Google and Microsoft are in a war of words after the search engine company publicized a critical Windows bug just 10 days after telling the software firm about it.
The bug, which allows privilege escalation in Windows, was discovered by Google on 21 October. An attacker can use it to access things they should not be able to, and according to Google, it is already being actively exploited in the wild.
That caused Google to declare the bug “particularly serious”, and give Microsoft just seven days to fix it before it would go public and tell the world about the error. The rationale for such disclosure programs is part preventative and part punitive: it allows others using unpatched versions of Windows to be aware of the danger, even if they cannot fix it until Microsoft releases a patch, but it also serves to publicly berate the developer for their delay in fixing the bug.
Microsoft has responded with anger at not being given time to properly issues a patch. “We believe in co-ordinated vulnerability disclosure, and today’s disclosure by Google puts customers at potential risk,” a Microsoft spokesperson told tech news site VentureBeat. “Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible. We recommend customers use Windows 10 and the Microsoft Edge browser for the best protection.”
It’s not even the first time Google and Microsoft have squabbled over the former’s tight timeline for fixing vulnerabilities. In 2015, Google published another bug online 90 days after informing Microsoft, just a few weeks before the company planned to roll out its own patch. In that case, the bug was agreed by both companies to be non-critical, and so Microsoft planned to delay its patch until a regular roll-out, but Google refused to budge on the time limit.
Microsoft’s Chris Betz wrote at the time “The decision feels less like principles and more like a ‘gotcha’, with customers the ones who may suffer as a result. What’s right for Google is not always right for customers.”
He added: “We ask that researchers privately disclose vulnerabilities to software providers, working with them until a fix is made available before sharing any details publicly. It is in that partnership that customers benefit the most. Policies and approaches that limit or ignore that partnership do not benefit the researchers, the software vendors, or our customers. It is a zero sum game where all parties end up injured.”
© 2016 Guardian Web under contract with NewsEdge. -.
