I think this it utterly irresponsible to publish without trying to contact Microsoft's security team first. Why on earth?
Windows System Exploit
11–20 of 49 posts
Re: Windows System Exploit
#12Earlier quoted context omitted.
Agreed. Raymond Chen refers to these types of problems as involving "being on the other side of this airtight hatchway": http://blogs.msdn.com/b/oldnewthing/archive/2010/05/11/10009...
That's not entirely true - non-privileged local users are not supposed to be able to bluescreen the system. Note that, e.g. Terminal Server exists.
You can cause a blue screen by trying to copy the device context of the screen to itself with BitBlt - a stupid thing to do but still causes a blue screen
Re: Windows System Exploit
#13I think this it utterly irresponsible to publish without trying to contact Microsoft's security team first. Why on earth?
They don't have a vulnerability reward program, so why on earth would you?
Re: Windows System Exploit
#14Untill proven otherwise this totally violates full Disclosure policies. I know they are like 'gentleman agreements' but this feels bad, and looks bad, like the author is only out for some internet fame. I can not believe that he in any way tried to contact Microsoft, but clearly took his time on this publication.
Re: Windows System Exploit
#15Untill proven otherwise this totally violates full Disclosure policies. I know they are like 'gentleman agreements' but this feels bad, and looks bad, like the author is only out for some internet fame. I can not believe that he in any way tried to contact Microsoft, but clearly took his time on this publication.
Re: Windows System Exploit
#16I think this it utterly irresponsible to publish without trying to contact Microsoft's security team first. Why on earth?
They don't have a vulnerability reward program, so why on earth would you?
So you're saying you should only do the right thing if there's something in it for you?
Re: Windows System Exploit
#17Untill proven otherwise this totally violates full Disclosure policies. I know they are like 'gentleman agreements' but this feels bad, and looks bad, like the author is only out for some internet fame. I can not believe that he in any way tried to contact Microsoft, but clearly took his time on this publication.
I kind of get the feeling that the author doesn't really know what he's doing. The actual exploit code is a fragment of what looks like a 'hello world' sort of console IO test. The 0xC0000000 he goes on and on about is just GENERIC_READ | GENERIC_WRITE, which is a totally legal combination. And he disassembles his own code for no particularly good reason.
Given all of this, it's not really a surprise that he's not clear on responsible disclosure policies (this doesn't really violate 'full disclosure policies' - he's fully disclosing it, after all!). It sounds like he was just playing around with things, found a way to crash his own machine by accident, and decided to post it online.
I also note that the code is incomplete, and looks reasonably straightforward and correct from casual inspection. I wonder if the real cause is elsewhere?
Re: Windows System Exploit
#18Re: Windows System Exploit
#19I think this it utterly irresponsible to publish without trying to contact Microsoft's security team first. Why on earth?
This would put more pressure on Microsoft to fix the issue at hand, no?
Re: Windows System Exploit
#20Earlier quoted context omitted.
That's not entirely true - non-privileged local users are not supposed to be able to bluescreen the system. Note that, e.g. Terminal Server exists.
You can cause a blue screen by trying to copy the device context of the screen to itself with BitBlt - a stupid thing to do but still causes a blue screen
Sounds interesting. Anyone else have evidence for Microsoft's policy of ignoring local DoS vulns?