Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 0day exploit goes wild, and so do Microsoft marketers

arstechnica.com

Post reply on HN
Print view View original

31–40 of 78 posts

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#31

Post by gnud »

cujo wrote: post #15
ohitsdom wrote: post #14

The researcher disclosed the bug one week before Microsoft is scheduled to patch it. I'm sure MS isn't thrilled, but they did drag their feet: "I decided to release this bug one week before the patch is released, because it is not the first time Microsoft sits on my bugs. I'm doing free work here with them (I'm not paid in anyways for that) with the goal of helping their users. When they sit on a bug like this one, t…

The researcher sounds really petty. They're patching it, but not on this person's schedule so he's causing microsoft and USERS problems they didn't have before. If they weren't patching, I'd understand, but this isn't the right way to get attention in my book.

Well, I'm not sure I agree in this case.

> He told Ars that the software maker initially planned to patch the flaw in December but later decided to delay the release until February so it could be included with other planned SMB fixes.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#32

Post by pdimitar »

eli wrote: post #27
pdimitar wrote: post #17

Earlier quoted context omitted.

There are very competent people on this planet who make a very good buck out of zero-days (not to mention remotely control users' machines, and steal data). IMO the researcher didn't want that particular vulnerability to dwell on somebody's todo list for several years. It definitely puts pressure on MS but I don't think that's bad. Corporations have demonstrated time and again that the only way to get them to move is…

Just because there are other people who act totally unethically doesn't mean you get bonus points for doing kinda the right thing.

What would your solution be?

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#33

Post by drzaiusapelord »

cujo wrote: post #15
ohitsdom wrote: post #14

The researcher disclosed the bug one week before Microsoft is scheduled to patch it. I'm sure MS isn't thrilled, but they did drag their feet: "I decided to release this bug one week before the patch is released, because it is not the first time Microsoft sits on my bugs. I'm doing free work here with them (I'm not paid in anyways for that) with the goal of helping their users. When they sit on a bug like this one, t…

The researcher sounds really petty. They're patching it, but not on this person's schedule so he's causing microsoft and USERS problems they didn't have before. If they weren't patching, I'd understand, but this isn't the right way to get attention in my book.

>The researcher sounds really petty.

We live in the age of security researcher marketing. No one wants to be the anonymous guy who submitted sometnhing. They want to be the star and have all these articles written about them and all this attention. The easiest, of course unethical, way to get this is to release something before its patched regardless of what the OEM is doing in regards to patch scheduling. To release one week before patch Tuesday is a pretty big middle-finger to a lot of people for no other reason than what looks like personal gain or spite.

I imagine this decision is going to bring him a lot of negative attention. I wouldn't hire someone who 0-day'd a security bug a week before its patch out of spite.

Thankfully, connecting to a random smb is a fairly edge case. I believe most firewalls block smb to/from the internet and most consumer ISPs block the protocol outright. This probably won't have much of a real world impact.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#34

Post by becarefulyo »

simion314 wrote: post #2

Does anybody know how many days it would take from when a critical security bug is discovered in Windows and assuming that the fix is just a few lines of code and not a component rewrite and marketing is not in the way, I am wondering how many steps are from when a fix is created until is released.(I imagine that there may some QA and some managers that need to approve it but I have no idea)

Disclosure: I work at MS but not on the kernel or anything related to this security bug. Opinions are my own.

I've seen one-line bug fixes introduce many other bugs.

Adding a null check is always suspicious. Is the system in an invalid state? Should it fail fast instead of swallowing the error?

Maybe the code wasn't touched in several years. Maybe the person that wrote it no longer works there. Maybe the code in question doesn't have good test coverage or documentation. There are so many variables to consider when assessing risk of code changes.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#35

Post by cujo »

mlmlmasd wrote: post #28
cujo wrote: post #15

Earlier quoted context omitted.

The researcher sounds really petty. They're patching it, but not on this person's schedule so he's causing microsoft and USERS problems they didn't have before. If they weren't patching, I'd understand, but this isn't the right way to get attention in my book.

> so he's causing microsoft and USERS problems they didn't have before. He's not causing problems, he's solving them.

