Google Goes Public with Unpatched Microsoft Edge and IE Vulnerability
bugs.chromium.org
bugs.chromium.org
> I will not make any further comments on exploitability, at least not until the bug is fixed. The report has too much info on that as it is (I really didn't expect this one to miss the deadline).
Worth mentioning that "Goes Public" implies there was a human who pulled the trigger; it was a bot:
> This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public.
...
> Deadline exceeded -- automatically derestricting
is it a human or a bot?
The account that posted it, hawkes@google.com, is listed[1] as the "owner" of Project Zero, which implies to me that they may be a user account, but quite likely one that has a script running under its permissions.
There certainly could be a human-controlled kill-switch to this release process, of course, and it's possible that "hawkes" manually goes through a list of vulnerabilities every day and clicks "release".
[0] http://www.convertunits.com/dates/90/daysfrom/Nov+25,+2016 [1] https://bugs.chromium.org/u/1279493906/
The one who didn't expect it to miss the deadline is the same as the person who originally reported the vulnerability. It is therefore a safe assumption that this person understands the disclosure process involved.
Furthermore it is a safe bet that the bug is exploitable. I'm sure that the black market will shortly have people using it.
Meaningless distinction, a human designed the bot that pulled the trigger. Building a robot that then murders someone doesn't absolve the designer from the ramifications of what they built.
The meaningful distinction is that a human can be persuaded to extend the deadline, at least in theory. A bot cannot be persuaded to do anything, and if a deadline passes an action is triggered like a dead man's switch. In one scenario, a human needs to maintain the decision to uphold that deadline without bias every single time it comes into question. In the other, they only have to do it once: when the bot is initially designed.
They're different things entirely. Arguing that they're not is like arguing that it's easy to maintain a diet or exercise regimen because you just have to uphold a New Year's resolution for a week. This has important ramifications for a security disclosure deadline, because it (theoretically) reduces bias. There are other elements of a disclosure that can still elicit bias, but at least the deadline time itself will not be one of them.
From headline reading "X goes public with...", most people would infer a scenario where something out of the ordinary is taking place. Pointing out that this disclosure was made by a bot is a meaningful distinction.
And a human designed the insecure code on IE. That programmer isn't "absolved of the ramifications" of exposing their user base to god-knows-what kind of malware/ransomware.
This process and the costly signal associated ensures better behaviour from vendors in the long run.
Not meaningless at all. A better analogy is that you built a robot that pointed a gun at a chair, and said, "this robot will pull the trigger on date X, so don't sit in that chair on date X."
It's not trivial to argue that the robot designer shares the lion's share of the blame here.
What's up with them not being able to patch on time? How is 90 days not enough to get a patch out the door? That's a quarter, for goodness' sake!
But I hope Microsoft can prove me wrong and explain in detail next month why it couldn't deliver any of the 20-30+ bug patches because of a couple of other unrelated and broken patches.
Edit: This is sarcasm but the bank story is true.
Keep in mind that the Google docs/drive/whatever suite is the competitor for Microsofts Office 365 product.
Has Google ever released info about an unpatched critical bug on their own systems/applications?
> Has Google ever released info about an unpatched critical bug on their own systems/applications?
Are those critical? Not according to the text accompanying them, or am I missing something.
[1] Certainly not literally altruism. I suppose Google thinks this projects benefits everybody including themselves.
That's quite possible but once you start releasing unpatched vulnerabilities about competitor products there is at least a chance that 'including themselves' trumps 'everybody'.
It's not like we haven't been here before:
http://www.theverge.com/2016/10/31/13481502/windows-vulnerab...
So, google made a nice little 'hands-off' automatic disclosure feature which gives them a reason to say 'computer did it' but I don't think for an instant 'altruism' of any kind is the reason they do this.
If google really had the well-being of internet users at heart they'd shut down google analytics and stop accumulating profiles.
Until they do that my money is on Google estimating that they will do others more damage than they will do themselves through Project Zero and as such yes, we will all benefit but Google will benefit the most of all.
how would that "help" the well-being of internet users?
What's more, their analytics have nothing to do with the point at hand. Why even bring it up, except as an opportunity for a tangential soapbox? We're talking about disclosure timelines.
So if Google wanted to attack MS on the subject of privacy they'd have to go all the way to Skype to get some traction. So instead they attack on a front where Google is strong and Microsoft slightly weaker.
Google is anything but altruistic, their each and every move is to improve the bottom line for Google and their shareholders. If something is really altruistic it likely falls in their PR budget.
It seems pretty unreasonable to fault Google if the answer is "No, because they patch critical bugs in a timely manner."
There is so much missing in terms of transparency here. For instance: was there positive confirmation the message was received by the right people at the vendor? Was there any attempt at communication as the expiry date drew close?
Of course the onus is technically on Microsoft but Google has been at this before and it did not look clean to me at the time.
I can't believe I'm defending MS here.
I'm all for competitors keeping each other sharp but it helps to keep in mind they're competitors first.
One possible way around this is to set up something like project 0 independent of Google, Microsoft and so on and have all of them commit to contributing funding to keep it alive.
The answer is: Yes, thev're had critical Android bugs pass the deadline. And what I wrote 88 days ago still holds - still can't see what the actual android bug says, which is annoying.
