Forgot your password?
typodupeerror
Google Microsoft Security Technology

MS Asks Google To Delay Fuzzer Tool 205

Posted by CmdrTaco
from the i-need-somebody dept.
eldavojohn writes "Polish Google security white hat Michal Zalewski has announced concerns that one of a hundred vulnerabilities his fuzzer tool found in IE is well known to third party hackers in China. His simple explanation provides an interesting counter argument to Microsoft's usual request that security problems not be released until they can slowly investigate them. From the article, 'Microsoft asked Zalewski to delay cross_fuzz's release, but he declined, in part because of his fear the IE vulnerability was already being explored by Chinese hackers, but also because the company's security experts had not responded to information he provided.' You can read about and download cross_fuzz for your own use."
This discussion has been archived. No new comments can be posted.

MS Asks Google To Delay Fuzzer Tool

Comments Filter:
  • by Anonymous Coward on Monday January 03, 2011 @11:05AM (#34744184)

    Microsoft is the last among browser makers to react to the vulnerability. Everybody else has released patches to address some, if not all of the holes.

    Seems the IE team is so small, they can only do is development on IE9; perhaps there is no other team. Maybe they're all working to make the latest Windows Mobile platform a rousing success.

    Its a much slower, conservative company now that Bill Gates has left. And I don't mean that in a good way.

    • Re: (Score:3, Interesting)

      by hedwards (940851)
      Probably the only way that this will change is if the laws are changed to make them liable for their own incompetence. As it is software developers can release software without the ability to return it for a refund or any particular guarantee that it does what they claim it to do. Meaning that you could very well end up in the situation where you've paid for software that's badly broken and they're not liable, going to give you a refund or fix it.
      • by Ustice (788261) on Monday January 03, 2011 @11:45AM (#34744634) Homepage
        Be careful what you wish for. We are more likely to end up with well-meaning legislation that does the opposite, where it punishes those that publish security holes as helping criminals.
      • by Anonymous Coward on Monday January 03, 2011 @11:50AM (#34744700)

        They'd only start slapping a Beta tag on everything like Google does. That would buy them a few years of delays. Then they'd lobby to get the law modified so their liability was limited to the price of the software. Then they'd say the kernel is what costs and the rest is free bundled stuff. At every stage they'll lobby and start lawsuits to delay things. Eventually its 15 years later and you've got some silly obscure law that protects nobody unless they've got the money to fight a massive software company (something the US DoJ doesn't have).

        • by sjames (1099)

          Far worse, the big proprietary players would do that but the small shops and free software would all fold up or leave the U.S. because they couldn't afford the legal fees.

      • by mini me (132455)

        That would only serve to drive the cost of software up. Is it not best to allow the free market to work? Those who want the guarantees can pay for it, while those who are willing to take the risk can use the software for less, perhaps even free.

        I am certain that if you passed the appropriate amount of money in Microsoft's direction, they would be more than happy to accept liability for IE. Personally, I do not want to pay for that level of service.

        • by LingNoi (1066278)

          How could anyone whine about the cost of software going up. Right now it's at rock bottom to purchase consumer software, more expensive software across the board would be a good thing assuming the money goes to the right people (haha).

          • by mini me (132455)

            The added costs would go to people like insurance companies who would assume more risk on behalf of the vendor for errors in the software. A lot of open source software projects would come to an end, because who wants to be liable for errors in the work they provide for free? Let the market decide. If liability is important, people will pay for it.

          • Um, what? It's hard to estimate profit margins, but Daniel Eran Dilger [roughlydrafted.com] estimates that Microsoft has a 66% profit margin on Office and 81% on Windows. That's far beyond typical profit margins, so such prices are not "rock bottom".
        • by mcgrew (92797) *

          Get real, Microsoft's software is WAY overpriced. ALL of it is way overpriced; at least, for an average Joe buying the software outright at a computer store.

          I paid over a hundred bucks for XP, upgrading from 98. I really felt ripped off. Not only did a lot of my old software no longer run, Microsoft "disabled" the app that came with my CD burner, saying it was "unstable". I'd had no stability problems with 98. What was worse, every morning when it booted it informed me that it had disabled this software, wh

          • by mini me (132455)

            Accepting a refund is different than assuming liability for a mistake in the product. I am not against refunds on software. Though I do realize it is a difficult problem to solve in the world of piracy.

