MS knew of Aurora exploit four months before Google attacks

Microsoft first knew of the bug used in the infamous Operation Aurora IE exploits as long ago as August, four months before the vulnerability was used in exploits against Google and other hi-tech firms in December, it has emerged. Redmond's security gnomes finally got around to patching the exploit on Thursday. Microsoft's …

[Destroy All Monsters]

I can hear the wailing sound...

....of incoming no-win-no-fee lawyers.

[raving angry loony]

full disclosure.

it's shit like this that makes the "full disclosure of flaws" camp look ever so right in their attitude. When Microsoft hides flaws, everyone suffers. Except, it seems, Microsoft.

[gollux]

Aiding and abetting...

as usual. Glad to know where we stand.

[Anonymous Coward]

Yes, please, disclosure++

It's not just Microsoft, a lot of outfits with closed-source software will leave horrid exploitable holes open for months, sometimes even years. Apple are as bad, scarily.

I can see the logic of the argument about keeping things quiet until it's fixed- make no mistake about it. However, the argument only holds up when the developers actually fix the bugs in a responsible time frame.

Personally, I am in favour of full disclosure- and I also prefer completely open software, especially for security-critical stuff.

However, if you must be closed, and if you can't support full disclosure, maybe disclose to the vendor in private with a notification that you'll go private after a month. If the software concerned is so vital and sensitive that it's too special for initial full disclosure, it's important enough to put full resources into fixing and testing in that (non-mythical man) month.

If you can't be arsed to devote resources to fixing your shit rather than working on new shiny things for marketing to push, then screw you- you don't deserve the month's head start, and the deference.

[Anonymous Coward]

Monopoly games

Could this happen in a competitive market? Would MS, or anybody else, get away with such malpractice in the security-department had they been just one of 5 or 6 equal sized players.

[lucmars]

It could happen as well

Simply because the first reaction is to hide his head in the sand. Moreover, a security flaw is a very valuable information which could be leaked from the corporation staff. Depending the internal organisation, such information can be retained a while for a personnal use before it become an issue to address.

[Mark Simon]

Open Source or Closed Doors?

Why anybody still uses IE is a mystery. Microsoft puts a lot of energy into telling the world that Open Source is evil. If they put half the amount of energy into fixing their security problems, every body would be a lot happier.

It’s very simple. Full disclosure of the source code plus a planet full of developers, or secret codes in the hands of a (relative) hand full of developers?

[Doug 3]

Microsoft is more secure than OSS

only because you don't know what they are hiding. Do you feel safe now that it is pretty obvioud that the locks on your Windows are just painted on?

Paris because she can't tell the difference either.

[Anonymous Coward]

Interesting Connection, Between Source Country and Attack Objectives?

The 'Aurora' (not a very chinese term!) attack was targetting persons involved in state oppression, where as the vulnerability used was discovered in a country accused of oppressing certain persons and excessive wall building.

Black Helicopters incoming, extra anonymous, for suggesting such a thing...

[Inachu]

The guise of first reports.

The guise of first reports always linger longer as they tend to rannk higher in peoples mind longer even though information may have changed.

Thus knowing the above I am sure lots of people still think China is the guilty party for hacking when in fact the code was brewed in the USA.

Nice going!