Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows System Exploit

megafrock.com

Post reply on HN
Print view View original

21–30 of 49 posts

Re: Windows System Exploit

#21

Post by exDM69 »

kyberias wrote: post #11

I think this it utterly irresponsible to publish without trying to contact Microsoft's security team first. Why on earth?

I wonder how easy it is to actually contact Microsoft on matters like this? It would probably take hours upon hours of searching convoluted corporate websites just to get an e-mail address or phone number to contact. Just slamming it on the web and posting on hacker news will take less time and is sure to reach Microsoft's attention quickly :) Sure, it's not responsible but not everyone is.

Re: Windows System Exploit

#22

Post by upthedale »

ygra wrote: post #18
upthedale wrote: post #16

Earlier quoted context omitted.

So you're saying you should only do the right thing if there's something in it for you?

It's probably a better incentive than getting nothing back :-)

OK, conversely, you're saying that you should do the wrong thing (as in this case), if there is no financial incentive?

Given you aren't going to get a reward either way, why not do the right thing?

Frankly, I can't believe I need to discuss the morality of this. Is it not obvious?

And yes yes, I realise this is probably a case of Hanlon's Razor, not a moral failing, but justifying it on the grounds of there being no reward is crazy.

Re: Windows System Exploit

#23

Post by WalterGR »

exDM69 wrote: post #21
kyberias wrote: post #11

I think this it utterly irresponsible to publish without trying to contact Microsoft's security team first. Why on earth?

I wonder how easy it is to actually contact Microsoft on matters like this? It would probably take hours upon hours of searching convoluted corporate websites just to get an e-mail address or phone number to contact. Just slamming it on the web and posting on hacker news will take less time and is sure to reach Microsoft's attention quickly :) Sure, it's not responsible but not everyone is.

I wonder how easy it is to actually contact Microsoft on matters like this? It would probably take hours upon hours of searching convoluted corporate websites just to get an e-mail address or phone number to contact.

You could go to microsoft.com and type "report a security vulnerability" into the search box. Then click the first result.

Re: Windows System Exploit

#24

Post by kevingadd »

mjpa wrote: post #12
JoachimSchipper wrote: post #7

Earlier quoted context omitted.

That's not entirely true - non-privileged local users are not supposed to be able to bluescreen the system. Note that, e.g. Terminal Server exists.

You can cause a blue screen by trying to copy the device context of the screen to itself with BitBlt - a stupid thing to do but still causes a blue screen

That sounds like a video driver bug, though.

Re: Windows System Exploit

#25

Post by potkor »

thedudemabry wrote: post #5
twoodfin wrote: post #3

This isn't really an exploit, except insofar as a local user can cause a DoS for the system. Until there's a demonstration that arbitrary code can be invoked with elevated privileges, it's just a bug.

Agreed. Raymond Chen refers to these types of problems as involving "being on the other side of this airtight hatchway": http://blogs.msdn.com/b/oldnewthing/archive/2010/05/11/10009...

Actually, Chen implies that it would be a security bug if an unprivileged user could do it on her own:

"Enabling the kernel debugger requires administrative privileges, so it's not like unprivileged users can force a system halt on their own".

Re: Windows System Exploit

#26

Post by ygra »

upthedale wrote: post #22
ygra wrote: post #18

Earlier quoted context omitted.

It's probably a better incentive than getting nothing back :-)

OK, conversely, you're saying that you should do the wrong thing (as in this case), if there is no financial incentive? Given you aren't going to get a reward either way, why not do the right thing? Frankly, I can't believe I need to discuss the morality of this. Is it not obvious? And yes yes, I realise this is probably a case of Hanlon's Razor, not a moral failing, but justifying it on the grounds of there being no…

Well, I was just trying to guess their reasoning. I'd have no problem doing The Right Thing™, but I'm nowhere skilled enough to find a vulnerability anyway.

As it stands I don't think there is much harm done because it's a local vulnerability, crashing a user-mode process. Annoying, maybe, but my graphics driver has a far worse track record as far as bluescreens are concerned.

Re: Windows System Exploit

#27

Post by exDM69 »

WalterGR wrote: post #23
exDM69 wrote: post #21

Earlier quoted context omitted.

I wonder how easy it is to actually contact Microsoft on matters like this? It would probably take hours upon hours of searching convoluted corporate websites just to get an e-mail address or phone number to contact. Just slamming it on the web and posting on hacker news will take less time and is sure to reach Microsoft's attention quickly :) Sure, it's not responsible but not everyone is.

I wonder how easy it is to actually contact Microsoft on matters like this? It would probably take hours upon hours of searching convoluted corporate websites just to get an e-mail address or phone number to contact. You could go to microsoft.com and type "report a security vulnerability" into the search box. Then click the first result.

Well that was easy. It even worked on the internationalized version in my native language, which is not common with corporate websites. But that's just the first step, anyway.

Re: Windows System Exploit

#28

Post by darren_ »

upthedale wrote: post #22
ygra wrote: post #18

Earlier quoted context omitted.

It's probably a better incentive than getting nothing back :-)

OK, conversely, you're saying that you should do the wrong thing (as in this case), if there is no financial incentive? Given you aren't going to get a reward either way, why not do the right thing? Frankly, I can't believe I need to discuss the morality of this. Is it not obvious? And yes yes, I realise this is probably a case of Hanlon's Razor, not a moral failing, but justifying it on the grounds of there being no…

This case is not 'the wrong thing'. The wrong thing is selling this data to criminals, or not publishing it at all because odds are someone else is going to find it eventually.

What you're calling "the right thing" isn't zero cost. It takes a fair bit of time (spaced out over a period of months, by the way, so it's not a fire and forget it report) to report a vulnerability to microsoft and follow up with their security team. More so if your vuln is at all interesting or complex. You may have to write PoCs. Your vulnerability will be patched in 4-6 months (not exaggerating, although this will obviously be quicker if it's made the news somehow), and you'll get a minute credit in their patch tuesday notes.

So no, the morality of this is not obvious. Where is my moral obligation to effectively do charity work for a megacorp that can't be bothered to keep up with industry standards in security?

Re: Windows System Exploit

#29

Post by wcchandler »

I hate the idea of "full disclosure." I, instead, love what this author has done. You found a bug, you're posting about it. Great. Any decent, respectable, commercial enterprise should have somebody watching sites like this, looking for posts like these. They shouldn't rely on somebody taking time away from themselves or their projects and write up a bug report. No.

Re: Windows System Exploit

#30

Post by nuje »

upthedale wrote: post #16
darren_ wrote: post #13

Earlier quoted context omitted.

They don't have a vulnerability reward program, so why on earth would you?

So you're saying you should only do the right thing if there's something in it for you?

Is stuffing the cracks in Windows the right thing in the end though?
Post reply on HN