Slashdot Log In
Honeymonkeys Discover Undisclosed Vulnerability
Posted by
CmdrTaco
on Fri Aug 12, 2005 07:43 AM
from the bug-hunting-is-dangerous-work dept.
from the bug-hunting-is-dangerous-work dept.
spafbnerf writes "Securityfocus is running an article on Microsoft's honeymonkey project, previously covered on Slashdot. In early July 2005, this project discovered its first exploit for a vulnerability that had not been publicly disclosed, the JView profiler vulnerability which Microsoft announced later that month. "
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Big respect to the guys behind this. (Score:5, Funny)
BUT....Damn "Honeymonkey" is such a cool codename. I'm going to name my firstborn after it!
Re:Big respect to the guys behind this. (Score:5, Funny)
At last, my search for a new nickname for my penis is over.
-Eric
Parent
Honeymonkey (Score:3, Insightful)
Seriously, MS has set up a bunch of machines that actively surf the web trolling for vulnerabilities. I guess it's the "If we can't code securely, at least we can find the holes to plug." theory. Considering IE, it's not a bad idea.
It would be nice if they shared the exploits with everyone, at least once a patch exists, though.
OK, good job Microsoft: Now if you could implement a "least privileges" model by defau
Honeymonkeys and typewriters... (Score:5, Funny)
Explains a lot...
The key word is unpatched. (Score:5, Funny)
I don't think I have a stronger word than DUH!
It just occurred to me. (Score:4, Interesting)
Why not build a virtual machine into the browser itself?
Sort of a special purpose virtual machine that has
just enough of an OS to run the browser.
If Microsoft refuses to remove IE from Windows, at least IE could be isolated from the rest of the operating system.
Re:It just occurred to me. (Score:5, Insightful)
You mean like Java ?
MS has already killed that idea because it commoditized the desktop and broke their API lock-in.
Parent
Re:It just occurred to me. (Score:3, Interesting)
No, he doesn't know it, but he's talking about OS-level Mandatory Access Controls. More like Trusted Solaris.
Windows Vista will supposedly have this.
Is it me... (Score:3, Interesting)
Obviously Microsoft copied the idea from the aptly named Honeypot [wikipedia.org].
Honeypot makes sense.
Why ever would anybody in their right mind come up with something as lame as 'Honeymonkey'?
Is it because Microsoft is 'getting old'? It's like the old guy saying "In my day, we used to say 'Whizzo!' when something was really neat", and the teenager laughs, and comments that it doesn't sound half as good as 'cool'.
Re:Is it me... (Score:4, Insightful)
A honeymonkey goes swinging around the net looking for someone to attack it.
Now if MS would compile a database of offending sites and allow me to use it as a blacklist for my browser, that'd be even better. Unfortunately they'd probably only make it available for IE.
Parent
Re:Is it me... (Score:3, Funny)
I can't imagine that there is any real attraction, seeing a monkey swinging through the trees, whereby people would line up to attack it. And how does it mix with honey?
I suppose that if you dunk the monkey in honey then some people may want to grab it and suck it - only if they're ravenous, I would have thought.
Oh for pete's sake (Score:4, Insightful)
Coincidence? (Score:3, Interesting)
Re:Coincidence? (Score:3, Informative)
honeymonkeys... (Score:4, Funny)
More Misdirection from the Masters (Score:5, Informative)
I can't believe that people are lapping this up.
The so-called vulnerability that Microsoft claim to have found a 0-day for in the second week of July was actually discovered by SEC-Consult, and first published [sec-consult.com] on June 29, having discovered it, and notified Microsoft on June 17. There was effectively nil response from Microsoft (they claimed to have not been able to reproduce the issue...).
While many people believe that the sample object used, the javaprxy.dll, was the flaw itself, the first paragraph of the advisory (the background) indicates that it is a COM level issue, and they identified at least 20 vulnerable objects on a standard XP installation.
It was this issue that Microsoft ignored until the recent Black Tuesday updates, and then claimed ownership of via the honey monkey project.
Sorry, guys, you can't claim something that has already been published openly, and ignored when notified.
Re:More Misdirection from the Masters (Score:4, Interesting)
If you read the SecurityFocus article you'll notice that MS is claiming they found the first 0-day exploit for this vulnerability *in the wild*. You are absolutely correct that a proof of vuln was published by SEC-Consult. However, no known exploit yet existed to take advantage of the vuln. And the SEC-Consulting page does note that MS was finally able to reproduce the problem.
You and I both know that it's a matter of semantics and the MS PR machine is in full effect here in the way this announcement was worded. However, that doesn't negate the interesting aspects of the honeymonkey approach. By actively trolling the net for "in the wild" exploits and vulnerabilities they're increasing the chances of finding and (hopefully) addressing security issues in a proactive manner.
Despite the fact that MS is indirectly responsible for my paycheck from my day job, I've never viewed them as a particularly security-focused company and I'll be the first to admit their track record blows goats. But the honeymonkey project is a step in the right direction and could be a useful approach for other OS's and security-minded orgs [1]. It's a neat concept and I'm frankly surprised it's MS doing it.
[1] I'm currently the moderator for SecurityFocus' penetration testing mail list. I don't get to see as much discussion of these types of things as say, the vuln-dev list, but it would be great discussion material to see if a similar approach could be utilized for pen-testing.
Parent
Sorting Wheat from Chaff (Score:3, Interesting)
I do not deny that the Honeymonkey project is useful, and will be in the future (although the figures listed for number of sites with malware seems low).
Because there was a lot of contrary reporting and postings which appeared around the start of July, it is difficult to sort the wheat from the chaff in order to obtain accurate information, but I do remember reading that proof of concept code definitely existed, and was published, at the start of July, with one example being reported on the ISC Diary [sans.org]. I a
Obligatory.... (Score:3, Funny)
Security Risk (Score:3, Insightful)
What Makes Reading /. Hard Some Times ... (Score:5, Insightful)
If an indepedent, third party security company were performing these web site audits, the company wouldn't be admonished, but readers would still attack the "unfinished product" which was Windows XP unpatched. However, how can you fault a company that is trying to correct tens of years of security ignorance with new pro-active efforts?
MSFT is basically performing external penetration testing of their software while security teams are writing vulnerability scanners and focusing on individual aspects of an application's design. In fact, one could argue that this is one of the more effective ways of performing security testing since exploits in the wild can exist in the wild for months before any security company diagnoses the vulnerability and this method will identify areas of the Internet that seem to disseminate these exploits between web sites.
If you want to comment on the lack of security focus in the past, definitely. Are they playing a major game of catch up? Definitely. Should IE be so tightly meshed with the OS? Of course not. But can some of you just grow up and get past the MSFT bias and stop doing childish crap like making fun of the "honeymonkey" term or accusing workers of just sitting in the room not doing anything?
zero day exploit?! (Score:3, Insightful)
How can you call it a zero-day exploit with a straight face when you found it in the wild??
Re:This is a good thing (Score:4, Interesting)
Parent
Re:Another one? (Score:3, Interesting)
As part of the software development lifecycle, there is a part normally called something like Testing/Debugging. I'm suggesting that maybe they should spend some more time in that stage, rather than using the major
Re:Another one? (Score:3, Insightful)
So let's say that Microsoft tests Windows Vista in this way.
What information do they learn? Remember - the bad guys don't have access to Windows Vista, so they can't know about exploits in the new code in Windows Vista.
It's a chicken and egg problem - the bad guys can't know about 0day Windows Vista exploits because they don't have access to Windows Vista to exploit it.
If they find exploits in Windows Vista, it's because they're also in XP. If they're in XP, they can simply test with XP.
A honeymonk