Home / Business Focus
Wed, Nov 21, 2001 - Page 19 News List

Skeptics distrust software giant's secrecy on bugs

The increasing need for computer security has brought to the surface disagreements over the disclosure of information about the nighmare of protecting Microsoft's systems


Scott Culp, above, manager of Microsoft's company's security response center, in his office in Redmond, Washington. Microsoft has recently been attempting to persuade security companies to keep quiet for a month when they discover a potentially damaging flaw in software.


When Oy Online Solutions Ltd discovered that a flaw in Microsoft's Internet Explorer could let hackers steal private user information from Web files known as "cookies," the Finnish company faced a difficult decision.

Should it whisper the news to Microsoft so the software giant could fix the problem? Or should it announce the so-called "bug" to the world so Explorer users could protect themselves before a hacker discovered the same vulnerability?

This dilemma has intensified recently, with Microsoft promoting a campaign to persuade security companies to keep quiet for a month when a potentially damaging flaw in software is found.

Some security experts are skeptical of Microsoft's motives -- and the campaign itself.

The company argues that devastating computer worms such as Code Red and Nimda were unleashed by hackers who learned details of Microsoft vulnerabilities on the Web -- then picked up "exploit tools" -- blueprints for how to exploit the flaws.

"For a very long time there has been an argument about whether releasing exploit tools is helpful or harmful, but it's largely been a theoretical discussion," said Scott Culp, who manages Microsoft's company's security response center. "We've now got proof."

Microsoft's campaign won the support of five security companies at the "Trusted Computing" forum it hosted on its campus here last week. But many other computer experts say the concept is unlikely to gain momentum.

They contend that keeping flaws quiet would be more damaging to online security -- even if announcing details sometimes plays into the hands of malevolent hackers.

For example, Oy Online Solutions at first consulted with Microsoft but ultimately opted to disclose details of the Internet Explorer bug on Nov. 9. The security company said Microsoft was taking too long to make a patch that could fix the problem, leaving millions of users at risk.

Opponents of Microsoft's stance say such "full disclosure" is the only way system administrators can be sure that a patch successfully closes a breach in security -- and the only way consumers can take proper precautions.

"Full disclosure is a necessary evil. I don't think anybody likes it, even the advocates of it, simply because we know what the results are," said Elias Levy, chief technology officer of Security Focus Inc. The company, based in San Mateo, California, hosts Bugtraq, a Web forum devoted to programming errors such as the Internet Explorer flaw.

Some critics believe Microsoft's ulterior goal is to improve its image by quashing news of its products' failings.

Microsoft put out 60 patches to fix security problems in 1999, 100 last year and 55 this year. Some of the flaws have been in such important programs as Windows XP and Microsoft's Internet server software, known as IIS. After Nimda and Code Red attacked holes in IIS, an influential Gartner analyst advised clients to look for alternatives.

"They don't take security seriously. They treat security as a public relations problem," said Bruce Schneier, chief technical officer of Counterpane Technologies Inc, an online security services company. "It's much easier to hide the information than to fix the problem. That's their motivation here."

Just about every computer program in the world has defects. For years, computer scientists followed a protocol of "bug secrecy," notifying only the programmers that their work needed to be fixed. But that offered little incentive to completely fix problems or alert customers.

Comments will be moderated. Keep comments relevant to the article. Remarks containing abusive and obscene language, personal attacks of any kind or promotion will be removed and the user banned. Final decision will be at the discretion of the Taipei Times.

TOP top