Responsibility is Everyone's Job

The software developers constantly talk about responsible disclosure.

Responsible disclosure is basically defined as informing the software developer of a vulnerability so that the vulnerability can be researched and fixed. This is compared to full disclosure where the vulnerability is announced to everyone without giving the software developer a chance to fix the vulnerability. Contrast this with the economic pressure for a software developer to reveal a vulnerability, which is none.

The spectrum consists of Full Disclosure (tell everyone), Responsible Disclosure (tell the developer), and Non-Disclosure (tell no one). Without going into details suffice it to say the responsible disclosure is currently mainstream.

The question is how the developers handle fixing the vulnerability. The general thought is that a responsible company would put resources into fixing these as soon as possible, but these comercial developers are, for the most part are in business to make a profit. I am not including open source developers in this post.

Now for two examples of how Microsoft has handeled responsible disclosures.

The ANI exploit, which I wrote about in Vista Smista& ANI Exploit. The vulnerability was disclosed in December of 2006 and not fixed until exploits where released in March. An quote from my previous blog is below and more details are in my other post mentioned above:

In short this was disclosed to Microsoft in December of 2006. Apparently the first report of this vulnerability was used as an exploit was March 28th. Due to the wide spread use of the exploit several third parties released interim patches... Microsoft
reacted, as it tends to do when third party patches are released, and the news
media starts to publish... Microsoft released the official patch out-of-cycle on
Tuesday the 3rd of April (instead of today the 10th of April).

Just recently, the end of May 2007, a vulnerability in Microsoft Web Server IIS 5.X where authentication can be bypassed, was announced. However this vulnerability was discovered December 15th 2005 (no this is not a typo) and was subsiquently responsibly disclosed to Microsoft. Apparently Microsoft finally decide to publically disclose the vulnerability, but without a fix. Unless you consider paying for an upgrade to Windows Server 2003 and IIS 6.0 a patch.

Keeping in mind thath these are just two examples where:

1. Microsoft failed to fix a known vulnerability for several months until an exploit was released.
2. Kept a vulnerability secret for over a year and then releases the information and requires a paid upgrade to the latest code for a fix.

I think Microsoft should re-evaluate their responsibilities as a good citizen or netizen.

When Google isn't Google: Google-analytics Compromised

It has been reported the the popular Google Analytics has been compromised. The details are in the ISC Diary Entry titled Google Counter ... isn't.

What this means to the average user is that any web site that uses Google Analytics, and there are more than a few that use this free service, will attempt to infect your computer.

Wat is the average user to do? Disable javascript and break most web sites? Which is almost like putting bars on your windows and refusing to leave the house.

Well it isn't a secret what I do I use Firefox and the noscript extension as my main defense against this. I normally leave anything not required for accessing a site, including Google Analytics, disabled. I was initially surprised by the number of javascripts attempting to run from sites I had not directly connected to. I would describe this as checking who a visitor is bringing with them when they want to visit my house.

sites that where used to See "Drive by What?" for my latest blog entry on the subject, or check here for all my references to noscript.

Drive by What?

It used to be that that you could avoid certain types of sites and avoid most malware. Add a good antivirus software are you where pretty safe. Not any more just about any site can be used for drive-by-downloads.

Now even major sites can participate in spread infections just by displaying advertising. The dark side submits an ad that downloads malware by just viewing the ad on a site.

This has become so common that Brian Krebs, of Security Fix fame, wrote an article about it called Cyber Crooks Hijack Activities of Large Web-Hosting Firm. Where it discusses a web hosting provider that has literally hundreds of infected host sites, and the site owners don't even know that their sites are infected.

Even Google discusses it in their new security blog with their initial post Introducing Google's online security efforts.

Alas we are not completely helpless. I have mentioned Noscript before and I will continue to recommend it to enhance your control over what runs on your computer.

I will also mention an anti-malware tool from eEye that I recently discovered called Blink that is currently free for personal use in North America.

eEye Digital Security is offering Blink Personal Internet security with Antivirus for free as a 1-year subscription in North America.

If you are outside of North America, as of the time I write this, the price is $24.95 for one computer and $29.95 for three (3) computers. I have found this to be quite effective without causing performance issues.

Videos

Who knows you better than your peers?

It seems that there was a contest for university students to create videos to increase awareness of computer security among university students.

The contest was conducted by the EDUCAUSE/Internet2 Computer and Network Security Task Force, the National Cyber Security Alliance, and ResearchChannel.

Even though the intended audience is college and university students the videods are entertaining and educational for other audiences. I suggest you check the out the videos here.

Malware the New Common Cold

Everyone has had a cold and everyone will continue to get colds. Science, and your doctor, have tried to eradicate the common cold, but to no avail.

Why are we still saddled with the common cold. Lets go to the root cause, which is, excuse me, are viruses, and by viruses I mean uncountable millions. Common cold viruses are so numerous that no one has attempted to even count them, common cold viruses can literally appear and die off or mutate into a different strain without anyone knowing.

In the old days viruses where unique digital organisms that would appear and never change. After a while viruses would "mutate into sever distinct strains, as their original creator or another entity made changes.

Nowadays malware writers cross-pollinate between different malware code attempting to create the uber malware. Then there was the so called storm worm which spread through a barrage or constantly changing e-mails with different intriguing subject lines and different executables.

The bottom line is that malware is here to stay with us for the foreseeable future, and just like real life there are some times where we must take extra care to avoid infections.