          • If I buy a toaster and it won't make toast, I can get a refund. Why can't I get a refund for shoddy software?

            Because you bought the software in the full knowledge that it was shoddy and sold "as is, no returns, no guarantee".

            • by mcgrew (92797) *

              Because you bought the software in the full knowledge that it was shoddy and sold "as is, no returns, no guarantee".

              Why didn't it say that on the box? You don't see "no returns, no gurantee" until you've paid for the POS and seen the EULA.

              They have "lemon laws" [carlemon.com] for cars, why can't we have laws like that for software?

              If I sell you a bucket of paint, but the bucket is empty, that's fraud.

          • Re: (Score:3, Interesting)

            by msauve (701917)
            The market disagrees with you, as customers continue to purchase, and MS continues to profit from, their software offerings. Pricing is only relative to the market. From a purely economic perspective, it might be overpriced if by reducing the price they get greater profits from an increase in sales. But, I suspect that MS is pretty sharp about finding the price points which maximize profit.

            "I paid over a hundred bucks for XP"

            In fact, you disagree with yourself, unless you're claiming that MS somehow force
            • by devent (1627873)

              Because there is no market. The customers don't have any choice. Where ever you go you will get Microsoft Windows and your "market" will drop support if you use anything else then Microsoft Windows. Many OEMs are going so far that they even will drop the warranty if you dare to install something else on your computer then Windows.

              The government, the schools, the employers support this monopoly. Because they are all dependent on Microsoft Windows. The government and the schools failed to implement open stand

              • by msauve (701917)
                "You cannot get a computer without Windows in the first place."

                www.apple.com HTH! HAND!

                "Plus you need Microsoft Word and Excel to get your work done or to communicate with the government. Plus you need Windows to play the games out there. You even need Windows to pay your taxes."

                You're fabricating things. My in-laws do all those things, and don't even have a computer.
            • by mcgrew (92797) *

              No, I had no choice, thanks to the Sony rootkit my daughter installed. It completely trashed Win 98, and I had lost the reg # for it.

              I specifically bought it to run the Windows programs I already had. Had I known that Windows wouldn't run Windows programs, I'd have just wiprd the drive and installed Linux, rather than running it dual-boot.

              • by msauve (701917)
                You lost/broke something, and chose to replace it. You're confusing "want" and "need."
        • by devent (1627873)

          What free market? You mean the market where I can go to Mediamarkt and get 99% of the computer, laptop with Windows 7? Or the free market in Saturn where 99% of the computer and laptop are with Windows 7? Or the free market at best buy where 99% of the computer and laptop are with Windows 7? Or maybe the free market with Dell, Hp, Samsung, Lenovo?

          To what market I go if I don't wish to buy a computer or laptop with a more secure system?

          A free market can only work if there are many vendors, which are competin

        • by Kijori (897770)

          Surely the GP's proposal would, at least on one understanding, be beneficial to the functioning of the market?

          There are, to my mind, two constructions of what the GP said. The first is the narrow suggestion that customers should be eligible for a refund if software doesn't match the designers claims. Given that the existence of a free market relies on the dissemination of accurate information, preventing the creator of software from making exaggerated claims to sell their product would seem entirely consist

      • by digitig (1056110)
        Yes, and they can afford to pay, whereas most of the FOSS community would have to walk away because they just wouldn't be able to afford the risk. "Refund" is ok, "liable" is a problem.
        • by Sancho (17056) *

          How about only having liability on code which cannot be inspected? Though the lobbys would never allow that to pass.

    • by _Sprocket_ (42527) on Monday January 03, 2011 @11:40AM (#34744600)

      Its a much slower, conservative company now that Bill Gates has left. And I don't mean that in a good way.

      There was a point in time (not too long ago by normal standards - ancient history "Internet time") when Microsoft was very slow to respond to any security issue. That was very much in the Bill Gates era. The concept of full disclosure comes from that time. The subject of disclosure has been beat to death around here more than once so we'll avoid going down that path. However, some of the intents of the "full disclosure" concept is to shame the vendor and warn the user. Even "responsible disclosure" rules tend to have some breaking point where the bug gets exposed without vendor consent.