Gifting exploiters a 0day before the KNOWN patch release date, is causing problems.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#36

Post by WayneBro »

mlmlmasd wrote: post #30
eli wrote: post #27

Earlier quoted context omitted.

Just because there are other people who act totally unethically doesn't mean you get bonus points for doing kinda the right thing.

MS is acting 'totally unethically' by not patching this bug immediately and rewarding the researcher.

Meh. The bug requires you to connect Windows to a malicious SMB server.

Now that everybody knows that, if anybody is really concerned, they can stop SMB connections from LAN to WAN by blocking TCP 139, 445 and UDP 137, 138.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#37

Post by aaronbrethorst »

pizza234 wrote: post #8
simion314 wrote: post #2

Does anybody know how many days it would take from when a critical security bug is discovered in Windows and assuming that the fix is just a few lines of code and not a component rewrite and marketing is not in the way, I am wondering how many steps are from when a fix is created until is released.(I imagine that there may some QA and some managers that need to approve it but I have no idea)

There is an interesting (and very amusing) article about the general concept: https://blogs.msdn.microsoft.com/ericlippert/2003/10/28/how-many-microsoft-employees-does-it-take-to-change-a-lightbulb it doesn't directly answer the question, but things are far more complicated than they look.

URLs auto link as long as you don't indent them.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#38

Post by Mithaldu »

cujo wrote: post #15
ohitsdom wrote: post #14

The researcher disclosed the bug one week before Microsoft is scheduled to patch it. I'm sure MS isn't thrilled, but they did drag their feet: "I decided to release this bug one week before the patch is released, because it is not the first time Microsoft sits on my bugs. I'm doing free work here with them (I'm not paid in anyways for that) with the goal of helping their users. When they sit on a bug like this one, t…

The researcher sounds really petty. They're patching it, but not on this person's schedule so he's causing microsoft and USERS problems they didn't have before. If they weren't patching, I'd understand, but this isn't the right way to get attention in my book.

As a longtime windows user: No.

There's no excuse for them to delay patching it without explaining to him in detail why there's a delay, and even if he had been a dick about it, they should've had a very good explanation for the public.

They had neither and that is unacceptable.

Reason being: Even if he doesn't publicize it, someone else might know and be using it without MS knowledge. Anytime you become aware of an exploit one must act as if it already is being abused.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#39

Post by bryanrasmussen »

cujo wrote: post #15
ohitsdom wrote: post #14

The researcher disclosed the bug one week before Microsoft is scheduled to patch it. I'm sure MS isn't thrilled, but they did drag their feet: "I decided to release this bug one week before the patch is released, because it is not the first time Microsoft sits on my bugs. I'm doing free work here with them (I'm not paid in anyways for that) with the goal of helping their users. When they sit on a bug like this one, t…

The researcher sounds really petty. They're patching it, but not on this person's schedule so he's causing microsoft and USERS problems they didn't have before. If they weren't patching, I'd understand, but this isn't the right way to get attention in my book.

I don't know, I guess that really depends on the frequency and context of 'not the first time Microsoft sits on one of my bugs'. I'm not a security researcher but I suppose if I was and Microsoft was sitting on my bugs pretty frequently and they were really serious I might just give them a shot across the bows one fine day.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#40

Post by VikingCoder »

cujo wrote: post #15
ohitsdom wrote: post #14

The researcher disclosed the bug one week before Microsoft is scheduled to patch it. I'm sure MS isn't thrilled, but they did drag their feet: "I decided to release this bug one week before the patch is released, because it is not the first time Microsoft sits on my bugs. I'm doing free work here with them (I'm not paid in anyways for that) with the goal of helping their users. When they sit on a bug like this one, t…

The researcher sounds really petty. They're patching it, but not on this person's schedule so he's causing microsoft and USERS problems they didn't have before. If they weren't patching, I'd understand, but this isn't the right way to get attention in my book.

Presuming the USERS don't ALREADY have a problem is the inherent flaw in your logic.

A researcher who earns no money finding exploits is at an inherent disadvantage to black hats who DO get funding for selling the exploits they find.

Post reply on HN