Google Discloses Exploited Windows Vulnerability 10 Days After Telling Microsoft (venturebeat.com) 101
An anonymous reader writes: Google today shared details about a security flaw in Windows, just 10 days after disclosing it to Microsoft on October 21. To make matters worse, Google says it is aware that this critical Windows vulnerability is being actively exploited in the wild. That means attackers have already written code for this specific security hole and are using it to break into Windows systems.In a blog post, security researchers at Google write, "The Windows vulnerability is a local privilege escalation in the Windows kernel that can be used as a security sandbox escape. It can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD. Chrome's sandbox blocks win32k.sys system calls using the Win32k lockdown mitigation on Windows 10, which prevents exploitation of this sandbox escape vulnerability."
So Windows 10 is not affected? (Score:2)
Re: (Score:2)
looks like all and chrome mitigates it in win10 (from how i read it)
Comment removed (Score:4, Interesting)
Re:Neel Mehta is a real crumbum (Score:5, Insightful)
What in that behavior do you find unethical?
Re:Neel Mehta is a real crumbum (Score:5, Interesting)
Re: (Score:1)
Re: (Score:3)
In most companies it's the opposite: the "rush to market" is so important that security can "wait until later."
Re: (Score:1)
Even if the software developer took every precaution and followed current methodologies to prevent vulnerabilities in their software, there is still a chance that a vulnerability exists.
My point is that when disclosing, you should take into consideration whether the software developers were following best practices or not. 99% of the time, the answer is: not.
Re: (Score:2)
Remember there are companies who store passwords in plaintext. That is not only idiotic, anyone with half a brain knows not to do that.
My mind always boggles when I click a recover password link, and get my old password emailed to me in plain-text.
Re:Neel Mehta is a real crumbum (Score:4, Informative)
If you disagree, and you're a programmer, then answer this: do your managers give you extra time on your tasks to make sure your code is secure? Have they ever encouraged you to care about security, or is it the opposite? Do the encourage you to treat user-input carefully, and as a potential exploit?
Yes, yes and yes.
Further, there are explicit security review processes at the concept, design and implementation stages (there are also privacy reviews which have a similar structure but a different focus). There are mandatory internal training courses that all developers must attend which train developers about user input validation as well as considerably more sophisticated security issues. There are teams whose entire focus is security, to build secure infrastructural components which make it difficult for the general developer population to build insecure software. There are other teams whose whole job is to find vulnerabilities. There are large systems that do nothing but automated fuzz testing of our products. Third party penetration testing teams are regularly hired to attempt to find vulnerabilities, and those teams are given the wholehearted support of the development teams, and full access to all relevant information. External researchers are paid hefty bug bounties for reports of vulnerabilities in our products. Discovery of security vulnerabilities provokes a post-mortem process to analyze how the vulnerability was created and to identify what changes to tooling, processes or training could have prevented the vulnerability from being created.
And you know what? There are still security bugs.
Yes, software companies should make a serious attempt to write secure code. No, it is not reasonable to expect that they'll succeed, not in the general case, not without increasing the cost of software by two or three orders of magnitude. Reasonable effort in design and implementation, defense in depth, actively seeking vulnerabilities and aggressive patch deployment are the best we know how to do in the general case.
Different from the Kid Gloves They Used for Apple (Score:5, Insightful)
Re:Different from the Kid Gloves They Used for App (Score:4, Interesting)
Windows Market Share: 90%
Everything else: Math%
Google wants to put as much pressure on MS to get them to fix the problem as quickly as possible as this vulnerability affects the largest market share of Google's Product.
We all know all those windows users will blame Chrome for infecting their machine Because Reasons(TM) so let Google force MS into fixing this issue ASAP.
Apple's vulnerability? Who cares, it affects a microcosm of Google's user base.
Re:Different from the Kid Gloves They Used for App (Score:5, Insightful)
No, the difference is that the Windows exploit is being actively used in the wild by malware. It's better to know about it so we can mitigate the risk as much as possible.
In Apple's case no-one was taking advantage of the flaw, as far as we know, so it was better to keep it quiet while they fixed it.
Exploits in the wild (Score:3)
The goal of keeping mum on security vulnerability until the vendor fixes it is to prevent potential attackers from learning about the vulnerability. The discoverer decides that users of the software are better off not knowing about the problem because they'd rather attackers don't know either.
Here, according to TFA, there are already exploits in the wild. In that situation MS users are already at risk; Google keeping mum can only hurt them (by keeping them ignorant of the vulnerability) but won't help (be
Re: (Score:2)
Re: (Score:2)
Technically speaking also there is the problem of criminal negligence and the culpability that arises from that ie you knew about the fault, you did not tell me and I suffered as a result, that fault now lies with those who kept the risk secret from me. Now that really brushes up super close to wilful culpable criminal negligence. Face the reality, software programmers have got away with a shit bucket ton of stuff they should never have got away with and the law is catching up to them.
Re: (Score:1)
Apple Market Share: 3-5% Windows Market Share: 90% Everything else: Math%
Not in phones, tablets, servers, supercomputers, etc.
Re: (Score:2)
Probably because it's exploited.
If it wasn't exploited, Microsoft has a full 90 days. As it is exploited, well, telling doesn't really hurt anyone - they gave Microsoft a heads up and well, telling people about it doesn't really hurt anyone.
The Apple one probably wasn't exploited so Google gave extra time knowing
Re: (Score:2)
Security is a partnership... (Score:1)
Everyone has vulnerabilities, because there are just too many inconceivable ways that protective measures might be bypassed. As such, teamwork between providers is the key; just because the other guy's platform is doesn't mean yours can't also be sunk, especially in this interconnected world of botnets.
