News for hackers. Stuff that matters.

A comment on Google Researcher Publishes Windows 10 Zero-Day Security Vulnerability. Parent comment

Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by leereeves on Thursday June 13, 2019 @07:27AM (#20173684)
Project Zero just told everyone how to exploit a bug that won't be fixed for a month.

Even if that is (arguably) better than "having no teeth", that doesn't make it a good idea. Perhaps they can find better teeth, a response that doesn't involve helping bad actors when vendors fail to patch quickly.

[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by Dylan16807 on Thursday June 13, 2019 @07:40AM (#20173772)
> Perhaps they can find better teeth

Feel free to suggest!

But wanting something to be true isn't enough. And I can assure you, everyone wants that.

[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by leereeves on Thursday June 13, 2019 @07:44AM (#20173787)
Why not publish the existence of the vulnerability without any details?

That is the only information most people will get from the disclosure anyway. Only the black hats are helped by disclosing the details.

[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by dvdkon on Thursday June 13, 2019 @08:22AM (#20174039)
Blackhats knowing is what makes companies patch the vulnerabilities. Not enough people care about there being an undisclosed vulnerability for the company to expend resources.
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by leereeves on Thursday June 13, 2019 @08:41AM (#20174187)
Microsoft doesn't care about fixing vulnerabilities unless Google forces them to?
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by wysifnwyg on Thursday June 13, 2019 @09:33AM (#20174655)
Not many companies care about fixing vulnerabilities until they actually have to.
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by pixl97 on Thursday June 13, 2019 @08:09AM (#20173959)
Why not fix your bugs in 180 days?
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by peterwwillis on Thursday June 13, 2019 @09:28AM (#20174613)
Fines for companies that don't patch vulns within 90 days? This would encourage shifting left with security to make it easier to fix flaws so they don't overrun product deadlines.
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by Aloraman on Thursday June 13, 2019 @08:47AM (#20174248)
Yes, this is not simple description of a vulnerability, this is almost ready-to-use exploit. Ethics aside, what does it mean for Microsoft and ProjectZero from the legal standpoint? Does publishing of an active exploit make either ProjectZero or Microsoft criminally or civilly liable in some way?
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by lawnchair_larry on Thursday June 13, 2019 @11:06AM (#20175574)
How could a bug report be illegal?

If you merely say that you observed a crash in someone else’s software when a certain argument is passed, and that makes you liable for their bug, we are all in big trouble.

[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by leereeves on Thursday June 13, 2019 @12:31PM (#20176435)
This isn't just a bug report; this is more like lockpicking instructions.
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by AnaniasAnanas on Thursday June 13, 2019 @09:04PM (#20179874)
Pretty sure that lockpicking instructions are legal. You can find a lot of lockpicking channels on youtube.
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by Operyl on Thursday June 13, 2019 @02:58PM (#20177656)
I’m sorry, but this isn’t an RCE. It’s a low priority issue.
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by lawnchair_larry on Thursday June 13, 2019 @08:57PM (#20179846)
Which could also not possibly be illegal.
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by Aloraman on Thursday June 13, 2019 @12:41PM (#20176520)
Well, there is a difference. First, that certain argument (malformed certificate) was not randomly encountered, it was specifically constructed to trigger the vulnerability (Was reverse-engineering involved? I don't know). Second, this bug report not only discloses the fact that the vulnerability exists, but also provides a working example for any script-kiddie to use as an exploit. Third, the bug was not privately disclosed to software vendor, but was released to the public. From https://security.stackexchange.com/questions/22973/if-i-find... it seems that would be criminal in UK or Germany, no idea what could've happen in US. On one hand, you have First Amendment, on other hand, there is an EULA.
[ Parent | on HN ]