http://www.theverge.com/2016/10/31/13481502/windows-vulnerab...
"Google went public just 10 days after reporting the bug to Microsoft, before a patch could be coded and deployed. The result is that, while Google has already deployed a fix to protect Chrome users, Windows itself is still vulnerable — and now, everybody knows it."
"We believe responsible technology industry participation puts the customer first, and requires coordinated vulnerability disclosure. Google’s decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk."
Edit: The distinction is important: the "malware authors" that have the access to the 0-day before Google publishes it are a minority of all malware authors: 0-days are carefully guarded and have high price. The moment Google publishes the details, the whole malware community has an access to something that is provably 0-day working exploit. The difference is huge, more orders of magnitude, up to every script kiddie.
Long term, it's in the interest of the customers as well - that's the only way to encourage ocmpanies to be releasing fixes sooner!
They already had that. That's what active exploitation means. It's not a 0-day after it's known.
> And that is only in the interest of Google, not the customers.
Sure. Just like newspapers report misconduct and it's only in the interest of themselves, not their customers. You seem to be under the impression that companies will endeavor to fix the problems as quick as possible no matter what, and that public exposure won't change that timeline at all. History tells a different story
Edit for your edit:
> 0-days are carefully guarded and have high price.
They are carefully guarded because every use risks discovery of the exploit which reduces its value. Being identified in the wild to the level seen here, or at least to the degree of importance here, indicates that the can't already out of the bag. You can assume being used in a high level attack like this effectively eliminates it as a zero day at some point, as forensics will be done. I wouldn't be surprised if the exploit was dumped to the general malware public as soon as the hack was made public, which also helps to obscure the origin slightly.
> The moment Google publishes the details, the whole malware community has an access to something that is provably 0-day working exploit. The difference is huge, more orders of magnitude, up to every script kiddie.
You act like we can reliably make predictions about what will happen if not released. It's entirely possible it could, would or has been dumped to the greater malware community already, and not releasing the details will just allow those same script kiddies access to a populace that hasn't had a chance to mitigate the attacks.
When presented with the option to keep information about danger to the greater populace secret or take it live when taking it live allows people to take their own actions to protect themselves, you take it live. Preventing people from taking their safety into their own hands by hoarding the information is immoral. It actively prevents them from protecting themselves.
Adobe patched flash before it public. Chrome protects from the specific Windows problem. Using Chrome for the time between the announcement and a fix would mitigate the attack. This course of action would leave anyone who was not already donig it safer, and in this case is easy to do.
> The attackers are faster, exactly during the time between the publishing by Google and the patch by Microsoft it's the attackers who are better off by the orders of magnitude.
As I said above, an easy mitigation exists above. Using Chrome for a few days if you weren't already if all you have to do to protect yourself from remote execution of this until it's patched.
It's not any one person or organization's place to decide the course of action for everyone else because they have secret information. The responsible thing to do if people have the the ability to change how it affects them is to disclose this information. To do otherwise is to make everyone's decision for them. It's the same principle that leads to the freedom of press. The people have aright to know about information that affects them when their choices matter.
This example you gave supports my claim, not yours: "they can use Chrome" is exactly something for what the public doesn't need to know exactly which API in which system DLL contains the bug when invoked under which circumstances, knowledge of which can be used to develop new attacks.
You might respond that Google should just tell the other browser vendors then. But why just the other browser vendors? Why would Google get to choose who qualifies as worth notifying?
I stand by my assertion. When the public is at risk, and they have the ability to take steps to reduce that risk, it is their right to know about that risk so they can take those steps if they desire.
If there were a gang of thieves working through an area taking advantage of the local population because the majority of locks sold in the area had a major flaw, I would expect it to be reported. That may spur the thieves to change how they operate, and may in some ways make them much harder to catch, but it's irresponsible to not notify the people in danger so they have a chance to protect themselves and their property, and explain what the problem is. They need to explain how it works so people can feel assured any fixes put in place actually fix the problem,and the easiest way to tell if you are in danger is often to try the exploit of the flaw yourself, because sometimes it affects more than the discoverer and the company involved thought.
You either believe the responsible thing to do is to report the details, or never report them. If you believe the responsible thing to do is to report the details, then it's just a matter of when. If it's being actively exploited, like it is here, and if you agree that a year is too long, and no time is too short, then it's a matter of choosing an amount of time that provides the vendor time to fix the exploit while reducing the number of people that might suffer in the meantime. You can either try to make decisions on a case by case basis, which will ultimately be arbitrary, or you can set a policy and follow it.
Microsoft had a week to get a fix out. If it was important enough to them, they would have. They have the talent, time, money and existing resources to do so. It wouldn't necessarily have been easy, but not doing so is a failure on their part, not Googles. I won't fault Google for giving me the choice to protect myself when Microsoft won't.
Your premise is wrong - there is a need. The details can be used to create signatures for anti-malware software and IDSes by 3rd parties who are nimbler than Microsoft.
Additionally, there is more to be worried about than just workarounds: some organisations do full-take packet capture archiving and might be interested to know if they were hacked via this flaw (retrospectively) before (more) data is exfiltrated, the sooner they are made aware of an actively-exploited bug, the better.
> ... If they don't, everybody has to wait for Microsoft anyway, but the malware authors get one now famous 0-day
Wrong again: there is no need to wait for Microsoft for the reasons I mentioned above. Before this, only the bad guys knew about the exploit, now the good guys also know about it and may work to mitigate it. We have no idea how well-known this exploit was in underground forums, so it is hard to quantify how many more bad guys know it for certain.
No, you don't need to publish the details of the vulnerability to the public in order to cooperate among the anti-virus vendors.
> some organisations do full-take packet capture archiving and might be interested to know if they were hacked via this flaw
Observing full packets has nothing to do with giving to the public the details of which system API flaw was used for the attack.
Just like I don't agree with how Google implemented AMP, making google.com a link redirector that didn't exist before and was actually used in the fishing campaign, specifically:
http://seclists.org/bugtraq/2016/Apr/70
That is what was actively used to fish the logins from Podesta et al.
Google's response:
https://sites.google.com/site/bughunteruniversity/nonvuln/op...
"tooltips are not a reliable security indicator"
Translation: "we don't look at that sh.t"
"poses very little practical risk."
See how Podesta et al. were tricked.
"offers fairly clear benefits"
Translation: "For us. Muahhaha."