Did Microsoft Know About the IE Zero-Day Flaw In Advance? 123
judgecorp writes "Microsoft issued an emergency patch for a flaw in the Internet Explorer browser on Friday, but there are hints that the firm may have known about the flaw two months ago. The notes to Microsoft's patch credit the TippingPoint Zero Day Initiative for finding the flaw, instead of Eric Romang, the researcher at Metasploit who made it public. ZDI's listings show its most recent report to Microsoft on 24 July, suggesting Microsoft may have known about this one for some time. The possibility raises questions about Microsoft's openness — as well as about the ethics of the zero day exploit market."
Of course Microsoft knew (Score:3, Insightful)
And the bad hackers? They submit these to competitors like Google who then "leak" the news about competitors flaw.
Re: (Score:2, Insightful)
Security by obscurity is considered bad practice. You know, what would you think if AIRCRAFT/CAR/SHIPMANUFACTURER would wait 2 months before recalling defective parts (especially dicy stuff like brakes or stuff that's critical to the structure of the thing)... I don't think you would be pleased to know that you were riding around in a death trap.
Re: (Score:1)
Then please carry on. Noone stops you from killing/hurting yourself... Of course, if something does happen, then rest assured, there will be a Darwin Award on the other side in this case.
Re: (Score:2)
Would you rather drive a car that some people know an easy way to break in to or would you prefer that one fine Tuesday the dealer quietly offers you free fix?
Re: (Score:3)
Yes, and that's exactly the problem here./
New kind of ethics in town (Score:5, Interesting)
and that is called, 'returning shareholder value'
Car manufacturers have always allowed defective products into the field, as long as the costs (lawsuits, bad press) do not outweigh the benefits (PROFIT!)
Of course, they already have lawyers on retainer, and 'good relationships' with the media outlets, so that can cover most complaints by simply quashing them with legal briefs and keeping the complainants from ever getting media coverage
There was a long period of time when MS seemed to follow that model, but they seemed to have gotten on their game in the past few years, hopefully this is not a sign that they are falling back to the lowest level of service that they can give to security issues without getting sued
Re: (Score:3)
Look, there is no such thing as a defect free product. Does not exist in any realm.
Given that, an instant recall of any product subsequently found to have a defect would shut down commerce totally. It would be completely unworkable in the real world. Its nothing about returning shareholder value. Its about keeping civilization running WHILE you fix infrastructure instead of running screaming back into the cave every time you discover a loose screw on a cabinet door.
Complex systems are complex to fix. Bu
Re:New kind of ethics in town (Score:5, Interesting)
Oh, the difference here is that exploits once discovered work almost 100% of the time on a board variety of systems. And because the pc market is mostly a monoculture, these exploits effect every system in the block!. In fact this has been observed a number of timer: Or who can forget CodeRed, iloveyou, blaster; conficker/downup, stuxnet, duqu, flame, ... All these had some major impact on the computing community, so you can't compare that with the odd broken axel or loose bolts.
Actually, they don't work 100% of the time.
Its a browser bug.
It only affects IE 6-9. Not Safari, Chrome, or Firefox.
It only appears on a few dodgy websites.
The fact that this is unheard of pretty much means its not close to affecting 100%.
But hey, thanks for reminding me about all those other exploits,
who can forget CodeRed, iloveyou, blaster; conficker/downup, stuxnet, duqu, flame,
I had indeed forgotten about these.
Probably because they never affected me.
Or anyone that I knew.
Because they got blocked by Anti Virus software on windows well before they became epidemic in scope.
And of course none of them bothered linux.
Re: (Score:2)
I had indeed forgotten about these.
Probably because they never affected me.
Or anyone that I knew.
Because they got blocked by Anti Virus software on windows well before they became epidemic in scope.
And of course none of them bothered linux.
Maybe you have poor memory? These were big news.
I worked on a second-level support desk during the iloveyou outbreak, and a great many companies that we supported were affected. Likewise blaster and codered. I was a programmer by then, but I saw the damage on several servers that weren't firewalled.
Re: (Score:2)
Serves you right for running windows servers NOT FIREWALLED.
What the hell were you thinking?
Like I said, none of those outbreaks affected me or my customers.
Re: (Score:1)
Re: (Score:1)
No, it's only bad if the secret is a vital piece of the security of the system. As Bruce Schneier said [schneier.com]:
Just because security does not require that something be kept secret, it doesn't mean that it is automatically smart to publicize it.
Re: (Score:2)
You are also a moron. IE will not kill you (not that I have found yet). Bad breaks will. Terrible comparison.
Bad brakes can kill you. That would be a bad break. Terrible spelling.
Re: (Score:1)
Well a bad break in your neck might kill you.
Re: (Score:2)
The Concorde crash springs to mind. They'd been warned for a long time that the fuel tanks lacked shielding and were at risk y
Re: (Score:2)
Aircraft can go for YEARS still using parts known to be a risk.
Four to be exact [nzherald.co.nz]. I'm sure a cost/benefit agreement was reached. Brings little comfort to the passengers.
As for the Concorde, about as freaky as accidents get. More than one airliner has been brought down by a popped tire.
Re: (Score:3)
Re:Of course Microsoft knew (Score:5, Informative)
And the bad hackers? They submit these to competitors like Google who then "leak" the news about competitors flaw.
I'm pretty sure that Google discretely notifies Microsoft of flaws that it is aware of.
Re:Of course Microsoft knew (Score:5, Insightful)
And why is that? Google would love to see Microsoft die.
You don't bring nukes to a knife fight. Sure, you win the knife fight, but now everyone else knows to nuke you first and ask questions later.
Re: (Score:2)
Can someone forward the parent post to every world leader, corporation and Murdoch paper on the planet.
Re: (Score:2)
Except that you're talking shit. Microsoft has been credited with informing their competitors of vulnerabilities as often as Microsoft's competitors have been credited with informing them of vulnerabilities.
Re:Of course Microsoft knew (Score:5, Insightful)
Lots of answers:
* If you inform Microsoft of a flaw in IE, then Microsoft in turn notifies you of a flaw in Chrome. ;)
* Chrome's Windows version actually uses a lot of IE components (ICS stands out, if I remember right), so a flaw in IE could potentially affect Chrome, depending on what the flaw is (e.g. an IE flaw that sets a stealth/fake proxy in IE ICS, which in turn affects Chrome...)
* Just because you want your competitors to die or be diminished, doesn't mean you have to be a dick about it.
Re: (Score:2)
The component you speak of is WinInet. Chrome also uses CryptoAPI, so that's another surface.
Re: (Score:1)
I work in the field
Then you should exploit your expertise. Go back and comment on the gummi-cow-feed item.
Ba-dump.
Re:Of course Microsoft knew (Score:4, Insightful)
Not all of them can be fixed instantly, and in some instances (like this) fixing them could actually create hints for hackers to use and exploit
If you have knowledge of a critical exploit, and you can't fix it in months, then your software is not suitable for use in a production environment.
It is crucial to let system admins know as soon as you find an exploit, so they can defend themselves. You can't assume that blackhats will not find out, because they will, and you are putting your users at risk with such negligent behavior.
Your post mainly shows that you don't know what you're talking about.
Re: (Score:3)
Everyone embargoes security bug details. Everyone. Mozilla, Red Hat, Canonical, Google... Everyone does it. And many times critical bugs are embargoed for several weeks, sometimes even 6 or more months.
Re: (Score:3)
Wrong. Mozilla, Red Hat, Canonical and Google embargo the details, including the existence of, critical security bugs until a patch is available... UNLESS the exploit is publicly known already.
It's very easy to prove. Just find any critical security flaw in the CVE database and look at the date the CVE was created. Then look at the date of the official announcement, it's quite frequently weeks to months in between.
Re: (Score:2)
Yes, Red Hat will announce bugs with no patch *IF* the flaw is already publicly being exploited. Just like Microsoft.
Are those critical flaws that give remote or local privilege escalations? Let's take an example. I looked for important security flaws and found this one.
Notice the date on the announcement, it specifically says the word "Public" date. That date is 2012-01-18, however the CVE it references was created on December 7th, 2011.
So here's a critical privilege escalation bug, that was kept secre
Re: (Score:2)
Hmm.. not sure why the link was not there..
https://access.redhat.com/security/cve/CVE-2012-0056 [redhat.com]
Re: (Score:2)
I'm not sure what your point is. The CVE is merely evidence of the MINIMUM amount of time the flaw has been known by the vendor. I only gave examples of vendor acknowledge flaws, so they're valid CVE's.
