Feeds

Google cyber-knight lances Microsoft for bug-hunter 'hostilities'

While revealing a Windows 0-day security flaw

The Essential Guide to IT Transformation

Top Google engineer Tavis Ormandy has slammed Microsoft for apparently treating security bug hunters with “great hostility”.

He blasted Redmond's behaviour towards those who report vulnerabilities as he publicly revealed a new unpatched security hole in the Windows operating system - a bug that can be exploited to crash systems or gain administrator privileges. The vulnerable driver is present in "all currently supported versions" of Windows, according to the Googler.

Ormandy discovered the flaw in the bezier curve-handling bit of the Win32k.sys kernel-level driver in March. However, triggering Microsoft's programming cock-up was difficult and at first the results were unpredictable.

In short, the "next" pointer in a double-linked list of graphical objects is not initialised by the kernel. By putting the Windows memory allocator under pressure, so that it reuses memory previously edited by the user, it is possible to prime this vulnerable "next" pointer so that the kernel follows it into a block of user-controlled memory. Exploiting this to write arbitrary data to sensitive areas of the system, to elevate privileges for example, is left as an exercise for the reader.

After documenting the bug, he posted his initial findings to the Full Disclosure mailing list, and published a complete dossier last week.

In a related post on his personal blog, Ormandy invited others to look into the flaw, before finishing the essay with trenchant criticism of Redmond's attitude towards computer security professionals.

“Note that Microsoft treat vulnerability researchers with great hostility, and are often very difficult to work with. I would advise only speaking to them under a pseudonym, using Tor and anonymous email to protect yourself,” he warned.

The Windows software giant is understood to be investigating the Win32k.sys issue highlighted by Ormandy. It's unclear if or when a possible patch may arrive. The corporation declined to respond to Ormandy's criticism, which although sincere is out of step with the opinion of many bug hunters we've spoken to over recent years: while Microsoft is praised for eventually engaging the computer security community, it's usually Oracle and Apple that are spoken about through gritted teeth.

Vulnerability management specialists Secunia warned that the flaw discovered by Ormandy can be used to launch denial-of-service assaults or elevate a local user's privilege. The danger is that the bug could be combined with other security flaws to carry out attacks remotely. Secunia classified the flaw as "less critical", which is towards the bottom end of its scale of severity.

“The vulnerability is caused due to an error within 'win32k.sys' when processing certain objects and can be exploited to cause a crash or execute arbitrary code with the kernel privilege,” Secunia noted in its advisory.

“The vulnerability is confirmed on a fully patched Windows 7 x86 Professional (win32k.sys version 6.1.7601.18126) and reported on Windows 8. Other versions may also be affected,” it added.

Ormandy has had dust-ups with other vendors over security bugs in the past. Three years ago he publicly disclosed a zero-day Windows XP Help Center security bug that he had notified Microsoft about only five days before. The flaw was far more serious than this latest coding blunder. In any case, Ormandy's antipathy towards Redmond's security gnomes is not a recent development.

Last year Ormandy went out of his way to criticise Sophos for “poor development practices and coding standards” after he found a number of vulnerabilities in its security software. Two years ago he accused Adobe of "trying to bury" scores of bugs in its Flash Player software. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Fiendishly complex password app extension ships for iOS 8
Just slip it in, won't hurt a bit, 1Password makers urge devs
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.