Feeds

Google cyber-knight lances Microsoft for bug-hunter 'hostilities'

While revealing a Windows 0-day security flaw

Boost IT visibility and business value

Top Google engineer Tavis Ormandy has slammed Microsoft for apparently treating security bug hunters with “great hostility”.

He blasted Redmond's behaviour towards those who report vulnerabilities as he publicly revealed a new unpatched security hole in the Windows operating system - a bug that can be exploited to crash systems or gain administrator privileges. The vulnerable driver is present in "all currently supported versions" of Windows, according to the Googler.

Ormandy discovered the flaw in the bezier curve-handling bit of the Win32k.sys kernel-level driver in March. However, triggering Microsoft's programming cock-up was difficult and at first the results were unpredictable.

In short, the "next" pointer in a double-linked list of graphical objects is not initialised by the kernel. By putting the Windows memory allocator under pressure, so that it reuses memory previously edited by the user, it is possible to prime this vulnerable "next" pointer so that the kernel follows it into a block of user-controlled memory. Exploiting this to write arbitrary data to sensitive areas of the system, to elevate privileges for example, is left as an exercise for the reader.

After documenting the bug, he posted his initial findings to the Full Disclosure mailing list, and published a complete dossier last week.

In a related post on his personal blog, Ormandy invited others to look into the flaw, before finishing the essay with trenchant criticism of Redmond's attitude towards computer security professionals.

“Note that Microsoft treat vulnerability researchers with great hostility, and are often very difficult to work with. I would advise only speaking to them under a pseudonym, using Tor and anonymous email to protect yourself,” he warned.

The Windows software giant is understood to be investigating the Win32k.sys issue highlighted by Ormandy. It's unclear if or when a possible patch may arrive. The corporation declined to respond to Ormandy's criticism, which although sincere is out of step with the opinion of many bug hunters we've spoken to over recent years: while Microsoft is praised for eventually engaging the computer security community, it's usually Oracle and Apple that are spoken about through gritted teeth.

Vulnerability management specialists Secunia warned that the flaw discovered by Ormandy can be used to launch denial-of-service assaults or elevate a local user's privilege. The danger is that the bug could be combined with other security flaws to carry out attacks remotely. Secunia classified the flaw as "less critical", which is towards the bottom end of its scale of severity.

“The vulnerability is caused due to an error within 'win32k.sys' when processing certain objects and can be exploited to cause a crash or execute arbitrary code with the kernel privilege,” Secunia noted in its advisory.

“The vulnerability is confirmed on a fully patched Windows 7 x86 Professional (win32k.sys version 6.1.7601.18126) and reported on Windows 8. Other versions may also be affected,” it added.

Ormandy has had dust-ups with other vendors over security bugs in the past. Three years ago he publicly disclosed a zero-day Windows XP Help Center security bug that he had notified Microsoft about only five days before. The flaw was far more serious than this latest coding blunder. In any case, Ormandy's antipathy towards Redmond's security gnomes is not a recent development.

Last year Ormandy went out of his way to criticise Sophos for “poor development practices and coding standards” after he found a number of vulnerabilities in its security software. Two years ago he accused Adobe of "trying to bury" scores of bugs in its Flash Player software. ®

Boost IT visibility and business value

More from The Register

next story
USA to insist on pre-flight mobe power probe
Prove it works or it can't come aboard flights to USA
Computing student jailed after failing to hand over crypto keys
Sledgehammer once again used to crack a nut
Brit celebs' homes VANISH from Google's Street View
Tony Blair's digs now a Tone-y Blur
Doctor Who season eight scripts leak online
BBC asks fans to EXTERMINATE copies before they materialise
Insecure AVG search tool shoved down users' throats, says US CERT
Sneaky 'foistware' downloads install things you never asked for
New NSA boss plays down impact of Snowden leaks
You have not heard me say 'OMG, the sky is falling'
'I don't want to go on the cart' ... OpenSSL revived with survival roadmap
Heartbleed-battered crypto library reveals long path back to health
MONSTER COOKIES can nom nom nom ALL THE BLOGS
Blog networks can be force-fed more than they can chew
prev story

Whitepapers

How modern custom applications can spur business growth.
In this whitepaper learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
The Power of One eBook: Top reasons to choose HP BladeSystem
Only the Power of One delivers leading infrastructure convergence, availability and scalability with federation, and agility through data center automation.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximizing your infrastructure through virtualization
Virtualization continues to be one of the most effective ways to consolidate, reduce cost, and make data centers more efficient.
Build a Business Case: Developing Custom Apps
In this whitepaper learn how to maximize the value of custom applications by accelerating and simplifying their development.