IPv6 Attack Kills Mac OS X and makes Windows Server 2012 restart in Seconds

Post by btilly » Wed, Dec 12, 2012, 7:03 AM UTC

smsm42 wrote: post #22

btilly wrote: post #9

Earlier quoted context omitted.

There is an active debate on whether immediate full disclosure is the right or the wrong response. In general until there is public disclosure, vendors do not feel motivated to fix problems. Unless you release details, people cannot verify that they are vulnerable. And if an exploit is already circulating among "the bad guys", then you're not doing that much damage by disclosing. In this case it looks like someone is…

That depends on the vendor. Some vendors are slow, some vendors are fast. It is wrong to say that no vendor even fixes bugs unless they are publicly disclosed, it is not what responsible disclosure means.

Post by lloeki » Wed, Dec 12, 2012, 7:41 AM UTC

sounds wrote: post #23

dfc wrote: post #14

Earlier quoted context omitted.

I'm not defending the disclosure procedures but I think the author is under the impression that Apple is not going to care/respond and therefore not worth waiting X days before announcing publicly: "The new version of the attack is powerful enough that I decided to formally notify Apple. I don't expect them to care much--Microsoft certainly didn't think this was important to them, and Windows is much more vulnerable.…

To send router advertisement packets to a remote network (obviously spoofing the return address) shouldn't be very hard, but I don't know if firewalls or routers in between will refuse to forward the packet. Anyone want to perform a test with me?

    Source Address
                     MUST be the link-local address assigned to the
                     interface from which this message is sent.

Post by fauigerzigerk » Wed, Dec 12, 2012, 8:35 AM UTC

btilly wrote: post #9

ghshephard wrote: post #2

Disclosure to Apple - Apple notified 12-11-12. I often wonder why disclosures of these types of exploits is now, "same day" instead of "Let vendor know you will be reporting this to public in a week." I wonder if it is out of concern they will be pressured to keep quiet? There is a good practical reason for not providing advance disclosure at major conference, particularly if you're subject to some kind of NDA, becau…

There is an active debate on whether immediate full disclosure is the right or the wrong response. In general until there is public disclosure, vendors do not feel motivated to fix problems. Unless you release details, people cannot verify that they are vulnerable. And if an exploit is already circulating among "the bad guys", then you're not doing that much damage by disclosing. In this case it looks like someone is…

Post by ghshephard » Wed, Dec 12, 2012, 8:54 AM UTC

rwg wrote: post #26

splicer wrote: post #15

Earlier quoted context omitted.

When I discovered a vulnerability in Mac OS X that would allow a unprivileged user to keylog every user on the system (CVE-2007-0724), I let Apple know, then kept quiet until they fixed the issue. It took them 11 and a half months to fix. They thanked me in the security update note, and I now how a CVE on my resume. Was silence the most morally correct action? To this day, I am still unsure.

I've never thought to put CVE-IDs I'm credited for reporting on my resume. Is that...a thing? Do tech employers (outside of security consultancies) even know what a CVE-ID is?

Post by saurik » Wed, Dec 12, 2012, 9:53 AM UTC

smsm42 wrote: post #24

splicer wrote: post #15

Earlier quoted context omitted.

When I discovered a vulnerability in Mac OS X that would allow a unprivileged user to keylog every user on the system (CVE-2007-0724), I let Apple know, then kept quiet until they fixed the issue. It took them 11 and a half months to fix. They thanked me in the security update note, and I now how a CVE on my resume. Was silence the most morally correct action? To this day, I am still unsure.

Unless there were an easy workaround which you could disclose only with disclosing the rest of the problem - yes, it was.