      This is less of a turning point than a reminder of where we've been before.

    • by Low Ranked Craig (1327799) on Monday January 03, 2011 @12:11PM (#34744898)

      Ballmer has a hard-on for Apple and Google. Instead of focusing on their core business which is providing servers and office automation to businesses they are chasing Apple and google with WP7, chasing the iPad, the iPod, Google search, and the Sony playstation. Arguably they've been successful at the latter, the others not at all.

      Look at WP7 vs Windows Mobile 6.5. WM6x is in dire need of an overhaul. WP7 cannot replace it in a business environment at this point. We use windows mobile powered devices for out warehouse management apps. The replacement for ActiveSync, Windows Mobile Device Center, is worse than AcviecSync (if you can believe that) and is more consumer focused than business focused. WP7 is not designed for business apps - there is a huge opportunity for Google to invade the embedded business app space.

      Ballmer needs to cease his juvenile, masturbation fantasies of crushing Jobs and Schmidt and get back to focusing on their core business.

    • by Gadget_Guy (627405) * on Monday January 03, 2011 @12:14PM (#34744930)

      According to the timeline [coredump.cx], Microsoft too has also released patches for some but not all the bugs. This final delay appears to be because they had problems reproducing the crashes, which I think is probably due to the nature of this tool which makes reproducing the exact circumstances difficult. I can sympathise because I have had to find hard to reproduce bugs is the past.

      Still I think that is correct that it should be all made public now, considering that the bad guys have already got the code.

    • Microsoft's edge has always been their ability to buy companies' products (and companies themselves) and sell them at profit and the locked-in nature of their clients. They are a business company that deals in technology rather then a technology company doing business.
      There are exceptions, like their entry into the gaming arena, but don't forget their primary nature.
  • When (Score:3, Funny)

    by Anonymous Coward on Monday January 03, 2011 @11:06AM (#34744202)
    When is someone going to DO something about the possibly government sponsored hacking taking place in China? It ought to be brought up at the UN, or trade meetings, or SOMETHING! If the Chinese government won't stop it, we need to cut them off.
    • by NevarMore (248971)

      Yes, lets have the UN send one of its famous "Stern Letters Of Warning" to China that they've been very naughty and shouldn't do what every other nation or its citizens doesn't already do.

    • China has a permanent seat on the UN security council.

      That being said, they have the ability to veto any substantive resolution designed to address their intrusion into Google's computer systems.

  • by flyingfsck (986395) on Monday January 03, 2011 @11:08AM (#34744232)
    MS believes in security through ignorance, since it makes them money. As long as the common users don't know that their machines are infiltrated, stealing their bank information and sending spam, they are happy, since at worst, they will think their machine is worn out and slow and then go out and buy a new one, chock full of new versions of MS software.
    • by mcgrew (92797) * on Monday January 03, 2011 @11:23AM (#34744382) Homepage Journal

      From the co,puterworld link:

      "I have a conference call with MSRC [Microsoft Security Response Center]," Zalewski said in the timeline's note for Dec. 28. "The team expresses concern over PR impact, suggests that the changes made to my fuzzer code between July and December might have uncovered additional issues, which would explain why they were unable to reproduce them earlier."

      MS, if you want better PR, stop worrying about PR and start worrying about code quality. For what your software costs, its performance is abysmal. You have Yugo software with a Lexus price.

    • by v1 (525388)

      I think I'd call it more "security by bliss" (from 'ignorance is bliss") Really they're not so much taking advantage of users' ignorance, but rather that they don't care. As long as their computer is functional, most users don't care if their machine is participating in a botnet and DDoS'ing or spamming.

      • by bluefoxlucid (723572) on Monday January 03, 2011 @11:52AM (#34744716) Journal

        Right, which is why most users are overly concerned about "credit card theft" when most infections are about spamming the shit out of people; and a large number of people who succumb to identity theft are actually taken by malware that installs itself as an "anti-virus" program but secretly records your bank transactions.

