Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows System Exploit

megafrock.com

Post reply on HN
Print view View original

31–40 of 49 posts

Re: Windows System Exploit

#31

Post by santaragolabs »

exDM69 wrote: post #21
kyberias wrote: post #11

I think this it utterly irresponsible to publish without trying to contact Microsoft's security team first. Why on earth?

I wonder how easy it is to actually contact Microsoft on matters like this? It would probably take hours upon hours of searching convoluted corporate websites just to get an e-mail address or phone number to contact. Just slamming it on the web and posting on hacker news will take less time and is sure to reach Microsoft's attention quickly :) Sure, it's not responsible but not everyone is.

Pretty easy; you just email secure@microsoft.com (there are PGP or S/MIME keys available too) and you generally receive a response in a maximum of 48 hours. In most cases you get a reply within a few hours stating that you've passed their spamfilters, that they've done an initial overview of your report and that they will start looking into it.

If you google for "microsoft report security vulnerability" the first page you get is this: http://technet.microsoft.com/en-us/security/ff852094.aspx. Doesn't get much clearer than that in my opinion.

Re: Windows System Exploit

#32

Post by santaragolabs »

ygra wrote: post #18
upthedale wrote: post #16

Earlier quoted context omitted.

So you're saying you should only do the right thing if there's something in it for you?

It's probably a better incentive than getting nothing back :-)

You get better security back for all the Windows machines that are in your local network, the ones that your customers use or the Windows/Azure servers you use for your day to day business.

If you dump it online way more people start looking at it. They might be able to turn it into a reliable exploit leaving you, your customers and your servers at risk.

But the last thing HN needs is another debate on the pro's and cons of full disclosure; that's been done to death in the past decade all over the web :)

Re: Windows System Exploit

#33

Post by kyberias »

orik wrote: post #19
kyberias wrote: post #11

I think this it utterly irresponsible to publish without trying to contact Microsoft's security team first. Why on earth?

This would put more pressure on Microsoft to fix the issue at hand, no?

Perhaps but it also increases the probability that a possible security issue gets exploited. I suspect the author just wants publicity first. Ego talks.

Re: Windows System Exploit

#34

Post by kyberias »

wcchandler wrote: post #29

I hate the idea of "full disclosure." I, instead, love what this author has done. You found a bug, you're posting about it. Great. Any decent, respectable, commercial enterprise should have somebody watching sites like this, looking for posts like these. They shouldn't rely on somebody taking time away from themselves or their projects and write up a bug report. No.

I don't get it. It takes the exact same time to write a report to Microsoft about it. The author clearly didn't even consider it.

Re: Windows System Exploit

#35

Post by santaragolabs »

easy_rider wrote: post #14

Untill proven otherwise this totally violates full Disclosure policies. I know they are like 'gentleman agreements' but this feels bad, and looks bad, like the author is only out for some internet fame. I can not believe that he in any way tried to contact Microsoft, but clearly took his time on this publication.

There are tons of developers who've got no experience dealing with (potential) security issues or have any idea about the "gentleman agreements" that are prevalent in the security- versus the IT-industry. So it could very well be that he has no idea what he's doing.

Then again; every 12 months or so the debate regarding full/responsible/no disclosure flares up again in the security-/IT-industry after another public outcry regarding one specific bug, company or patch. In the end nothing is resolved and we still continue to rely on gentleman agreements.

Re: Windows System Exploit

#37

Post by maxdeliso »

bdonlan wrote: post #17
easy_rider wrote: post #14

Untill proven otherwise this totally violates full Disclosure policies. I know they are like 'gentleman agreements' but this feels bad, and looks bad, like the author is only out for some internet fame. I can not believe that he in any way tried to contact Microsoft, but clearly took his time on this publication.

I kind of get the feeling that the author doesn't really know what he's doing. The actual exploit code is a fragment of what looks like a 'hello world' sort of console IO test. The 0xC0000000 he goes on and on about is just GENERIC_READ | GENERIC_WRITE, which is a totally legal combination. And he disassembles his own code for no particularly good reason. Given all of this, it's not really a surprise that he's not cl…

I haven't exactly pinpointed the cause of the problem, I just noted that that call was the last point in my code to get executed before the system was hosed.

Also, the code is complete: check the tarball listed at the end of the page.

Re: Windows System Exploit

#38

Post by maxdeliso »

kyberias wrote: post #36

Ok, tried it. This DOES NOT trigger blue screen on Windows 8 (64bit) / Visual Studio 2012. I'm pretty sure the author has some other problems in his environment.

This is not the case.

Did you use the makefile to build it? I'm thinking that those specific compile and link flags are key to the triggering condition.

I've gotten it to crash at least three or four times on several windows 7 boxes of wildly differing configurations. No confirmed trials on a windows eight box, the bug may have been fixed there.

Re: Windows System Exploit

#39

Post by wcchandler »

kyberias wrote: post #34
wcchandler wrote: post #29

I hate the idea of "full disclosure." I, instead, love what this author has done. You found a bug, you're posting about it. Great. Any decent, respectable, commercial enterprise should have somebody watching sites like this, looking for posts like these. They shouldn't rely on somebody taking time away from themselves or their projects and write up a bug report. No.

I don't get it. It takes the exact same time to write a report to Microsoft about it. The author clearly didn't even consider it.

We don't know the author. He may very well enjoy writing these types of articles. Filling out a form online? Maybe not so much. He also has complete freedom in writing anything he wants with no obligation of providing further proof or information. To some, that's enough motivation.

Re: Windows System Exploit

#40

Post by gpvos »

wcchandler wrote: post #29

I hate the idea of "full disclosure." I, instead, love what this author has done. You found a bug, you're posting about it. Great. Any decent, respectable, commercial enterprise should have somebody watching sites like this, looking for posts like these. They shouldn't rely on somebody taking time away from themselves or their projects and write up a bug report. No.

What this author has done is full disclosure. Writing a bug report falls under "responsible disclosure".
Post reply on HN