> I don't buy this motive at all.

OK I'll bite. What do you think the motive is?

According to the post's byline, it was written by Neel Mehta and Billy Leonard of the Threat Analysis Group at Google. Are you questioning their professional judgement and claiming they are individually biased?

If not, are you suggesting that there is some management directive to look for Windows exploits and publish them on an aggressive timeline in order to embarrass Microsoft publicly? Do you think professional security researchers would abide by such a directive?

Yes, I believe what you describe in your second paragraph is most likely to be the case, given that coordinated disclosure is the standard approach to protecting users.

Waiting for coordinated disclosure should not delay disclosure indefinitely, though. Google decided on 7 days as per https://security.googleblog.com/2013/05/disclosure-timeline-...

I can't imagine that Microsoft have refused to fix this vulnerability though, otherwise this would have been mentioned in the blog post.

There's no good reason for Google not to respect coordinated disclosure here. Making an arbitrarily tight deadline their policy isn't protecting users.

The cited motivation was "it's being exploited in the wild". It's better to enable the rest of the world to defend against it.

This is flawed reasoning, as the vast majority of people will defend against it by installing the patch.

Well, here we get to the eternal debate about whether this trumps other considerations. Back before vulnerability researchers started putting credible deadlines to these things, vendors would sit on patches for months while the vulnerabilities were being exploited widely and were open secrets. A rough consensus seems to be that the common good is best served by these disclosure deadlines.

Also there's the consideration that security-critical environments who pay attention these have much more value-at-risk than the average Windows user. You want your safety critical systems who pay attention to be protected.

I don't think this is the case here though. It's been a few days since reporting the vulnerability, not months.

We don't yet know if this was being widely exploited (versus being a niche exploit used by an APT, for example), but it will be now either way.

What patch?

The future patch that Google should have coordinated their disclosure with.

So, there is no patch. And the only mitigating thing is what Google has said, patching Flash.

Now, tell me, how users would know about that without disclosing.

And, remember, there are already exploits

The problem is that Google also said this:

> The Windows vulnerability is a local privilege escalation in the Windows kernel that can be used as a security sandbox escape. It can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD.

Which is enough information for someone to write an exploit from scratch.

If they'd just said there is a win32k.sys vulnerability and advised users to make sure Flash is up to date, this would have been fine.

I'm starting to believe the base problem is a difference between a software company that has to test the heck out of every patch because of their large customer base (Microsoft) and a company that doesn't have a complete consumer facing experience[1] (Google). Seven days is not enough to patch anything that needs to be tested in the extensive manner required. An update / disable Flash would have been good enough until a proper patch on the day IT has planned (Patch Tuesday) activities around the deployment of patches.

I'm starting to think the ultimate PC OS for IT would be one with a transactional audit trail on all changes to the PC.

1) try calling Google about a problem if you disagree with this statement

As mentioned elsewhere in this thread, this has been Google's disclosure policy for more than three years.

https://security.googleblog.com/2013/05/disclosure-timeline-...

Stop spreading FUD without evidence.

Looks like a conveniently written policy for hitting their competitors with to me. What is certain is that Google pick and choose when to apply these disclosure time limits, they're not set in stone.

I guess it can look however you want it to look, if you've already decided that you know the truth.

No, just sceptical of their claim to be protecting users by disclosing early.

"coordinated" disclosure is a wonderful thing in a vacuum, but when people are actively being exploited then what? You silently wait to announce until the vendor is ready? How many people get owned in that time frame? How many people could mitigate in the meantime if they're tipped off to what the bad guys already know and use?

There's no "right" answer because this is a holy war that's been going on for a very, very long time now.

Thank you for saying "coordinated disclosure" instead of the misnomer, "responsible disclosure".

n.b. https://adamcaudill.com/2015/11/19/responsible-disclosure-is...

He's probably being sarcastic.

That level of detail allows malware detection by static analysis, A/V signatures, HIPS rules, etc.

Source: I've done these things before based off notices like this, and caught malware with it

At the same time it allows exploit writers to quickly add this to their kits.

I'd expect AV vendors to already have signatures for this given that it's being actively exploited, which means there must be malware samples to know this.

Most importantly it tells MS "fix your shit when your users are being attacked". Seven days ago was a Monday. That means they had a full week and a weekend to fix this. I understand that big bureaucratic organizations move slowly, and that the fix isn't trivial, but this is really the kind of thing for which they should have "scramble the jets and fix it" processes in place if they care about their user's security.

When there are known exploits attacks against users, giving a short time to get out quick patches to trusted software vendors makes a lot of sense, but I don't see a good reason for giving more than 24-48 hours before public disclosure.

Ah yes, the endless holy war over what constitutes "responsible" disclosure and the concern over who benefits more, the attackers or the attackees?

In this case, the exploit was being actively used in the wild. That means bad actors already had access to this and it was the users who were in the dark. Now it may be added to the "toolkits" of scripters and people who buy exploit frameworks but the people who do real damage were already using it according to Google.

I'm not yet sure whether I agree with the action/timeframe here, but but broadly speaking the argument is that you need to set a deadline, and enforce that deadline in order to pressure companies to fix their issues.

It's not just that people affected by this vulnerability are being protected by its disclosure (though there are reasons why that might be the case) it's that in the future vendors will take deadlines from P0 far more seriously when they realise that their reputation is on the line if they fail to patch in time.

If you let vendors get away with "we know that this is being actively exploited, but we haven't been able to come up with a timely fix, so please don't tell our customers how screwed they are", then that becomes the standard line and you need to keep letting deadlines slip. Or you don't let them slip and you end up with this sort of situation.

What about the thousands of people with imporant data that could be attacked in the coming days using this exploits, but can now protect themselves from it knowing this?

It goes both ways. As they said, this is active in the wild and many are being hacked AS WE SPEAK completely unaware of it. Imagine you had some information that is worth millions of dollars on your computer who is vulnerable to this. Now that you know, the first thing you'll do it turn off your computer or find a way to protect yourself. If they hadn't released it, you could've been hit in the coming week or month or however long it takes Microsoft.

As you can see, this isn't a black and white problem.

How does Google's disclosure allow people to protect themselves, though? They say to update Flash. Great, but that doesn't explain whether or not anything can be done to prevent the specific Microsoft vulnerability from being exploited if Flash isn't involved.

So if Google doesn't have any way to mitigate the vulnerability, all putting these details out do is allow more actors the chance to use the vulnerability until Microsoft can release a patch, which is exactly the opposite of responsible.

They can use Chrome, which mitigates the attack.

Regardless of Google's motives, "full disclosure" of vulnerabilities has always been about protecting the users and not the companies. The idea behind it is that companies need to be pressured into fixing bugs quickly. You can argue about the benefits and how effective such a strategy is, but that's why some people have done and continue to do full disclosure of bugs.