I didn't go trolling the CVE database, I went trolling the vendor acknowledged security bulletin database, then used the CVE they acknowledge to back up the claim.
It seems in your rush to call me an idiot, you were looking in the mirror.
Re:Of course Microsoft knew (Score:4, Informative)
Prove what, specifically? If you're going to be a dick, you should be specific about it. But here's a recent example.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3965 [mitre.org]
The CVE was created on July 11th, 2012. However, the existence of the flaw were not announced until August 29th, 2012.
There are many many more, and I will leave it as an exercise for anyone that wants more proof. Just look at the date the CVE was created (the assigned date) and look at the date of the announcement.
Re: (Score:2)
Nice of you to quote that part, but leave off the part that answers the question you're asking. That's seriously fucked up, dude.
Do it yourself. I told you how to prove it. It's very easy.
Re: (Score:2)
Re:Of course Microsoft knew (Score:5, Insightful)
Nice offhand remark about Google leaking MS zero days. Got anything to back that up?
tl;dr - utter rubbish. Yes, I work in the field too and have done for over 10 years.
Re: (Score:2)
I used to run a large network
Things have changed and are changing rapidly. Dev opps means that on a well run large network (at least one under central control, like a corporate one) it should be possible to put a patch on 200 servers, and probably 80%+ of those desktops in as much time. Actually you should be do the deployment work in about the 4-6 hours it takes to test patch, and patch process on the representative test machines, the rest of the 48 hours should be waiting for clients to check in and servers to hit reboot schedules
Re: (Score:2)
Re: (Score:2)
Perhaps you would like to explain why Mozilla regularly embargoes details of critical security bugs for months as well then?
The answer is that it's irresponsible to release details of a bug when no patch yet exists.
Re: (Score:2)
Wrong in so many ways..
For one, you assume that only one person discovered or knows about the flaw, that same person is a "good" person and not using the flaw to their advantage for hacking/cracking, and the only other people they told about it was MS.
And you assume announcing a flaw well before you have a fix in hand won't send two thousand hackers rushing in to try to exploit it.
Or maybe you think all hackers are honorable and wouldn't try to exploit something they read about but for which there is no current fix?
Do you even read the shit you post?
Re: (Score:2)
They could have slipped the patch in on any patch Tuesday without tipping their hand (it wouldn't be the first time a security fix was slipped in).
Re: (Score:2)
And they may have done just that, by slipping in a signature into the millions of machines running Microsoft Security Essentials, looking for the droppings of the exploit even when they haven't found the actual hole.
They may have known it wasn't being widely exploited (Eric Romang didn't discover it till Sept 17), just because they were not getting hits in MSE, and had time to seek a complete patch.
Re: (Score:2)
Checking for the signature of an actual attack is not at all the same as shipping a patch to PREVENT that attack from succeeding AT ALL.
Re: (Score:2)
Checking for the signature of an actual attack is not at all the same as shipping a patch to PREVENT that attack from succeeding AT ALL.
Exactly. But it does provide a measurement of how fast (it at all) the exploit is spreading, and prevents the currently known payloads from being installed while a solution is found that would allow the vulnerability to be permanently closed.
It allows you to triage the various exploits that need the most immediate attention.
Re: (Score:2)
It prevented nothing. If they had the patch, they should have shipped it. If they didn't (they do take time to develop and test) they should be honest about that.
Re: (Score:2)
Being honest about it does not include advertising a vulnerability you have no solution for.
How would that possibly make the problem better?
Its like hanging a big sign on your front door that says your lock is broken.
Re: (Score:2)
They have a patch now don't they?
Re: (Score:2)
Probably you do as well, if you have auto-updates applied.
Quote first sentence of Summary:
Microsoft issued an emergency patch for a flaw in the Internet Explorer browser on Friday,... the notes to Microsoft's patch credit the TippingPoint Zero Day Initiative for finding the flaw,
So problem solved.
Re: (Score:2)
There's no need for the CVE or whatever to be so explicit as to say "HACKERS GO HERE."
Hell most of the MS security patches say something entirely useless like "a security flaw has been identified in Windows that may...."
