Onderwerp: Re: [Full-Disclosure] MSIE src&name property disclosure

--On Monday, November 08, 2004 03:13:57 PM +0100 Michal Zalewski
<lcamtuf@ghettot.org> wrote:
>
> Several days later, this statement surfaces in an article, showing beyond
> any doubt that they are, quite simply, lying to the public to save face
> and gain time.
>
> As much as I am not a rabid Microsoft hater, this pissed me off more than
> a bit.
>
Never attribute to malice what can be explained by incompetence. Most
likely what happened is the left hand (PR) didn't know what the right hand
(secure@) was doing.

Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu

Michal Zalewski wrote:

>On Mon, 8 Nov 2004, Berend-Jan Wever wrote:
>
>
>
>>In response to statements found at
>>http://news.com.com/Exploit+code+mak...3-5439370.html
>>
>>
>
>Yup.
>
>But what amuses me most, is the following bit:
>
> "Microsoft has begun to investigate the Iframe vulnerability and has not
> been made aware of any program designed to exploit the flaw, the company
> said in an e-mail statement to CNET News.com."
>
>When you posted your first message confirming that the problem is
>exploitable, I forwarded it to secure@microsoft.com, so that they know
>they have a problem in case they do not read Full-Disclosure. I got no
>response. Later, when you posted a working exploit, I sent them another
>forward, including a remark it is probably a good idea to react now, if
>they failed to do so before.
>
>In response, I got a mail from "Lennart" of Microsoft Security Response
>Center, saying that they are aware of the problem and read mailing lists,
>and that my original mail simply got lost in the noise.
>
>Several days later, this statement surfaces in an article, showing beyond
>any doubt that they are, quite simply, lying to the public to save face
>and gain time.
>
>As much as I am not a rabid Microsoft hater, this pissed me off more than
>a bit.
>
>
>
The really insidious thing is how they always attempt to claim that
their version of disclosure policy is "commonly accepted" when nothing
could be further from the truth. The security community, including most
security consulting companies, follows a wide range of policies. Most of
these policies have very little in common with Microsoft's policy, which
they call "Responsible Disclosure (tm)." Of course, they themselves do
not practice responsible disclosure to their customers. If they did,
then EVERY vulnerability they discovered internally would be in an
advisory. This is how it is done in organizations that truly do want to
protect their customers, such as the Linux community.

This is another reason why studies comparing Microsoft's security to
Open Source security are always bizzare. They compare the entire set of
Linux vulnerabilities to a tiny subset of the bugs Microsoft knows
about, but pretends other people don't. WINS is a classic example.

Dave Aitel
Immunity, Inc.

On Mon, 8 Nov 2004, Paul Schmehl wrote:

[ Moderators - feel free to kill this ]

> Never attribute to malice what can be explained by incompetence. Most
> likely what happened is the left hand (PR) didn't know what the right
> hand (secure@) was doing.

Highly unlikely; Microsoft Security Response is a team that, among other
things, manages and handles security response, including security-related
PR-esque functions (ever seen 'security evangelist' job postings on the
net?). The quote is fairly specific, so I doubt it could be spawned by a
lone PR drone who did not check with them.

--
------------------------- bash$ ){ :|:&};: --
Michal Zalewski * [http://lcamtuf.coredump.cx]
Did you know that clones never use mirrors?
--------------------------- 2004-11-08 21:35 --

http://lcamtuf.coredump.cx/photo/current/