RE: [Full-Disclosure] Microsoft and Security
From: Burnes, James (james.burnes_at_gwl.com)
To: <firstname.lastname@example.org>, <email@example.com> Date: Fri, 25 Jun 2004 15:38:56 -0600
And what are you going to do about it, punk?
> -----Original Message-----
> From: firstname.lastname@example.org [mailto:full-disclosure-
> email@example.com] On Behalf Of firstname.lastname@example.org
> Sent: Friday, June 25, 2004 10:02 AM
> To: email@example.com
> Cc: NTBugtraq@listserv.ntbugtraq.com; firstname.lastname@example.org
> Subject: [Full-Disclosure] Microsoft and Security
> Where is Microsoft now "protecting their customers" as they love
> to bray? Should not someone in authority of this public company
> step forward and explain themselves at this time?
> All of sudden panic is being created across the WWW with "IIS
> Exploit Infecting Web Site Visitors With Malware", "Mysterious
> Attack Hits Web Servers", "Researchers warn of infectious Web
> sites" all stemming from all news accounts from an
> unpatched "problem" with Internet Explorer now two weeks old and
> counting, which in fact in reality stems from 10 months ago,
> that being the adodb.stream safe for scripting control with
> write capabilities.
> What exactly is being done about this? Nothing. What does
> multiple billions of dollars buy you today. Nothing. However for
> $20 million you can almost fly to the moon.
> Someone ought to step forward and explaini what exactly is
> happening at this public company. The great "protector of their
> customers". One might even suggest that their entire "security"
> mandate be re-examined. What exactly do they consider a
> vulnerability? Something that suits them or something that's
> cost effective to fix. So what, a few people lose their
> identities, have a few dollars extracted from their bank
> accounts, have their home pages reset, we'll fix it when it
> suits us as we have to be on budget this quarter. The Big Boss
> says $40 billion isn't enough this year.
> A vulnerability:
> "A security vulnerability is a flaw in a product that makes it
> infeasible - even when using the product properly-to prevent an
> attacker from usurping privileges on the user's system,
> regulating its operation, compromising data on it, or assuming
> ungranted trust."
> what this gibberish? For the past 10 months the adobd.stream
> object is capable of writing files to the "all important
> customer's" computer. It has real world consequences. It rapes
> their computer. Does it fit into the gibberish custom
> definition. Plain and simple: "A security vulnerability is a
> flaw in a product that makes it infeasible". What kind of
> language is this. Reads like the financial department conjured
> it up.
> Disabling scripting won't solve it. Putting sites in one of the
> myriad of "zones' won't solve it. Internet Explorer can
> trivially be fooled into operating in the less than secure so-
> called "intranet zone" and it can be guided there remotely.
> What's happening here. Where is the Microsoft representative
> explaining all of this to the shareholders and "customers" they
> so dearly wish to protect. This is unacceptable. Someone must
> be held accountable.
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
Full-Disclosure - We believe in it.