7 ms·

Windows 10 0day exploit goes wild, and so do Microsoft marketers

163 points by aao 10y ago

simion314 10y ago
Does anybody know how many days it would take from when a critical security bug is discovered in Windows and assuming that the fix is just a few lines of code and not a component rewrite and marketing is not in the way, I am wondering how many steps are from when a fix is created until is released.(I imagine that there may some QA and some managers that need to approve it but I have no idea)
- nitinreddy88 10y ago
  It depends. Some bugs can be fixed easily and some might be too complicate to fix even though it looks simple. Usually all critical bugs are attended as soon as they are created (few hours delay). But the actual fix depends on the bug and there is no general formula for that
  - test1235 10y ago
    >assuming that the fix is just a few lines of code
    - kybernetikos 10y ago
      Even assuming that, there could be a massive testing load to ensure that those few lines of code don't mess up something tangentially related, or cause new security issues of their own.
      - cmdrfred 10y ago
        Microsoft fired it's QA department so that doesn't seem to be a reasonable explanation either. http://www.computerworld.com/article/2878026/microsoft-to-business-dont-worry-about-windows-10-consumers-will-test-it.html http://www.computerworld.com/article/2878026/microsoft-to-bu...
      - simion314 10y ago
        Assuming you just need to add a check for null pointer and that this bug is very critical like hackers are exploiting it, assume engineers create a fix and are 100% it is safe, hopefully there was no other component that was depending on the broken code , how much it will take to fix it, maybe there is somewhere a history of critical bugs , with the date of when it was found and when it was fixed then we can find the time interval.
        city41 10y ago
        The Windows kernel is one of the most mission critical pieces of software in the world. And is easily the most important piece of IP for MS. I'd argue there's no such thing as a "simple fix". I have no doubt even the most trivial of changes has to be very thoroughly vetted.
        kybernetikos 10y ago
        I've worked on software where without fail every new release would go through more than a week of soak testing.
- pizza234 10y ago
  There is an interesting (and very amusing) article about the general concept: https://blogs.msdn.microsoft.com/ericlippert/2003/10/28/how-many-microsoft-employees-does-it-take-to-change-a-lightbulb it doesn't directly answer the question, but things are far more complicated than they look.
  - aaronbrethorst 10y ago
    URLs auto link as long as you don't indent them.
- becarefulyo 10y ago
  Disclosure: I work at MS but not on the kernel or anything related to this security bug. Opinions are my own. I've seen one-line bug fixes introduce many other bugs. Adding a null check is always suspicious. Is the system in an invalid state? Should it fail fast instead of swallowing the error? Maybe the code wasn't touched in several years. Maybe the person that wrote it no longer works there. Maybe the code in question doesn't have good test coverage or documentation. There are so many variables to consider when assessing risk of code changes.
  - tremon 10y ago
    Maybe the person that wrote it no longer works there. Maybe the code in question doesn't have good test coverage or documentation These are not valid excuses for a company the size of Microsoft.
    - Sunset 10y ago
      These are the kind of consideration only companies the size of Microsoft are likely to have.
      - Relys 10y ago
        Touché!
- EdHominem 10y ago
  They could have a solution out the door in less than 24h but it may be a mitigation (ie, disable the service) rather than a proper fix. But that's pretty easy. In fact, it's usually the first thing an engineer does when verifying a bug report - "Ok I've reproduced it, now let's shut off the service and make sure the problem goes away." Release a patch that disables the vulnerable service and give people a way to bypass that and turn it back on once they've taken proper internal measures. (Read the CVE, block ports, etc...)
pomfpomfpomf3 10y ago
tl;dr: a null deref in windows kernel when you connect to a malicious SMB share
- SlashmanX 10y ago
  That's not what this article is about though really
  - tokenizerrr 10y ago
    Sure, but the main question I had when reading the headline was if I should go into "Oh shit!" mode.
- slowmotiony 10y ago
  Thanks
- MohammadLee 10y ago
  tl;dr: a CVSS 7.8 Windows vulnerability in the SMB service can allow an attacker to DoS any machine with the filesharing service exposed; the possibility of RCE seems to have been discarded; exploits are freely available online. This article complains that Microsoft's communication is lacking details and transparency in times of war
