The folks at Microsoft are not happy that Google decided to tell the world that Windows has an easily exploitable vulnerability through Adobe Flash. As far as Microsoft is concerned, the people at Google are snitches for giving out the info.
In a statement to The Verge, a spokesperson for Microsoft said that this
….disclosure by Google puts customers at potential risk. We recommend customers use Windows 10 and the Microsoft Edge browser for the best protection.”
What is the vulnerability that is causing a massive amount of bad blood between two of the biggest tech firms in he world?
According the Google Security blog, the vulnerability has to do with a specific bug. However, the specificity does not mitigate the seriousness of the problem. As a matter of fact, people who know how have already started exploiting it:
The Windows vulnerability is a local privilege escalation in the Windows kernel that can be used as a security sandbox escape. It can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD. Chrome’s sandbox blocks win32k.sys system calls using the Win32k lockdown mitigation on Windows 10, which prevents exploitation of this sandbox escape vulnerability.
We encourage users to verify that auto-updaters have already updated Flash — and to manually update if not — and to apply Windows patches from Microsoft when they become available for the Windows vulnerability.”
You would think that Google is doing the world a favour by informing us about this problem right? Not so according to Microsoft and many online security consultants.
The first problem is the fact that since Google found the flaw, their engineers had found a fix for it. But the solution is only for those who are using Google’s Chromebook.
Which indicates a sort of selfishness on the part of Google.
The other thing is that Google should have given Microsoft enough time to discover a fix for the problem before letting the world know about the bug.
In letting the cat out of the bag, Google just made sure other malicious hackers know there is a way to hack Windows PC quite easily. Formerly, only a select few knew about it. Now, the number of hackers aware of the bug has increased geometrically.
In their defense, Google say they have done nothing wrong. They followed the company’s laid down procedure on how to deal with bugs.
The policy Google is referring to is that all bugs more be reported to the public at least 10 days after being aware of it. Accordingly, Google reported the problem to Microsoft and waited for 10 days to elapsed before making it public in their security blog.
In other words, Google is saying it is no fault of theirs that the Microsoft’s engineers couldn’t come up with a fix in the time frame given. After all if Google engineers could do it, why not Microsoft’s.
Given the nature of the bug, independent software engineers think 10 days is not enough to get a fix for something like this. The prevailing wisdom is that Google should revise that 10-day policy.
In a statement to Venture Beat who first reported the issue, Microsoft had this to say:
The Windows vulnerability is a local privilege escalation in the Windows kernel that can be used as a security sandbox escape. It can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD. Chrome’s sandbox blocks win32k.sys system calls using the Win32k lockdown mitigation on Windows 10, which prevents exploitation of this sandbox escape vulnerability.”
That is all well and good. There is nothing in that statement that indicates when Microsoft think a fix would be found. Telling people to use Windows 10 and Edge to avoid the problem is another way of abdicating responsibility as far as I am concerned.
I am sure Microsoft are aware that most of the world don’t own a Windows 10 PC and not many of them have the money to buy a new Windows 10 computer. As for using Edge, thankfully, most people use better browsers on their PCs.
Image credit: slashgear.com; ssl.com; theverge.com; usatoday.com