Angry researchers disclose Windows zero-day bug

An anonymous group of security researchers last week published information about an unpatched Windows bug, saying that they were disclosing the vulnerability because of the way Microsoft treated a colleague.

The flaw in Windows Vista and Server 2008 could be used by attackers to gain unauthorized access to a PC or cause it to crash.

Microsoft downplayed the threat, saying that the vulnerability required an attacker to have physical access to the computer or have compromised it with another exploit.

More intriguing than the vulnerability or its public disclosure — both are commonplace with Windows — was the declaration that began the message posted July 1 to the Full Disclosure security mailing list.

“Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry (and some not from the industry) have come together to form MSRC: the Microsoft -Spurned Researcher Collective,” the message read. “MSRC will fully disclose vulnerability information discovered in our free time, free from retaliation against us or any inferred employer.”

The name of the group is a poke at the Microsoft Security Response Center, the group responsible for investigating vulnerabilities, which also goes by the acronym (MSRC).

Tavis Ormandy is the Google security engineer who was at the center of a storm last month after he publicly disclosed a Windows vulnerability when Microsoft wouldn’t commit to a patching deadline.

Ormandy’s vulnerability was quickly put to use by hackers, who began launching attacks five days after he publicized the flaw. Last week, Microsoft claimed that it had tracked attacks on more than 10,000 computers since June 15.

While some security researchers criticized Ormandy for going public with the Microsoft vulnerability, others rose to his defense, calling out both Microsoft and the press for linking Ormandy to his employer, Google .

The Microsoft-Spurned Researcher Collective posted their message anonymously using an account from the Hushmail service and listed six names supposedly associated with the group. The names, however, were represented only by multiple Xs.

The group also called on other researchers to join it and along the way took another jab at its opponent. “We do have a vetting process, by the way, for any Microsoft employees trying to join,” the group said.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Related Tech News

CDN in your inbox

CDN delivers a critical analysis of the competitive landscape detailing both the challenges and opportunities facing solution providers. CDN's email newsletter details the most important news and commentary from the channel.