Feeds

Spurned security researchers form anti-MS collective

There's power in a union

Secure remote control for conventional and virtual desktops

Updated Security researchers irked by how Microsoft responded to Google engineer Tavis Ormany's public disclosure of a zero-day Windows XP Help Center security bug have banded together to form a group called the Microsoft Spurned Researcher Collective*.

The group is forming a "union" in the belief that together they will be better placed to handle flak from Redmond and elsewhere following the publication of security flaws. A statement, published by The Windows Club blog, explains the Collective's stance.

“Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry (and some not from the industry) have come together to form MSRC: the Microsoft-Spurned Researcher Collective," it said. "MSRC will fully disclose vulnerability information discovered in our free time, free from retaliation against us or any inferred employer.”

Last week the researcher published a zero day flaw affecting Windows Vista and Windows Server 2008. The unpatched security bug creates a means for hackers to crash affected systems and stems from a security bug in the Windows kernel. Vupen Security, which published an advisory on the flaw but is not part of the collective (Contrary to early versions of this story, Vupen rates the vulnerability only as a moderate risk bug because it doesn't lend itself to remote execution.)

The debate about responsible disclosure of security vulnerabilities is as old as software development. Security researchers argue that by disclosing problems they give end-users a chance to act and put pressure to act on software developers, who might otherwise be tempted to ignore the problem. Software developers (including Oracle, Adobe and many others as well as MS) argue that disclosing vulnerabilities in the absence of a fix imperils users.

To some outside either camp the argument hinges on whether a vulnerability is been actively exploited. The length of time a vendor has had to fix a bug - a period that can sometimes run into months - is also an important factor. ®

* The name of the group is an obvious send-up of Redmond's own Microsoft Security Response Centre.

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.