Angry researchers disclose Windows zero-day bug
Anonymous group claims Microsoft has hostile attitude, backs Google researcher
Computerworld - An anonymous group of security researchers last week published information about an unpatched Windows bug, saying that they were disclosing the vulnerability because of the way Microsoft treated a colleague.
The flaw in Windows Vista and Server 2008 could be used by attackers to gain unauthorized access to a PC or cause it to crash.
Microsoft downplayed the threat, saying that the vulnerability required an attacker to have physical access to the computer or have compromised it with another exploit.
More intriguing than the vulnerability or its public disclosure -- both of which are commonplace with Windows -- was the declaration that began the message posted July 1 to the Full Disclosure security mailing list.
"Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry (and some not from the industry) have come together to form MSRC: the Microsoft-Spurned Researcher Collective," the message read. "MSRC will fully disclose vulnerability information discovered in our free time, free from retaliation against us or any inferred employer."
The name of the group is a poke at the Microsoft Security Response Center, the group responsible for investigating vulnerabilities, which also goes by the acronym MSRC.
Ormandy's vulnerability was quickly put to use by hackers, who began launching attacks five days after he publicized the flaw. Last week, Microsoft claimed that it had tracked attacks on more than 10,000 computers since June 15.
While some security researchers criticized Ormandy for going public with the Microsoft vulnerability, others rose to his defense, calling out both Microsoft and the press -- including Computerworld -- for linking Ormandy to his employer, Google.
The Microsoft-Spurned Researcher Collective posted its message anonymously using an account from the Hushmail service and listed six names supposedly associated with the group. The names, however, were represented only by multiple X's.
The group also called on other researchers to join it and along the way took another jab at its opponent. "We do have a vetting process, by the way, for any Microsoft employees trying to join," the group said.
Microsoft confirmed that it was investigating the bug but said that the risk to users was minimal. "Our initial analysis of the Proof-of-Concept code supplied has determined that an attacker must be able to log on locally or already have code running on the target system in order to cause a local Denial of Service," said Jerry Bryant, a group manager with the company's MSRC, in an e-mail late Monday.
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!