full-disclosure - Re: Two bulletins from Microsoft on Patch Tuesday

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 07 Nov 2008 11:18:01 -0500
From: Valdis.Kletnieks@...edu
To: Col <colweb@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Two bulletins from Microsoft on Patch Tuesday

On Fri, 07 Nov 2008 07:18:18 GMT, Col said:

> I don't think any hacker is going to bother spending 5 days looking
> for a needle in a haystack when he can reverse engineer specific files
> once the patch is released. I know very little of looking for pointers
> in DLLs but from what I've seen it looks like a bit of a nightmare.
> The best way is to "diff" two files - the un-patched and the patched
> then you see where the changes are.

You're closer than most, but nobody's nailed the *actual* trade-off involved:

1) Large sites need a heads-up so they can form at least a rough estimate
of how much time/effort they will need to put in to deploying patches before
the guys who are doing diffs of binaries get their exploits.  If it's a low
rating, they can afford to do a lot of regression testing and deploy on a
relaxed timetable ("Oh, the guys over in XYZ have their weekly consolidation
run tonight, we'll upgrade them *tomorrow* night" versus "Screw the XYZ
run, we're pushing this in 2 hours whether they like it or not").

2) There's a very high chance that at least some percent of the black-hat
community is sitting on a 0-day exploit for these, that they've been using
for directed attacks under the radar (and in fact, a good chance that the
bulletin was issued because somebody's attack *didn't* go under the radar,
and that's how the white hats got a copy of the exploit).  This bulletin
is a heads-up to those black hats that their 0-day is going to be dropping
in value a lot starting Tuesday - so it's "smoke em if you got em" time.

For bonus points - compute what percent of advisories released next week
that *claim* to be reverse-engineering of the binary diff are actually
drops of 0-days that just became useless... ;)

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/