- j_s 10y ago
  Yes, the vulnerability is client-side AFAIK. PoC GIF: https://twitter.com/vvalien1/status/826935182456418304 https://twitter.com/vvalien1/status/826935182456418304
nxc18 10y ago
He asked a PR person, probably one with little security background (how many security people do you know who went into PR?) gave the stock answer which does happen to actually be good security advice: run the latest supported version with patches. The reporter was just butthurt about not getting a scoop and decided to write an article complaining about PR practices in place of an actual story. Really like the click bait title though, it's a nice touch. /s
- mtgx 10y ago
  Truth be told, Microsoft has among the worst PR agencies/policies from the tech industry. Very bureaucratic, slow to get something out of them, and you usually end up with just canned answers and most questions dodged. It's hardly even worth the effort to contact Microsoft's PR about something. Unless you know a higher-up exec, like Mary Jo Foley or Paul Thurrott does, for instance, you're unlikely to get a real answer for a security question. For a journalist, writing what you think happened, and then waiting for Microsoft to react, contact you, and tell you what really happened is likely a much more effective strategy to get something out of Microsoft.
- aao 10y ago
  It's a rant about PR bullshit, specifically this: >Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible, EDIT and this >The time has come for Microsoft vulnerability disclosure communications to mute the marketers and let the security engineers do the talking instead. I found it funny to be honest
  - baldfat 10y ago
    I am still shocked that Windows was recoverable from the fiasco of XP security problems. They have gotten exponentially better in security over the years.
    - cptskippy 10y ago
      The NT Kernel is a very secure and resilient design, it was just mucked up over the years with Win32 blurring the lines between the kernel and userland. MinWin was an internal project that started in Windows 7 where the tendrils of things like Win32 were extricated from the kernel. In addition to improving security, this also enabled things like multi-platform support and headless servers.
ohitsdom 10y ago
The researcher disclosed the bug one week before Microsoft is scheduled to patch it. I'm sure MS isn't thrilled, but they did drag their feet: "I decided to release this bug one week before the patch is released, because it is not the first time Microsoft sits on my bugs. I'm doing free work here with them (I'm not paid in anyways for that) with the goal of helping their users. When they sit on a bug like this one, they're not helping their users but doing marketing damage control, and opportunistic patch release."
- cujo 10y ago
  The researcher sounds really petty. They're patching it, but not on this person's schedule so he's causing microsoft and USERS problems they didn't have before. If they weren't patching, I'd understand, but this isn't the right way to get attention in my book.
  - pdimitar 10y ago
    There are very competent people on this planet who make a very good buck out of zero-days (not to mention remotely control users' machines, and steal data). IMO the researcher didn't want that particular vulnerability to dwell on somebody's todo list for several years. It definitely puts pressure on MS but I don't think that's bad. Corporations have demonstrated time and again that the only way to get them to move is a PR hype. If they want researchers to stop doing preliminary public disclosures, they should prioritize security higher than PR damage control.
    - UnoriginalGuy 10y ago
      > IMO the researcher didn't want that particular vulnerability to dwell on somebody's todo list for several years. Except the researcher themselves knew it was one more week, and not "several years." You cannot claim they were ignorant if their own statements shows that they were not.
      - pdimitar 10y ago
user5994461 10y ago
> What is the threshold where you decide to release a bug description? Absolute minimum: 1 month after patch. Also: Leave 1 month, as an absolute minimum, to publish a patch. Why that? Because it takes time to track a bug and fix it and test the fix and ship it to 1 billion consumers in 150 countries and languages. Welcome to the world of real users where things take time to happen. Of course, one may think that he's an idealistic enthusiast pressuring the evil big companies when giving them less time. But nope, the only thing one may truly accomplish is being an unrealistic asshole putting millions of computers and people at risk. Think twice before you disclose. There will also be your mom's computer on the other end of that 0-day ;)