If this vulnerability wasn't part of the fixes in last patch Tuesday Google - OR anyone - should keep their mouths shut until the provider has had a chance to patch it, and patch it right. There's nothing wor
Re: (Score:2)
It's been 18 years and still nothing. Maybe it's because Google doesn't use Windows? So it looks like you'll be waiting for a very long time.
I remember reading... some time 8-10 years a go... that Google was desperately trying to get their employees off Windows. Something like 66% were using Windows XP internally on their desktops.
Re: (Score:2)
Re: (Score:2)
They should keep their mouth shut or else what? The bad guys will start exploiting it?
Read the summary. The bad guys are already exploiting it.
Shachar
What In The Fuck????? (Score:1, Flamebait)
"The Windows vulnerability is a local privilege escalation in the Windows kernel that can be used as a security sandbox escape. It can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD. Chrome's sandbox blocks win32k.sys system calls using the Win32k lockdown mitigation on Windows 10, which prevents exploitation of this sandbox escape vulnerability."
How in the hell does anyone find this shit to start with? Where does one begin when trying to find bugs and vulnerabilities? Do these folks spend day in and day out sitting on a shitbucket, eating Cheetos and Monster and have absolutely no freakin' life???? SMH....
Oh well, keeps me busy in my line of work...
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
First it starts with having an understanding of what's going on. Then it continues with realizing that an assumption isn't necessarily true, and finishes with finding a means to force that assumption to be invalid.
One of my favorite exploits is a privilege-escalation issue on very old Linux systems. In short, you run a program that crashes and drops raw memory into cron's job folder, and when cron looks at the dump, it sees something that looks like a job spec, so cron happily runs whatever was in that memo
Re: (Score:2)
Back in the mid 80s, I did some work at JPL with the late Dan Alderson [wikipedia.org]. Generally speaking, an if/else if sequence ends without another if because all possible cases have been listed. Dan, however, would use a final if, specifying what should be the only possible situation, with an else aborting the program with the comment "1 = 2" to indicate an unexpected
Is the policy (Score:5, Insightful)
Vulns. already being exploited in the wild are published 7 days after reporting it to the vendor. This is nothing new and is Google's policy on this (dated 2013).
See: https://security.googleblog.com/2013/05/disclosure-timeline-for-vulnerabilities.html
Sleazy attempt to paint Google in a bad way. This flaw is already being exploited, the bad guys already know about it!
Re: (Score:1)
Which thank goodness only means someone has to be ignorant enough to download & execute a malware for it to work
... proceeds to link to some EXE file ...
Re: (Score:2, Funny)
Yes, because if not for Google, no one would ever have heard that Windows has vulnerabilities.
Microsoft's statement (Score:1)
The VentureBeat article has been updated with a response from Microsoft:
"We believe in coordinated vulnerability disclosure, and today's disclosure by Google puts customers at potential risk," a Microsoft spokesperson told VentureBeat. "Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible. We recommend customers use Windows 10 and the Microsoft Edge browser for the best protection."
What the hell are they smoking? Apple, the various Linux distributions, and the BSDs all are committed to "investigating reported security issues and proactively updating impacted devices as soon as possible." They all routinely release immediate updates for critical exploits. I think even Cisco's IOS has a better track record than Windows in time-to-fix for critical vulnerabilities.
Re:Microsoft's statement (Score:4, Insightful)
The VentureBeat article has been updated with a response from Microsoft:
"We believe in coordinated vulnerability disclosure, and today's disclosure by Google puts customers at potential risk," a Microsoft spokesperson told VentureBeat. "Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible. We recommend customers use Windows 10 and the Microsoft Edge browser for the best protection."
What the hell are they smoking? Apple, the various Linux distributions, and the BSDs all are committed to "investigating reported security issues and proactively updating impacted devices as soon as possible." They all routinely release immediate updates for critical exploits. I think even Cisco's IOS has a better track record than Windows in time-to-fix for critical vulnerabilities.
I might be wrong, but it seems like that's a crack at the security issues within Google's Android ecosystem...
MS isn't the one that let it get to a point where a bazillion hacked devices without updates are in the field a mere year or two after hardware was released.
XP had support for 10 years.
Re: (Score:2)
True. Very true. However, strictly speaking, only Apple and RHEL have customers.
Re: (Score:2)
OT: Which version of Firefox did you say was safe? Version 43? 44? or 45?
Thanks.
Re: (Score:1)
It's that or someone is "impersonating me" again (no 1st by any means, lol).
If only there were some way to "authenticate" a user on a forum website, so everybody could be sure that a particular person is posting...
APK
Re: (Score:1)
APK
P.S.=> lol
Re: (Score:2)
OK, thanks for the clarification. Must have been another AC. :-/
Zero day exploit (Score:3)
Once actively exploited, the proper response is to publicly announce the exploit. This is standard and acceptable practice. Someone is grinding an anti-google axe on this non-story.
exploit requires unpatched Flash (Score:2)
FTA: "A source close to the company also shared that the exploit Google describes requires the Adobe Flash vulnerability. Since Flash has been patched, the Windows vulnerability is mitigated."
How does that make matters worse? (Score:3)
How does that make matters worse? Exploit being used in the wild is the standard reason to expedite public disclosure. If the bad guys already know about the bug, there is no sense in keeping the legitimate users in the dark.
Shachar
what the... (Score:2)
this security issue is found, reported, confirmed to be exploited in the wild.
yet MS will release a patch next week...
no comments on this? i mean, that local exploit on linux (dirty cow) was patched in an instant and every major distro had the patch available within a day.