        It's like walking through Baltimore City alone at night. As much as people are terrified by it, not everyone is out to kill you; that said, if you walk through Baltimore City alone at night regularly, you'll meet someone who is out to kill you. Paranoia is when you think they're all out to get you; rational sense is when you realize, no, they're not, but there's a significant risk of encountering someone eventually and it only takes one knife to stop your heart.

    • by icebike (68054)

      That seems a bit over the top, even for the anti microsoft crowd here on Slashdot.

      Microsoft doesn't sell computers, and they make very little on OEM versions of Windows installed in the factory.

  • by Anonymous Coward on Monday January 03, 2011 @11:11AM (#34744272)

    Last year I attended a conference where one of the talks was about browser security. The speaker demonstrated how easy it was to gain access to someone's PC when the machine was being specifically targeted. Some of the things he did:

    1) Set up a rogue access point with open access and SSID name similar to the venue..

    2) Set up a rogue DNS.

    3) Set up a redirect page that installed demo software...

    One of the things he mentioned was that if you are being targeted specifically, your system will likely be compromised. If you are not targeted specifically, it's trivially easy to find machines that can automatically be compromised.

    Adding any apps increasing your exposure.

    The number of unpatched vulnerabilities is staggering and it's only a numbers game when a slew of machines are needed.

    • But that assumes you're being targeted specifically and maliciously by a skilled attacker. Unless you have a high-profile job, that defies common sense. And assuming a skilled attacker, there's really nothing you can do about it except minimizing the attack surface and just plain keeping stuff off your computer. A simple encrypted VPN connection routing all your traffic will effectively stop all local wireless attacks, reducing the attack surface to the wireless drivers, kernel packet processing and the VPN
      • Well, if you're in Panera Bread or Barnes & Noble, you're probably being targeted "specifically" ... for some value of "specific" amounting to "the 5 people in that store dumb enough to use Wifi."
        • It just makes no sense to me. Sitting with a laptop computer at a public access point and targeting people to spoof/sniff credit card information and credentials seems to have such low throughput to effort when botting at this point in time is almost simpler to execute (like firing an automatic shotgun). The people hanging out at the botting forums I've seen seem like ordinary criminals for the most part, and the barrier to entry nonexistant. Why use a low-risk low-pay method when you could use the no-risk
          • by bluefoxlucid (723572) on Monday January 03, 2011 @12:20PM (#34745000) Journal

            Sitting in a Starbucks is a low-risk method because it's hard to trace. Hell, you can load automated software onto a hand-held PDA (iPaq? I ran Linux on one...) to do all the raping and infecting. The packets can be tagged with a different MAC address than your real device, making it physically untraceable; it's all in your pocket, and can auto-connect to wifi and do whatever, so picking you out of a crowd is harder than "find the suspicious person" since you just carry it around and don't go out sniping.

            This works for MP3s and child porn and whatever the hell else too, btw. Assuming you know where and what to search (I assume torrents for MP3s, who knows for kiddy porn), you could have an automated program do all the relevant searches and store the results. When you get home, pop the device out and browse through the cached results... pick what you want, and next time you're out it'll find those things and download them.

            For the obvious flaw, you can ban your own Wifi network and your neighbors', or have the program automatically search for certain networks (yours, your neighbors', etc) and decide you're "too close to home" and shut down. You could even have a separate daemon that handles wifi, and when it sees you're "too close to home" it prevents any wifi connections at all.

            There's a lot of "I can have this here with me, but never physically do anything while connected to the network, and never use my own network" that can be done to hide your online presence. The same can be done for chatting on forums, sending e-mail, etc. The only thing you can't hide that way is real-time chat like instant messaging or IRC, because you have to twiddle the device; but for answering a forums post or blogs, you can have a program smart enough to deal with phpBB and V-Bulletin and Wordpress... it could let you record what you want to post, who to reply to, which post ID to reply to, the works... then when you're out somewhere, post.

            Basically you're interacting from an alternate reality, one where you're pulled out of the real world; that interaction is transferred into the real world physically somewhere, but you're not present at that point and there's no cable running from there to here to draw a path to you. You'd have to use an innocuous device (a PDA most likely, bought in cash) and download the software from a MAC-shifted device on a public link to have absolutely zero trail (i.e. no evidence that you're even capable of this), but it'd be doable. Completely. It'd make for some interesting shit... maybe I'll write a sci-fi novella about the idea.