163 points by aao 10y ago

Does anybody know how many days it would take from when a critical security bug is discovered in Windows and assuming that the fix is just a few lines of code and not a component rewrite and marketing is not in the way, I am wondering how many steps are from when a fix is created until is released.(I imagine that there may some QA and some managers that need to approve it but I have no idea)

nitinreddy88 10y ago
It depends. Some bugs can be fixed easily and some might be too complicate to fix even though it looks simple. Usually all critical bugs are attended as soon as they are created (few hours delay). But the actual fix depends on the bug and there is no general formula for that
- test1235 10y ago
  >assuming that the fix is just a few lines of code
  - kybernetikos 10y ago
    Even assuming that, there could be a massive testing load to ensure that those few lines of code don't mess up something tangentially related, or cause new security issues of their own.
    - cmdrfred 10y ago
      Microsoft fired it's QA department so that doesn't seem to be a reasonable explanation either. http://www.computerworld.com/article/2878026/microsoft-to-business-dont-worry-about-windows-10-consumers-will-test-it.html http://www.computerworld.com/article/2878026/microsoft-to-bu...
    - simion314 10y ago
      Assuming you just need to add a check for null pointer and that this bug is very critical like hackers are exploiting it, assume engineers create a fix and are 100% it is safe, hopefully there was no other component that was depending on the broken code , how much it will take to fix it, maybe there is somewhere a history of critical bugs , with the date of when it was found and when it was fixed then we can find the time interval.
      - city41 10y ago
        The Windows kernel is one of the most mission critical pieces of software in the world. And is easily the most important piece of IP for MS. I'd argue there's no such thing as a "simple fix". I have no doubt even the most trivial of changes has to be very thoroughly vetted.
      - kybernetikos 10y ago
        I've worked on software where without fail every new release would go through more than a week of soak testing.
pizza234 10y ago
There is an interesting (and very amusing) article about the general concept: https://blogs.msdn.microsoft.com/ericlippert/2003/10/28/how-many-microsoft-employees-does-it-take-to-change-a-lightbulb it doesn't directly answer the question, but things are far more complicated than they look.
- aaronbrethorst 10y ago
  URLs auto link as long as you don't indent them.
becarefulyo 10y ago
Disclosure: I work at MS but not on the kernel or anything related to this security bug. Opinions are my own. I've seen one-line bug fixes introduce many other bugs. Adding a null check is always suspicious. Is the system in an invalid state? Should it fail fast instead of swallowing the error? Maybe the code wasn't touched in several years. Maybe the person that wrote it no longer works there. Maybe the code in question doesn't have good test coverage or documentation. There are so many variables to consider when assessing risk of code changes.
- tremon 10y ago
  Maybe the person that wrote it no longer works there. Maybe the code in question doesn't have good test coverage or documentation These are not valid excuses for a company the size of Microsoft.
  - Sunset 10y ago
    These are the kind of consideration only companies the size of Microsoft are likely to have.
    - Relys 10y ago
      Touché!
EdHominem 10y ago
They could have a solution out the door in less than 24h but it may be a mitigation (ie, disable the service) rather than a proper fix. But that's pretty easy. In fact, it's usually the first thing an engineer does when verifying a bug report - "Ok I've reproduced it, now let's shut off the service and make sure the problem goes away." Release a patch that disables the vulnerable service and give people a way to bypass that and turn it back on once they've taken proper internal measures. (Read the CVE, block ports, etc...)

