelled "... Exploder"

As to what it does, that should be obvious from the name.

Re:Clarification Needed (please) (5, Funny)

Alter_3d (948458) | about a year and a half ago | (#41440227)

What's a "Internet Explorer" ?

It's the tool used to download Firefox, Chrome or Opera on new Windows PCs.

Of course, if you really hate the thing, you can always use the built in ftp client.

Re:Clarification Needed (please) (1)

geekmux (1040042) | about a year and a half ago | (#41440353)

What's a "Internet Explorer" ?

A small bug. It is technically part worm, part parasite, but fortunately has shrunk considerably in size from its formidable infectious years, and is easily killed and eaten these days by the Firefox...

Re:Clarification Needed (please) (1)

Anonymous Coward | about a year and a half ago | (#41440371)

Tool like any other explorers. It is meant to explore the internets. So if you dont know where your internet is hidding, you explore it every day again and again. Till you find yourself in a madhouse. simple as that. Hope it helps Everyone in their exploration and research.

Re:Clarification Needed (please) (1)

antdude (79039) | about a year and a half ago | (#41441211)

You forgot a "n" before "Internet Explorer" since I is a vowel. :P

Of course they knew. (2)

JustAnotherIdiot (1980292) | about a year and a half ago | (#41439693)

If I've learned anything from my current position it's that if a single person find a problem, they're usually whacked on the head and told to keep their mouths shut.
The person who knew was probably a grunt worker in microsoft who was hushed by his manager.

Re:Of course they knew. (1)

Penguinisto (415985) | about a year and a half ago | (#41441019)

Depends - give MSFT's stack-ranking system, I suspect it goes like this:

If it's a coworker's flaw? You broadcast it to raise your own rankings and screw the other guy over.
If it's your flaw and you discover it way too late in the process to fix w/o raising eyebrows? You shut up and pray like hell no one finds it.

Actually, it makes sense (-1)

Anonymous Coward | about a year and a half ago | (#41439733)

MS needs to improve their stats and reputation. What better way than claiming that they fix issues within a day, while chosing to hide the fact that the hole went out KNOWINGLY?

Windows! The OS that Totalitarian nations LOVE to see ran by the western nations infrastructure and militaries. Worse, presidents like Bush II help them all the way.

Knowing (5, Informative)

Anonymous Coward | about a year and a half ago | (#41439765)

Microsoft has a policy of "responsible disclosure" such that they credit the flaw to the first person who participates in that process. If that person reveals it before Microsoft, then the "responsible disclosure" did not take place and the next person is given credit. It is of no surprise that the one who made it public did not get credit from Microsoft.

You meant to say (2, Funny)

Anonymous Coward | about a year and a half ago | (#41440847)

1.) Guy reports exploit to M$ in February
2.) They do nothing
3.) Guy asks for progress in May
4.) They do nothing
5.) Guy asks for progress in July
6.) They do nothing
7.) Guy asks for progress in October
8.) They do nothing
9.) Guy releases exploit to public
10.) MS bitches loudly about "Google trying to smear us"
11.) MS does nothing for three days
12.) Two low-level guys are told to fix it ASAP on Monday
13.) On Tuesday they are grilled by Sinofski about progress
14.) On Wednesday Ballmer throws a chair at them
15.) On the deathbed (from the Ballmer-inflicted wounds), they fix the issue
16.) On Friday MS releases the patch

Re:You meant to say (1)

Minwee (522556) | about a year and a half ago | (#41442063)

Well, it got a response. Isn't that what "response-able disclosure" is all about?

People (3, Interesting)

gmuslera (3436) | about a year and a half ago | (#41439789)

Sometimes is good to remember that are involved people instead of big companies. Did the "company" knew about it or the people that received initially the report didn't escalated it? Who knows how much vulnerability reports they get every day, and how much of them are taken as dupes, already known, or plain sold to the biggest bidder, without the upper layers knowing about them.

Anyway, they are playing their role. It's supposed to be security by obscurity, so let put a shadow on all hints of insecurity. With a bit of luck the only aware of it will be the researcher that sent the report instead of the bad guys, so will be plenty of time to fix and schedule a deploy without anyone else knowing that it happened.

Inside Job (1)

Metabolife (961249) | about a year and a half ago | (#41439871)

Microsoft released this flaw on themselves so they'd have an excuse to invade multiple innocent computers with security essentials. You're living in a policed antivirus society. Wake up! There was actually a third exploit that you can see being silently removed by Norton before anything hit. You think this is a coincidence?

Re:Inside Job (1)

Zaphod-AVA (471116) | about a year and a half ago | (#41440635)

What is their goal in this? What to they gain from having MSE installed on systems?

Re:Inside Job (0)

Anonymous Coward | about a year and a half ago | (#41440719)

Isn't it obvious?

1) Installing MSE would mean users getting rid of 3rd-party anti-virus programs.
2) 3rd-party anti-virus programs are notoriously slow and buggy, hindering machine performance
3) ???
4) Replacing with MSE would improve performance
5) MS gets to report that it takes less time to do everything on their machines.