            • There's the latency, though. I can think of two other "bullet-proof" solutions: no-strings-attached satellite signal (you can only track so far as the uplink satellite's "footprint" as far as I'm aware), and simply tunneling the connection through two different botnet nodes in different jurisdictions, making sure not to transmit presonally identifiable data through the endpoint. If you obfuscate the data in time and shape, you could even pass a connection through the same "listening post" twice, allowing yo
              • Enough forensics will trace the connection back to where it came from, i.e. starbucks. Satellite... good luck getting free satellite, and they can ID the device somehow if you have a log-on (z3r0c00l did this...). I'm talking about something that traces back to a pinhole in reality and then vanishes. Oh shit, the attack came from nowhere; a wizard did it.
                • Actually, post-attack forensics would not be able to get anything useful out of botnet proxies even assuming black helicopters descending on them minutes after the fact. As long as it stays up, a node can be infected and malware injected and updated without ever touching disk, using multi-stage shellcode utilizing dll injection. The largest threat would be the botnet nodes being compromized during or before the attack. Now, if your criteria is that not only the attacker but also the *method used* being unkn
                  • Yes, my criteria is that a spook at every position along the wire physically cannot figure out who the hell you are, even if one is standing right next to you going, "Someone within range of the access point up there on that shelf is doing this... someone within a block and a half radius, in one of these 10 story buildings. Someone in that McDonalds, or that Panera, or up there on the second floor of Barnes & Noble, or in that Best Buy across the street, or one of the 2500 people in that office buildin
                    • You can still compromize your position through tracking where and when the device switches AP. And don't forget, if the signal is identifiable up to your "device" (public routers don't use encryption, so the data from the wireless router and your device can be easily correlated) the transmission can be triangulated, though I don't know with what precision. I don't think this method provides much additional security over just using a notebook, especially since by using a notebook you could excise control ove
                  • by nschubach (922175)

                    You mean the "Internet" doesn't cache all communication so that they can be pulled up easily by dumping the cache on someone's webcam to get the feed sent 3 weeks ago like they say on NCIS?

                    (Sorry, I always have a laugh when they start doing that...)

  • by should_be_linear (779431) on Monday January 03, 2011 @11:24AM (#34744388)
    "We consider all Mr. Zalewski claims invalid. Obviously he didn't contact Security Experts for IE in reality just like you cannot contact Santa".
  • Didn't work for me until I turned off the 'block pop-up windows' in Tools-Options-Content.

    So I'll keep that window pop-up blocker turned on I guess.

  • The summary made it sound like IE had 100 vulnerabilities, while the article stated that there was 100 vulnerabilities between 5 browsers ...
  • by lseltzer (311306) on Monday January 03, 2011 @11:33AM (#34744520)
    First, this article is basically a dupe of one from a couple days ago [slashdot.org]. Second, Zalewski was working on his own and MS asked him, in his personal capacity, not to release the tool. I had all this in my PCMag article referenced in the previous /.
  • Is that the guy that wrote "Silence on the Wire"? That was a good book of not-likely attacks that are completely and utterly practical, at least in a lab environment consisting of "my living room and $10 of shit I bought off Mouser." Reading the blinking lights off modems, for example.
  • Polish Google security white hat Michal Zalewski

    -What's your name?
    -Zalewski
    -Zalewski? Is that Polish?
    -Yes.
    -Are you trying to do some Polish humor?
    -That's..
    -SHUT UP!
    -That's just my name..
    -SHUT UP! I don't appreciate racial slurs! I think them dumb Pollacks have been ridiculed enough!

  • Once again, it's clear that fuzzing is really useful for testing security. Not that it's a be-all/end-all, but people developing secure software should be using fuzzers. It's unfortunate that this fuzzer's "design can make it unexpectedly difficult to get clean, deterministic repro"; without deterministic repros, it's often really hard to find and fix the problem.

"Out of register space (ugh)" -- vi

Working...