Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Four RCE Zero-Day Flaws Plague Internet Explorer

securityweek.com

Post reply on HN
Print view View original

21–30 of 34 posts

Re: Four RCE Zero-Day Flaws Plague Internet Explorer

#21

Post by thefreeman »

jerf wrote: post #9
sago wrote: post #7

Earlier quoted context omitted.

I wasn't considering anything, let alone 'making an argument'. Anyone who listens to non-specialists like me to determine security strategy is asking for trouble. I also wasn't making any comment about 'banking on difficulty of exploit', what I was asking for was relative risk. I think that all code is exploitable. The question I had was, is the exploitation of a particular UAF bug sufficiently easy that it outweighs…

I'm sorry, my tone was not intended as "what are you even talking about!?!". My tone is intended to convey that security penetration skills have become scarily good and "is it theoretical?" is almost no longer a question worth asking, because the skills, techniques, and tools to take what superficially seems to be a hairline crack into full-blown network ownership are unbelievably well developed. As I said, I am on t…

This article is a perfect example of this: http://googleprojectzero.blogspot.com/2014/08/the-poisoned-n...

The author was able to take an off by one error which allowed writing a single null byte all the way to full code execution. These guys are unbelievably good at what they do, and as you state, you can pretty much assume that any vulnerability is exploitable with sufficient effort and skill.

Re: Four RCE Zero-Day Flaws Plague Internet Explorer

#24

Post by bitmapbrother »

mizzao wrote: post #23
bitmapbrother wrote: post #22

Earlier quoted context omitted.

Since IE11 comes with Windows 10 - yes.

I thought Edge was a rewrite that threw out most of the code in old IE. Edge is not IE11.

They can't just get rid of IE11 as some businesses still use it.

Re: Four RCE Zero-Day Flaws Plague Internet Explorer

#25

Post by ludamad »

matwood wrote: post #20
david_shaw wrote: post #15

Earlier quoted context omitted.

I'm sure there's a lot that goes into fixing these, but Adobe surprised many in the security community with their fast and responsible reaction to the zero-day flaws unveiled by the Hacking Team leaks. Microsoft has the resources to fix these; I'm not sure what their excuse is (and it may be valid), but vulnerabilities like this should take highest priority.

> Microsoft has the resources to fix these; I agree, and have to assume the time to fix is back testing and checking with big vendors/users if the fix inadvertently breaks something they were relying on. At this point how many windows bugs are now features set in stone and must be carried on in perpetuity because so much software has been built around the buggy behavior?

Lots, but RCE is never a feature that will be set in stone.

Re: Four RCE Zero-Day Flaws Plague Internet Explorer

#26

Post by trengrj »

KMag wrote: post #18
amaks wrote: post #10

"Microsoft was initially given a May 12, 2015 deadline, but this deadline was extended to July 19 at the vendor’s request. Since the company failed to meet this deadline, ZDI has decided to inform users of the existence of this flaw." I would expect Microsoft to handle security vulnerabilities with a higher priority. Not sure why they are dropping this on the floor.

At some point I prototyped a tool that used Ron Rivest's timelock puzzles (repeated squaring modulo the product of two large safe primes takes a long time and isn't parallelizable, but is quick to compute if you can factor the modulus) to encrypt compressed tarballs of zero-day disclosures. The idea would be that if you found a vulnerability in a product whose vendor was likely to pour more money into gag orders and…

Do you still have access to the source? Sounds a really interesting tool even if just partly completed.

Re: Four RCE Zero-Day Flaws Plague Internet Explorer

#27

Post by na85 »

MichaelGG wrote: post #17
na85 wrote: post #11

How embarassing. I think it's hubris at this point that keeps Internet Explorer alive. I think it's been obvious for years that Microsoft just doesn't have the engineering talent to make a decent browser. It's time they bow out of that particular arena and focus on areas where they are strong.

I find it hard to believe this is a lack of engineering talent. MS has some extremely talented people and has pushed out some very neat security stuff well before, say, Apple has. I cannot believe MS has people sitting around saying "well darn we just don't know how to fix this bug for 6 months now". There's gotta be more to the story... I hope.

What's the alternative explanation?

IE has been a complete debacle since its inception.

Re: Four RCE Zero-Day Flaws Plague Internet Explorer

#28

Post by MichaelGG »

na85 wrote: post #27
MichaelGG wrote: post #17

Earlier quoted context omitted.

I find it hard to believe this is a lack of engineering talent. MS has some extremely talented people and has pushed out some very neat security stuff well before, say, Apple has. I cannot believe MS has people sitting around saying "well darn we just don't know how to fix this bug for 6 months now". There's gotta be more to the story... I hope.

What's the alternative explanation? IE has been a complete debacle since its inception.

Bad management? Thinking HP wouldn't release and putting people on other tasks in prep for Win 10? Not believing they were critical? Some messed up test or compatibility interaction that ended up slipping the release? Anything else interesting? How long do you think these will go unpatched? If they patch them in a week, will you change your opinion to "wow MS has talent but made a mistake"?

Coming to the conclusion that the world's largest software vendor that ships a rather security enhanced OS (how long did it take OSX to add ASLR), shipped plenty of memory analysis/protection features in their compiler, etc. simply lacks the talent to fix a few bugs... Someone screwed up but it's unlikely to be a technical talent issue. You need to update your priors.

PS: IE kicked ass at the beginning. I was rather excited with it around IE3. And let's not forget they invented XHR. It only totally went south once MS's management thought they'd won and disassembled the team. And hey, MS went from the leader in instant messaging (which could easily have been turned into the dominating social network) to buying Skype and dropping the MSN brand. They know how to drop the ball from a management perspective.

Re: Four RCE Zero-Day Flaws Plague Internet Explorer

#29

Post by na85 »

MichaelGG wrote: post #28
na85 wrote: post #27

Earlier quoted context omitted.

What's the alternative explanation? IE has been a complete debacle since its inception.

Bad management? Thinking HP wouldn't release and putting people on other tasks in prep for Win 10? Not believing they were critical? Some messed up test or compatibility interaction that ended up slipping the release? Anything else interesting? How long do you think these will go unpatched? If they patch them in a week, will you change your opinion to "wow MS has talent but made a mistake"? Coming to the conclusion t…

MSN Messenger was playing catchup to ICQ, they only became a leader by process of elimination when ICQ turned into adware and MSN was the only non-awful contender.

Re: Four RCE Zero-Day Flaws Plague Internet Explorer

#30

Post by tylersmith »

trengrj wrote: post #26
KMag wrote: post #18

Earlier quoted context omitted.

At some point I prototyped a tool that used Ron Rivest's timelock puzzles (repeated squaring modulo the product of two large safe primes takes a long time and isn't parallelizable, but is quick to compute if you can factor the modulus) to encrypt compressed tarballs of zero-day disclosures. The idea would be that if you found a vulnerability in a product whose vendor was likely to pour more money into gag orders and…

Do you still have access to the source? Sounds a really interesting tool even if just partly completed.

Here is an implementation of the same thing, but tailored toward encrypting Bitcoin private keys. Generalizing shouldn't be too difficult if you're interested: https://github.com/petertodd/timelock

Also a good article by Gwern about the same topic: http://www.gwern.net/Self-decrypting%20files

Post reply on HN