Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Two MSIE 6.0/7.0 NULL pointer crashes
From: Jeffrey Walton <noloader () gmail com>
Date: Fri, 22 Jan 2010 04:42:56 -0500

Given Microsoft's already poor reputation regarding security, I'm not sure
how it'd be possible for them to degrade their reputation any more
I don't believe its as bad as you think since Microsoft adopted a SDLC
(prior to circa 2001 was a different story). I also believe a
significant portion of the perception is due to vendors running on a
Windows operating system. When is the last time you heard someone
bashing Adobe, which is currently 'King of the Vulnerability Hill.'?

"Adobe surpasses Microsoft as favorite hacker’s target" (Jul 2009)
http://lastwatchdog.com/adobe-surpasses-microsoft-favorite-hackers-target/
"Adobe predicted as top 2010 hacker target" (Dec 2009)
http://www.theregister.co.uk/2009/12/29/security_predictions_2010/.

You're probably not going to like this, but in 2003, Apache on Linux
over took IIS as most defaced (the Server market share between Windows
and *nix appears to be about equal - see below). Zone-H Statistics
Report, http://www.zone-h.org/news/id/4686

I'm not sticking up for Microsoft. I simply claim the numbers state otherwise.

Very few people use Microsoft software because of its security reputation.
Presuming 'people' equates to Desktop installations, the numbers I
have seen indicate otherwise. When estimated through browser use,
Microsoft appears to have about 90%. Personally, I am familiar with
two US federal agencies where the desktop is exclusively Microsoft
(about 160,000 total hosts combined, unless the US government has
downsized since 2006).

If you're talking about servers, the numbers indicate that Microsoft
is on par with *nix (IDC report) or slightly above *nix (Gartner
report).

Again, I'm not sticking up for Microsoft. I simply claim the numbers
state otherwise.

The main reasons for using Microsoft are ease of use and compatibility
with other users.
Is *nix not trying to do the same? These are two key factors which
*must* be fulfilled before *nix can displace Microsoft on the Desktop.
IT departments like 'easy to use' - it keeps help desk calls to a
minimum. IT departments also like compatibility since they don't have
to spend time researching problems, workarounds, and solutions.

Given that, I'm not sure that Microsoft's perception will be
affected very much in the user community.
Agreed.

I do question Microsoft's position on *not* patching flaws when
discovered or reported in a timely manner. But that's another story,
and brings in co-conspirators, such as iDefense and TippingPoint.

For example, CVE-2009-2502 was reported to Microsoft in 2007 by a firm
which buys bugs to save everyone from 0-days. Microsoft probably knew
about the 2502 bug earlier, since the GDI+/JPEG vuln was made public
in Microsoft Security Bulletin MS04-028 (I'm making the leap that
Microsoft performed additional audits on the GDI+ module when reports
started arriving). Yet the bug was not fixed until 2009 (almost 2
years). See http://seclists.org/fulldisclosure/2009/Oct/196.

~JW

On Thu, Jan 21, 2010 at 6:34 PM, Rohit Patnaik <quanticle () gmail com> wrote:
Given Microsoft's already poor reputation regarding security, I'm not sure
how it'd be possible for them to degrade their reputation any more.  Very
few people use Microsoft software because of its security reputation.  The
main reasons for using Microsoft are ease of use and compatibility with
other users.  Given that, I'm not sure that Microsoft's perception will be
affected very much in the user community.

-- Rohit Patnaik

On Wed, Jan 20, 2010 at 6:17 PM, ☣ frank^2 <frank2 () dc949 org> wrote:

On Wed, Jan 20, 2010 at 10:25 AM, Dan Kaminsky <dan () doxpara com> wrote:
Seriously.  I mean, just look at Linux, Firefox, and OpenOffice.
Pristine code, not a single security vulnerability between them :)


That's a red herring. His point was the public perception of the
software company-- true or not-- would be hindered because Microsoft
is all-encompassing. Compared to the world of open-source, the risk is
distributed by the sheer virtue of software engineering being
distributed amongst thousands of entities. This means that the
vulnerabilities are spread across different parties, rather than
having all vulnerabilities encompassed by a single party-- in this
case, Microsoft.

His argument was irrelevant to corporations vs. open-source being more
vulnerable than one another-- it was simply a commentary on
distributed risk in software engineering.

--
"Did you and them get your degree from the same university of trolls?
I have mistaken nothing for nothing. Fuck you."

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault