Perhaps it is the fine tequila this evening, but I really don't get how
our industry can latch on to the recent 'Aurora' incident and try to
take Microsoft to task about it. The amount of news on this has been
overwhelming, and I will try to very roughly summarize:
News surfaces Google, Adobe and 30+ companies hit by "0-day" attack
Google uses this for political overtones
Originally thought to be Adobe 0-day, revealed it was MSIE 0-day
Jan 14, confirmed it is MSIE vuln, shortly after dubbed "aurora"
Jan 21, uproar over MS knowing about the vuln since Sept
Now, here is where we get to the whole forest, trees and some analogy
about eyesight. Oh, I'll warn (and surprise) you in advance, I am giving
Microsoft the benefit of the doubt here (well, for half the blog post)
and throwing this back at journalists and the security community
instead. Let's look at this from a different angle.
The big issue that is newsworthy is that Microsoft knew of this
vulnerability in September, and didn't issue a patch until late January.
What is not clear, is if Microsoft knew it was being exploited. The
wording of the Wired article doesn't make it clear: "aware months ago of
a critical security vulnerability well before hackers exploited it to
breach Google, Adobe and other large U.S. companies" and "Microsoft
confirmed it learned of the so-called 'zero-day' flaw months ago". Errr,
nice wording. Microsoft was aware of the vulnerability (technically),
before hackers exploited it, but doesn't specifically say if they KNEW
hackers were exploiting it. Microsoft learned of the "0-day" months ago?
No, bad bad bad. This is taking an over-abused term and making it even
worse. If a vulnerability is found and reported to the vendor before it
is exploited, is it still 0-day (tree, forest, no one there to hear it
Short of Microsoft admitting they knew it was being exploited, we can
only speculate. So, for fun, let's give them a pass on that one and
assume it was like any other privately disclosed bug. They were working
it like any other issue, fixing, patching, regression testing, etc. Good
Bad Microsoft! But, before you jump on the bandwagon, bad journalists!
Bad security community!
Did a friend send you this? From now on, be the
first to find out! Subscribe to InfoSec News