Google Engineer Finds Microsoft Security Flaw, Says Company is Hostile About It
May 23, 2013 10:51 AM
comment(s) - last by
Tavis Ormandy said Microsoft is difficult to work with regarding these issues
A Google engineer has called Microsoft out on a recent security flaw in the Windows operating system, and even said that the Windows creator is hostile toward third-party vulnerability researchers.
Tavis Ormandy, a Google security engineer, exposed the flaw on Full Disclosure. The Microsoft vulnerability, which was in the Windows kernel driver "Win32k.sys," was featured in a Full Disclosure mailing list on May 17.
Before that, Ormandy revealed the flaw on GitHub back in March in hopes of bringing other security researchers on board to investigate.
Ormandy said on Full Disclosure, "I don't have much free time to work on silly Microsoft code, so I'm looking for ideas on how to fix the final obstacle for exploitation."
Ormandy posted on Full Disclosure yet again on Monday, saying "I have a working exploit that grants SYSTEM on all currently supported versions of Windows. Code is available on request to students from reputable schools."
Ormandy also insulted Microsoft on Full Disclosure, saying "As far as I can tell, this code is pre-NT (20+ years) old, so remember to thank the SDL for solving security and reminding us that old code doesn't need to be reviewed ;-)."
Microsoft has been annoyed with Ormandy for publicly discussing vulnerabilities before they could be patched. Microsoft prefers "responsible disclosure," where security experts are asked to report flaws privately to the company.
"Note that Microsoft treat[s] vulnerability researchers with great hostility, and are often very difficult to work with," said Ormandy. "I would advise only speaking to them under a pseudonym, using Tor and anonymous email to protect yourself."
This article is over a month old, voting and posting comments is disabled
5/23/2013 1:39:50 PM
Well i would buy that if Google software was sooo perfect as to not have security flaws. There is a big Karma trap in running down a competitor in this fashion.
"This is from the DailyTech.com. It's a science website." -- Rush Limbaugh
Hulu to Hit $1 Billion in Revenue by End of Year
December 18, 2013, 1:35 PM
Harvard Undergrad Busted by Wi-Fi after Making Bomb Threat to Avoid Finals
December 18, 2013, 10:37 AM
San Francisco's Market Street Receives Free Outdoor Wi-Fi
December 17, 2013, 11:14 AM
Facebook Announces Auto-Play Video Advertising in Your News Feed
December 17, 2013, 10:00 AM
NSA Debates Granting Snowden Amnesty if He Keeps His Mouth Shut
December 16, 2013, 1:17 PM
Amazon's New "Pantry" Service to Compete with Costco, Sam's Club
December 13, 2013, 11:26 AM
Most Popular Articles
China's Lunar Rover Enters Orbit, Prepares for Historic Sat. Landing
December 13, 2013, 5:00 PM
Metro-Enabled Firefox Browser Expected to Land After Two Years of Work
December 12, 2013, 5:21 PM
The History of Normandy: How Nokia Plotted a Low-End Android Line
December 11, 2013, 8:12 PM
Ten Senators Sponsor Bill to Scrap Corn Ethanol Market Manipulation
December 13, 2013, 1:52 PM
China's Moon Rover Lands Safe and Sound, Starts Snapping Pics
December 16, 2013, 1:22 PM
Latest Blog Posts
Justice Leaks Details of Next HTC One Two Flagship Phone
Dec 5, 2013, 4:04 PM
Global Cyber Espionage Concerns Reveal Growing Cyber Armies
Nov 29, 2013, 11:04 AM
Is The Period Becoming an Expression of Anger?
Nov 26, 2013, 2:02 PM
NSA and Congress -- You Will Never Kill the Constitution, It's an Idea
Nov 10, 2013, 2:00 PM
AT&T Explores $100B+ USD Deal to Acquire Vodafone's European Operations
Nov 4, 2013, 7:34 AM
More Blog Posts
Copyright 2013 DailyTech LLC. -
Terms, Conditions & Privacy Information