Trying to force MSE onto user's machines is an insidious plot to improve their response times, and thus, benchmark values, for the next advertising blitz!

Re:Inside Job (1)

nzac (1822298) | about a year and a half ago | (#41441041)

No if it's an inside job, it will be so they can claim that: the new win8/IE10 security methods work and this time they have solved IE's security problems.

What if they did? (1)

Anonymous Coward | about a year and a half ago | (#41439873)

Most companies know of flaws before they are made public.

Re:What if they did? (1)

Anonymous Coward | about a year and a half ago | (#41440367)

MS has stated many times that they DO this.

They are fuzzing/QA'ng their own code all the time and finding things. People are submitting things. They are very clear on how they test, patch things, and credit.

This sort of attitude of 'i found a bug you must fix it *right* now' is rather silly. MS has pushed patches before they were ready and many businesses have suffered because of it. I know I have over the years had to change working code because of badly tested patches (patch 2 months later and it works again...). They have an ecosystem of millions of computers. You take out say 1% of those and it is a big deal.

Their cycle is usually 4-6 months from someone telling them the exploit until it is patched out. With some never being patched because no one else has found it. They roll those into the next version or a service pack. As the second they release a patch for anything the same people exploiting these sorts of things the rip it apart and figure out what it does. Opening a window of possible machines that have not been patched yet being exploited.

MS has stated many times what they do. These sorts of articles are more along the lines of 'dance MS dance for me I am bored'...

If you notice that same patch also had fixes for 5 other things that *NO* one outside of MS knew existed...

fisrst post (-1)

Anonymous Coward | about a year and a half ago | (#41439969)

we do8L't sux0r as

Lifecycle for latest IE Bugs (0)

Anonymous Coward | about a year and a half ago | (#41440215)

Hello,

I'm one of the maintainers of scip VulDB, a free vulnerability database. We do also provide additional details about the timeline of vulnerabilities. The latest IE bugs have had the following 0-day time (first known date of identification until any public release):

CVE-2012-1529 - 197 days [http://www.scip.ch/en/?vuldb.6513]
CVE-2012-2546 - 135 days [http://www.scip.ch/en/?vuldb.6514]
CVE-2012-2548 - 135 days [http://www.scip.ch/en/?vuldb.6515]
CVE-2012-2557 - 135 days [http://www.scip.ch/en/?vuldb.6516]

It's not unusual that Microsoft bugs have such a long "underground lifespan". But in the end it's hard to tell whether this delay of public disclosure or release of a countermeasure is the fault of a "blackhat", lazy researcher or Microsoft. But one thing is for sure: It takes way to long to provide a fix.

Regards,
Marc

Ethics in the zero day exploit market? (2)

rainer_d (115765) | about a year and a half ago | (#41440373)

I'm sure it exists, as long as the balance sheet is OK. A "market" (and the ZD exploit market, being largely unregulated, TTBOMK) doesn't have any ethics per-se.

More interesting would be to know (0)

Anonymous Coward | about a year and a half ago | (#41440401)

Who else knew and was that the reason Microsoft sat still with the patch.

Vendors like Microsoft share vulnerability risks involved information with government either directly or via CERT's, which in turn then forward information to parties responsible about national security ... which has been lately busy coding cyber espionage worms .... Not too hard to connect the dots really.

Ethics? (2)

mseeger (40923) | about a year and a half ago | (#41440433)

The possibility raises questions about Microsoft [...] as well as about the ethics of the zero day exploit market.

You're kidding me, right? You expect ethics on a market whose primary customers are spies and criminals? Selling to manufacturer is only the sale of the last resort.....

No (2)

fa2k (881632) | about a year and a half ago | (#41440857)

If Microsoft knew about it, it wasn't a zero-day vulnerability

Re:No (1)

Mike Buddha (10734) | about a year and a half ago | (#41441121)

Um, how do you figure? A vulnerability that hasn't been fixed when a product is released is still a vulnerability, and it still occurs pre-release, so that satisfies both criteria for being a zero day vulnerability.

Define Zero-Day... (1)

smilnrt (1648147) | about a year and a half ago | (#41442313)

So if they knew in advance it would not be a "zero-day" right? I dunno, maybe I am missing something here, carry on.

need to doubl check (0)

Anonymous Coward | about a year and a half ago | (#41442949)

it takes so long to fix the problem, because the (endless) fixes / iterations might turn it into a linux (in a couple of years).

Not sure what the problem is here (1)

detain (687995) | about a year and a half ago | (#41443617)

MS knew about an exploit and tried keeping it under wraps until it was patched. It just so happens that the exploit became widely known before they could release it with their normal update cycle so they pushed out an early update. I'm glad they don't post all the potential new exploits they become aware of until they are able to address the problems. If they were relying on outside help to maintain their security then I could see the need to make exploits known right away but as this is not the case, it doesn't make sense to tell the world about security holes like this if they are going to be able to fix it before it becomes a problem.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...