Monday, May 8th 2017
Google Project Zero Finds Windows Vulnerabilty, "Worst in Recent Memory"
Google's Project Zero has found yet another critical Windows Vulnerability, this time going so far as to call it "Crazy Bad" in a lone tweet by Google security researcher Tavis Ormandy. Tavis went on to elaborate that the vulnerability "works against a default install, [you] don't need to be on the same LAN, and it's wormable."
Sounds like the stuff of nightmares from a security perspective, right? The good news is Google's policy is to give companies 90 days to patch bugs like this before revealing the exploits details. The idea is to pressure developers to fix vulnerabilities before the reveal, so users remain protected and companies are forced to act rather than adopt a "wait and see" approach. Microsoft however, does not have the best follow-up reputation, having left at least two major security bugs unpatched for the entire 90-day security-flaw reveal window as recently as this year.
One would hope they are a little more expedient on this one, or we could see some massive computer software carnage, for lack of a better term.
UPDATE: This issue has been patched by Microsoft, and has been detailed to be a Remote Execution Vulnerability in Windows Defender. Needless to say, this is an update you don't want to miss. Microsoft should be praised for it's rapid response here.
technet.microsoft.com/en-us/library/security/4022344
Credit for pointing this out goes to acbluflame.
Source:
twitter.com (Tavis Ormandy)
Sounds like the stuff of nightmares from a security perspective, right? The good news is Google's policy is to give companies 90 days to patch bugs like this before revealing the exploits details. The idea is to pressure developers to fix vulnerabilities before the reveal, so users remain protected and companies are forced to act rather than adopt a "wait and see" approach. Microsoft however, does not have the best follow-up reputation, having left at least two major security bugs unpatched for the entire 90-day security-flaw reveal window as recently as this year.
UPDATE: This issue has been patched by Microsoft, and has been detailed to be a Remote Execution Vulnerability in Windows Defender. Needless to say, this is an update you don't want to miss. Microsoft should be praised for it's rapid response here.
technet.microsoft.com/en-us/library/security/4022344
Credit for pointing this out goes to acbluflame.
25 Comments on Google Project Zero Finds Windows Vulnerabilty, "Worst in Recent Memory"
obviously a company does not want to spend time effort and especially money so yeah to pressure them this flaw will be revealed to the world in 3 months.
and while I support this method because it sadly seems necessary I find it interesting that there is not bs law or at least lawsuit against the practice of making the flaw public.
we have seen many ridiculous things being apparently against the law that handily protect humanity destroying crap like lobbyist etc, so yeah, this being an exception is welcome surprise, but a surprise non the less.
UPDATE: No, you are right. Thanks, I will update the opening post.Really, all products are. Vulnerabilities of this grade are rare though. The last time the open source community had anything near this was the ShellShock incident.The end is always nigh. As long as it stays "nigh" and not "now" I'm happy.
Mine included ;)
That literally makes no sense.
So I would suggest you question the competence of your IT department over there, before you question Chrome's security :D The risk factor in my line of work is way too high and Chrome's sandbox is actually a big improvement over IE11 in terms of managing that risk. Keep in mind that the main reason for IE is because legacy applications run on IE and *may* not run on other browsers because they weren't built for that. Also, remember that building for IE was always the main cause for stagnation for any intranet based application in the workplace :) These days, companies want lean applications that can be browser independant.
And as much as I am sceptic of this "Google is good" thing they keep repeating (or whatever they say), I don't recall an incident where Google refused or neglected to react to a severe issue with their products. Only two that come close are the [in]famous Android vulnerabilities, to which Google responded quickly enough but the issue remained because it was the OEMs' job to push the updates, and the Chrome memory and power consumption issues, which aren't security ones (and the former could be argued to be a system requirement).
With that challenge I'm calling BS. Google is nearly legendary for fixing security problems quickly. If you're going to try making funny quips, make sure they're backed by fact.OORR, and I'm going to go out on a limb here, you could try to use your Android device for something OTHER than visiting "ishouldntbehere dot com". Perhaps a firewall is in order? Do you know what a firewall is and how to use it? And just FYI there bucko, iOS has vulnerabilities too. And Apple is just as swift at fixing them as Google.Again either your computing ethic needs massive improvement, or you're on drugs. I'm a Firefox fan, but Chrome is easily it's best competitor. While Edge is ok, It's not open source and therefore not trustworthy. And Chrome kicks Edge in the "jelly-beans" performance wise. If you want to be taken seriously, you need to sound less like a fan-boy..
As for chrome are you kidding me? How many extensions are full of worms and malware? Do you live in this world? And sure if you don´t install any you are safe. FML if you don´t use computers or phones at all you are safe.
So I'm going to redirect your question back to you. What planet are YOU on?
Talking about fanboyism.....
So, anything more you'd like to offer?