Re:Of course Microsoft knew (Score:4, Insightful)
I work in the field and can say there's tons of researchers who submit these flaws. Not all of them can be fixed instantly, and in some instances (like this) fixing them could actually create hints for hackers to use and exploit. That's why it's often better to be silent about them and make a fix ready in case they are publicly exploited. One of the worst case scenarios is if you patch something with huge notes about it and the hackers find out about the flaw that way. .
The summary makes it seem like Microsoft did something underhanded by attributing the bug report to a source that pre-dates the publishing by Eric Romang.
All this says is TippingPoint Zero Day Initiative acted responsibly, and Romang didn't.
As for how long it took, one can't make any judgement with no idea of the scope of the problem, or the testing they had to do in order to make sure the fix was proper, and didn't hurt anything else, and worked on every variety of their platform, the number of parts of the system needing the patch, etc.
Nor can we be positive that temporary measures may have been put in place until a formal patch was found, (such as a signature added to Security Essentials and shared with other security companies).
The last thing you want to do is announce you have a patch coming before you really have a patch in hand.
Re: (Score:1)
It's very simple. If you find a defect that could lead to a comprehensive security breach, and you can't fix it within a reasonable period of time (say 4-6 weeks) then you notify people of the fact that your software is defective and should not be used - no details, just simply "stop using it until we have a fix".
If your software is web enabled, and reports back to base (like IE does), issue an "update" that stops it working.
If an airline found out that their planes were vulnerable to sudden engine failure,
Rush to market. (Score:4, Insightful)
How many times have you made a quick demo/proof of concept code, only to be rushed to market besides you express statement that it isn't complete yet. Because your boss doesn't understand what it takes harden your code, or pressures you to just fix the UI to prevent the bad stuff from happening.
For example if you see a website that had javascript that clears out Single Quotes before sending the data over, it may mean that it is ripe for a SQL injection attack.
Re: (Score:1)
Geez, are we still talking about the iOS 6 maps?
Clarification Needed (please) (Score:5, Funny)
What's a "Internet Explorer" ?
Re: (Score:1)
What's a "Internet Explorer" ?
A liability.
Next question.
Re:Clarification Needed (please) (Score:5, Funny)
What's a "Internet Explorer" ?
It's the tool used to download Firefox, Chrome or Opera on new Windows PCs.
Of course, if you really hate the thing, you can always use the built in ftp client.
Re: (Score:1)
I used to do just that during my IE hate phase as I did not want to taint the poor CPU with those evil instructions into a tool of satan! I would cmd up ftp to getfirefox and even went as far as replace the blue E off every family computer and putting the firefox icon with it instead.
Maybe I am just OC?
Re: (Score:2)
What's a "Internet Explorer" ?
A small bug. It is technically part worm, part parasite, but fortunately has shrunk considerably in size from its formidable infectious years, and is easily killed and eaten these days by the Firefox...
Re: (Score:1)
Tool like any other explorers. It is meant to explore the internets. So if you dont know where your internet is hidding, you explore it every day again and again. Till you find yourself in a madhouse. simple as that. Hope it helps Everyone in their exploration and research.
Re: (Score:2)
Re: (Score:2)
You forgot a "n" before "Internet Explorer" since I is a vowel. :P
Re: (Score:1)
Anyone who types three random words into Google and clicks the I'm Feeling Lucky button earns an Internet Explorer badge. (please contact Microsoft if your badge doesn't arrive by overnight courier)
Of course they knew. (Score:3)
The person who knew was probably a grunt worker in microsoft who was hushed by his manager.
Re: (Score:2)
Depends - give MSFT's stack-ranking system, I suspect it goes like this:
If it's a coworker's flaw? You broadcast it to raise your own rankings and screw the other guy over.
If it's your flaw and you discover it way too late in the process to fix w/o raising eyebrows? You shut up and pray like hell no one finds it.
Knowing (Score:5, Informative)
Microsoft has a policy of "responsible disclosure" such that they credit the flaw to the first person who participates in that process. If that person reveals it before Microsoft, then the "responsible disclosure" did not take place and the next person is given credit. It is of no surprise that the one who made it public did not get credit from Microsoft.
