full-disclosure-uk January 2010 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] Two MSIE 6.0/7.0 NULL

Re: [Full-disclosure] Two MSIE 6.0/7.0 NULL pointer crashes

From: Jeffrey Walton <noloader_at_nospam>
Date: Fri Jan 22 2010 - 09:42:56 GMT
To: Rohit Patnaik <quanticle@gmail.com>


> Given Microsoft's already poor reputation regarding security, I'm not sure
> how it'd be possible for them to degrade their reputation any more
I don't believe its as bad as you think since Microsoft adopted a SDLC (prior to circa 2001 was a different story). I also believe a significant portion of the perception is due to vendors running on a Windows operating system. When is the last time you heard someone bashing Adobe, which is currently 'King of the Vulnerability Hill.'?

"Adobe surpasses Microsoft as favorite hacker’s target" (Jul 2009) http://lastwatchdog.com/adobe-surpasses-microsoft-favorite-hackers-target/ "Adobe predicted as top 2010 hacker target" (Dec 2009) http://www.theregister.co.uk/2009/12/29/security_predictions_2010/.

You're probably not going to like this, but in 2003, Apache on Linux over took IIS as most defaced (the Server market share between Windows and *nix appears to be about equal - see below). Zone-H Statistics Report, http://www.zone-h.org/news/id/4686

I'm not sticking up for Microsoft. I simply claim the numbers state otherwise.

> Very few people use Microsoft software because of its security reputation.
Presuming 'people' equates to Desktop installations, the numbers I have seen indicate otherwise. When estimated through browser use, Microsoft appears to have about 90%. Personally, I am familiar with two US federal agencies where the desktop is exclusively Microsoft (about 160,000 total hosts combined, unless the US government has downsized since 2006).

If you're talking about servers, the numbers indicate that Microsoft is on par with *nix (IDC report) or slightly above *nix (Gartner report).

Again, I'm not sticking up for Microsoft. I simply claim the numbers state otherwise.

> The main reasons for using Microsoft are ease of use and compatibility
> with other users.

Is *nix not trying to do the same? These are two key factors which *must* be fulfilled before *nix can displace Microsoft on the Desktop. IT departments like 'easy to use' - it keeps help desk calls to a minimum. IT departments also like compatibility since they don't have to spend time researching problems, workarounds, and solutions.

> Given that, I'm not sure that Microsoft's perception will be
> affected very much in the user community.
Agreed.

I do question Microsoft's position on *not* patching flaws when discovered or reported in a timely manner. But that's another story, and brings in co-conspirators, such as iDefense and TippingPoint.

For example, CVE-2009-2502 was reported to Microsoft in 2007 by a firm which buys bugs to save everyone from 0-days. Microsoft probably knew about the 2502 bug earlier, since the GDI+/JPEG vuln was made public in Microsoft Security Bulletin MS04-028 (I'm making the leap that Microsoft performed additional audits on the GDI+ module when reports started arriving). Yet the bug was not fixed until 2009 (almost 2 years). See http://seclists.org/fulldisclosure/2009/Oct/196.

~JW

On Thu, Jan 21, 2010 at 6:34 PM, Rohit Patnaik <quanticle@gmail.com> wrote:
> Given Microsoft's already poor reputation regarding security, I'm not sure
> how it'd be possible for them to degrade their reputation any more.  Very
> few people use Microsoft software because of its security reputation.  The
> main reasons for using Microsoft are ease of use and compatibility with
> other users.  Given that, I'm not sure that Microsoft's perception will be
> affected very much in the user community.
>
> -- Rohit Patnaik
>
> On Wed, Jan 20, 2010 at 6:17 PM, ☣ frank^2 <frank2@dc949.org> wrote:
>>
>> On Wed, Jan 20, 2010 at 10:25 AM, Dan Kaminsky <dan@doxpara.com> wrote:
>> > Seriously.  I mean, just look at Linux, Firefox, and OpenOffice.
>> > Pristine code, not a single security vulnerability between them :)
>> >
>>
>> That's a red herring. His point was the public perception of the
>> software company-- true or not-- would be hindered because Microsoft
>> is all-encompassing. Compared to the world of open-source, the risk is
>> distributed by the sheer virtue of software engineering being
>> distributed amongst thousands of entities. This means that the
>> vulnerabilities are spread across different parties, rather than
>> having all vulnerabilities encompassed by a single party-- in this
>> case, Microsoft.
>>
>> His argument was irrelevant to corporations vs. open-source being more
>> vulnerable than one another-- it was simply a commentary on
>> distributed risk in software engineering.
>>
>> --
>> "Did you and them get your degree from the same university of trolls?
>> I have mistaken nothing for nothing. Fuck you."
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/