(FD: Google pays me a day per week, but they don't pay me to spout of on HN in the evenings; this is all my opinionated opinion. :-)
1. Reliable exploitation might be difficult in such a way that the P0 people know how to get an exploit working, but Microsoft doesn't, and so it got deprioritized. A related (less likely) possibility is that the bug simply isn't easily exploitable in the configuration Microsoft ships, or expects to be shipping, these browsers in, due to environment differences in Google's testing lab.
2. Patching the bug might be more difficult than P0 anticipated (it might break compat, for instance).
3. The bug may be part of a pattern which is apparent to Microsoft but not to P0, so they may be holding off to get everything patched all at once rather than release an incremental patch that tips attackers off to a bunch more vulnerabilities.
Communication between P0 and other vendors isn't always great. (I think this is the fault of other vendors, by the way, and not P0).
That's in total contrast to web development where you can deploy a fix in ~ 1 hour to all your users simultaneously.
Hasn't stopped Microsoft pushing bad updates in the past.
> then wait some more because people ain't updating that often.
That's a problem with their update model, security waits for nobody.
It's a false dichotomy to suggest that MS's only options were an actual fix vs. do nothing. There are always other options.
Why does IE have a problem with this whereas other popular browsers do not?
On balance, Project Zero believes that disclosure deadlines are currently the optimal approach for user security - it allows software vendors a fair and reasonable length of time to exercise their vulnerability management process, while also respecting the rights of users to learn and understand the risks they face. By removing the ability of a vendor to withhold the details of security issues indefinitely, we give users the opportunity to react to vulnerabilities in a timely manner, and to exercise their power as a customer to request an expedited vendor response."
From https://www.engadget.com/2015/01/02/google-posts-unpatched-m...
You mean, like when they disclosed the cloudflare vulnerability after about a week and then the web turned into a race to whomever could find older-than-a-week cache with valuable information.
The vast majority of the people scrambling to find an older cache were the owners of those caches, who really didn't want to own data they shouldn't have been sent in the first place.
I see nothing close to Google trying to get MS. Instead it is what should be done.
Mow me with things like Scrougle and MS replaced YouTube as with their own i probably would not be so nice.
Look at Amazon will not allow Chromecast to be sold on their site. Personally i would have removed Amazon from their search engine but not Google.
Look at Uber. If i was Google i would use my power to destroy but not Google.
Feel how ever you want about Google but let's at least be fair.
NSA guy #2: "Sure, let's release our Google zero day!"
#1: "Oh, but didn't we spend millions on that?"
#2: "Yeah, but it'll really screw up Google!"
#1: "Okay, do it."
Google: "Oh my, thanks for pointing out that exploit. We're so glad the NSA is getting back to its mandate to alert American companies and organizations when it had identified security holes. And....fixed. Let us know if you find any more!"
I'm with GP on that we need more programs like project zero.
Please get angry and do it Microsoft! Show Google how it's done.
Disclosure: work at Google, but very far away from security.
If all the companies would to that it would be good for security
So I guess Microsoft missed both of those deadlines.
No. It was 90 days from the time the bug was filed to the time it automatically disclosed. There was no additional 14-day period (for whatever reason).
So, a deadline miss is often really a 104 (!!) day deadline miss. As an industry that's trying to refocus on security, surely we can do better than that.
This still leaves 60 days for fixing the actual bug. It really seems ample time.
Is this a common pattern in the bugs world ? publicizing a critical bug after 90 days of no response ?
I wasn't sure if I missed a sign of notification, or if vendors are automatically cc'd/whitelisted on restricted bugs for their products.
https://www.avecto.com/news-and-events/news/94-of-critical-m...
Umm, not that great. Whatever security features they are adding to Windows 10, they seem to be overshadowed by all the other crap they're putting in Windows 10.
It would make sense that more are found in W10 (which was 5-17mos in 2016) than W8 (which was 40-52mos in 2016), because of their relative time on the market.
To answer the question, we'd have to look at W10 at this point in its life-cycle compared to W8 at a similar point (and control for things like more active vuln researchers).
if your OS needs a ton of cruft bolted onto it to make it useful, and that cruft has security issues then compare that to an OS that doesn't need that cruft, or has a more security software ecosystem. for example, adobe reader vs macos preview.
ecosystem is hard to change, and not entirely the fault of the owners/developers/etc of the software, but it's still important
You should be wary of anyone who casually tells you that Microsoft is bad at security. There are things Microsoft might not be great at, but it's complicated.
This is an interesting claim; most of what I (and probably most people) think about Microsoft software security is informed by its earlier history, where it was doing pretty badly overall. What has Microsoft been up to lately that's impressed you with their security architecture/design?
For something like 10 years, Microsoft's been punching their weight with secure runtimes in particular, especially given the handicap they work with due to compatibility requirements. They're not perfect. But nobody is.
Here's a good recent example:
https://medium.com/@justin.schuh/securing-browsers-through-i...
I believe those projects switched to using this instance of the Monorail bug tracker since Google Code shut down.
But it's quite likely they all had their bug trackers on Google Code.
This really isn't a useful headline. It provides no information about the actual relevant event of Google releasing the bug. It just seems like any mundane bug report.
Editorializing titles is against HN guidelines.
That's why I said "conform more".