You meant to say (Score:2, Funny)
1.) Guy reports exploit to M$ in February
2.) They do nothing
3.) Guy asks for progress in May
4.) They do nothing
5.) Guy asks for progress in July
6.) They do nothing
7.) Guy asks for progress in October
8.) They do nothing
9.) Guy releases exploit to public
10.) MS bitches loudly about "Google trying to smear us"
11.) MS does nothing for three days
12.) Two low-level guys are told to fix it ASAP on Monday
13.) On Tuesday they are grilled by Sinofski about progress
14.) On Wednesday Ballmer throws a chair at them
15.)
Re: (Score:2)
Re: (Score:2)
I thought that was called "profitable disclosure".
People (Score:4, Interesting)
Sometimes is good to remember that are involved people instead of big companies. Did the "company" knew about it or the people that received initially the report didn't escalated it? Who knows how much vulnerability reports they get every day, and how much of them are taken as dupes, already known, or plain sold to the biggest bidder, without the upper layers knowing about them.
Anyway, they are playing their role. It's supposed to be security by obscurity, so let put a shadow on all hints of insecurity. With a bit of luck the only aware of it will be the researcher that sent the report instead of the bad guys, so will be plenty of time to fix and schedule a deploy without anyone else knowing that it happened.
Inside Job (Score:2)
Microsoft released this flaw on themselves so they'd have an excuse to invade multiple innocent computers with security essentials. You're living in a policed antivirus society. Wake up! There was actually a third exploit that you can see being silently removed by Norton before anything hit. You think this is a coincidence?
Re: (Score:2)
What is their goal in this? What to they gain from having MSE installed on systems?
Re: (Score:2)
No if it's an inside job, it will be so they can claim that: the new win8/IE10 security methods work and this time they have solved IE's security problems.
What if they did? (Score:1)
Most companies know of flaws before they are made public.
Re: (Score:1)
MS has stated many times that they DO this.
They are fuzzing/QA'ng their own code all the time and finding things. People are submitting things. They are very clear on how they test, patch things, and credit.
This sort of attitude of 'i found a bug you must fix it *right* now' is rather silly. MS has pushed patches before they were ready and many businesses have suffered because of it. I know I have over the years had to change working code because of badly tested patches (patch 2 months later and it work
Re: (Score:2)
Have you analyzed the typical time for Mozilla, or Google to fix such issue?
Re: (Score:1)
Really I can just sense the hate. That and the ridiculous assertion made that MS purposely let it in as an inside job. ... of course if I had to write websites optimized for quirks mode all day for ancient versions I could see the angry reaction to any IE news :-)
IE 6 and 7 could be dead fast enough.
Re: (Score:2)
Well, I had a quick look at some other CVEs for the hell of it.
Mozilla:
CVE-2012-3980 - 48 days - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3980 [mitre.org] (Bugzilla entry concealed from public)
CVE-2012-3979 - 48 days - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3979 [mitre.org] (Bugzilla entry concealed from public)
CVE-2012-3968 - 48 days - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3968 [mitre.org] (Bugzilla entry concealed from public)
Google:
CVE-2012-2869 - 103 days - http://cve.mitre.org/cgi-bin/cvenam [mitre.org]
Ethics in the zero day exploit market? (Score:3)
Ethics? (Score:3)
The possibility raises questions about Microsoft [...] as well as about the ethics of the zero day exploit market.
You're kidding me, right? You expect ethics on a market whose primary customers are spies and criminals? Selling to manufacturer is only the sale of the last resort.....
No (Score:2)
If Microsoft knew about it, it wasn't a zero-day vulnerability
Re: (Score:2)
Um, how do you figure? A vulnerability that hasn't been fixed when a product is released is still a vulnerability, and it still occurs pre-release, so that satisfies both criteria for being a zero day vulnerability.
Define Zero-Day... (Score:1)
Not sure what the problem is here (Score:1)
Re: (Score:1)
This is typical 0-day process. I'm not sure why there is now a problem with the 0-day ethics. But companies that sell their 0-day protection have always paid for and then given to M$ and 0racle (0-details), etc while leaving their customers protected. This is part of the "No more free bugs" approach, it provides a legitimate way to sell your discovery which someone worked towards, while knowing it is going to be responsibly disclosed and tracked and even that some people will be nearly immediately protec
Here is how vunlerability disclosure should work (Score:1)