A new approach to China

Quoting:"The company has determined that Internet Explorer was one of the vectors used in targeted and sophisticated attacks targeted against Google and other corporate networks," a Microsoft spokesperson told Ars.

http://arstechnica.com/microsoft/news/2010/01/microsoft-warn...

For this reason Google has improved security : http://gmailblog.blogspot.com/2010/01/default-https-access-f... http://www.sbmteam.com/blog/gmail-security

Also should be noted that the vulnerability affects IE6, 7 and the latest 8 as well.

The hole has existed since the beginning of the decade at least and well before all the 'trusted computing' and 'security development' focus was implemented..

Six years ago Microsoft shared its source code with the Chinese Government: http://slashdot.org/articles/03/02/28/1639216.shtml?tid=109

Even though Jim Allchin testafied before congress that revealing MS source code would be a threat to US security: http://www.eweek.com/c/a/Security/Allchin-Disclosure-May-End... )

Now, the Chinese government has been caught in a cyber attack against one of Microsoft's biggest rivals using a decade old flaw Microsoft never fixed.

Is this through the looking glass or what?

number6x, it's dizzying.

The only surprising thing about it is that anyone is surprised about it.

> The only surprising thing about it is that anyone is surprised about it.

By which? The decade old unpatched bug in IE, or the Chinese government using the code Microsoft released to them to attack US corporations? I'm not particularly surprised by either.

Not that their using the code in this way almost certainly violates the agreement they signed with Microsoft, but there's not a whole lot Microsoft can do about it now.

Hmm, maybe we'll finally see Microsoft moving off the old Windows code and using a BSD kernel for their next release after all.

Quoting:maybe we'll finally see Microsoft moving off the old Windows code and using a BSD kernel for their next release after all.

Only after the Large Hadron Collider destroys the universe.

> The decade old unpatched bug in IE...

As has been said in other threads in other fora, an "undiscovered vulnerability" does not exist, by definition, since it's not been discovered.

...until it is.

Thanks for the correction Bob. Also, my references do not prove that Chinese hackers used the source code revealed to China to find the exploit. However because they had the source it is not beyond the realm of possibility.

It's just one of those 'curioser and curioser' coincidences.

Sorry, 6, I meant it as no correction at all.

What I was trying to say is that people have chided ME for using the phrase "undiscovered vulnerability".

The biggest problem I have with Microsoft style "security" is that it's closed. We cannot know how many "previously undiscovered vulnerabilities" are actually problems that Microsoft knew about, but decided weren't worth fixing.

Quoting:We cannot know how many "previously undiscovered vulnerabilities" are actually problems that Microsoft knew about, but decided weren't worth fixing.

It's "worth fixing" only when enough people find out about it, usually through actual damage to data integrity.

In the face of Melissa/Mailissa, Code Red, Nimda, Back Orifice, SQL Slammer, Conficker/Downadup, and on and on and on, I would no more recommend M$ for anything, anywhere, than I would recommend using a lug wrench made of chewing gum.

Quoting:Yet, independent researcher Dino Dai Zovi had modified the exploit code by Monday morning to compromise Windows XP and Vista systems using Internet Explorer 7, he said. He expected to succeed in exploiting the same vulnerability on Internet Explorer 8 and Windows XP systems, he added.

http://www.securityfocus.com/brief/1064

Quoting:When Tenzin Seldon, a 20-year-old sophomore at Stanford, logged onto her Gmail account from New York over winter break, she may have helped Google understand the widespread penetration of its network by unidentified hackers in China.

http://www.mercurynews.com/top-stories/ci_14195105?nclick_ch...

"Students for a Free Tibet"

Ok, that makes sense.

Want to bet she was using IE on Windows. Makes it too easy for the Chinese governement.

Quoting:The GSP is a global initiative that provides national governments with controlled access to Microsoft Windows source code and other technical information they need to be confident in the security of the Windows platform. The China Government is one of the first governments around the globe to sign the agreement.

http://www.microsoft.com/presspass/press/2003/feb03/02-28GSP...

;-P

Umm, they look at the source code to see if windows is secure?

Seems like a waste of time to me.

>Seems like a waste of time to me.

Maybe not for them(the Chinese gov.) ....maybe so they 'learned things' ...how/where to 'hack' ... ;-P

quote from Nate Anderson at Ars :

Quoting:An inside job? It's little more than an anonymously sourced rumor at this point, but Reuters says that insiders from Google's own Chinese office may have been involved in the cyberattack on the company.

http://arstechnica.com/tech-policy/news/2010/01/google-v-chi...