pomfpomfpomf3 10y ago

tl;dr: a null deref in windows kernel when you connect to a malicious SMB share

SlashmanX 10y ago
That's not what this article is about though really
- tokenizerrr 10y ago
  Sure, but the main question I had when reading the headline was if I should go into "Oh shit!" mode.
slowmotiony 10y ago
Thanks
MohammadLee 10y ago
tl;dr: a CVSS 7.8 Windows vulnerability in the SMB service can allow an attacker to DoS any machine with the filesharing service exposed; the possibility of RCE seems to have been discarded; exploits are freely available online. This article complains that Microsoft's communication is lacking details and transparency in times of war
j_s 10y ago
Yes, the vulnerability is client-side AFAIK. PoC GIF: https://twitter.com/vvalien1/status/826935182456418304 https://twitter.com/vvalien1/status/826935182456418304

nxc18 10y ago

He asked a PR person, probably one with little security background (how many security people do you know who went into PR?) gave the stock answer which does happen to actually be good security advice: run the latest supported version with patches. The reporter was just butthurt about not getting a scoop and decided to write an article complaining about PR practices in place of an actual story. Really like the click bait title though, it's a nice touch. /s

mtgx 10y ago
Truth be told, Microsoft has among the worst PR agencies/policies from the tech industry. Very bureaucratic, slow to get something out of them, and you usually end up with just canned answers and most questions dodged. It's hardly even worth the effort to contact Microsoft's PR about something. Unless you know a higher-up exec, like Mary Jo Foley or Paul Thurrott does, for instance, you're unlikely to get a real answer for a security question. For a journalist, writing what you think happened, and then waiting for Microsoft to react, contact you, and tell you what really happened is likely a much more effective strategy to get something out of Microsoft.
aao 10y ago
It's a rant about PR bullshit, specifically this: >Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible, EDIT and this >The time has come for Microsoft vulnerability disclosure communications to mute the marketers and let the security engineers do the talking instead. I found it funny to be honest
- baldfat 10y ago
  I am still shocked that Windows was recoverable from the fiasco of XP security problems. They have gotten exponentially better in security over the years.
  - cptskippy 10y ago
    The NT Kernel is a very secure and resilient design, it was just mucked up over the years with Win32 blurring the lines between the kernel and userland. MinWin was an internal project that started in Windows 7 where the tendrils of things like Win32 were extricated from the kernel. In addition to improving security, this also enabled things like multi-platform support and headless servers.

ohitsdom 10y ago

The researcher disclosed the bug one week before Microsoft is scheduled to patch it. I'm sure MS isn't thrilled, but they did drag their feet: "I decided to release this bug one week before the patch is released, because it is not the first time Microsoft sits on my bugs. I'm doing free work here with them (I'm not paid in anyways for that) with the goal of helping their users. When they sit on a bug like this one, they're not helping their users but doing marketing damage control, and opportunistic patch release."

cujo 10y ago
The researcher sounds really petty. They're patching it, but not on this person's schedule so he's causing microsoft and USERS problems they didn't have before. If they weren't patching, I'd understand, but this isn't the right way to get attention in my book.
- pdimitar 10y ago
  There are very competent people on this planet who make a very good buck out of zero-days (not to mention remotely control users' machines, and steal data). IMO the researcher didn't want that particular vulnerability to dwell on somebody's todo list for several years. It definitely puts pressure on MS but I don't think that's bad. Corporations have demonstrated time and again that the only way to get them to move is a PR hype. If they want researchers to stop doing preliminary public disclosures, they should prioritize security higher than PR damage control.
  - UnoriginalGuy 10y ago
    > IMO the researcher didn't want that particular vulnerability to dwell on somebody's todo list for several years. Except the researcher themselves knew it was one more week, and not "several years." You cannot claim they were ignorant if their own statements shows that they were not.
    - pdimitar 10y ago

user5994461 10y ago

> What is the threshold where you decide to release a bug description? Absolute minimum: 1 month after patch. Also: Leave 1 month, as an absolute minimum, to publish a patch. Why that? Because it takes time to track a bug and fix it and test the fix and ship it to 1 billion consumers in 150 countries and languages. Welcome to the world of real users where things take time to happen. Of course, one may think that he's an idealistic enthusiast pressuring the evil big companies when giving them less time. But nope, the only thing one may truly accomplish is being an unrealistic asshole putting millions of computers and people at risk. Think twice before you disclose. There will also be your mom's computer on the other end of that 0-day ;)