When Oy Online Solutions Ltd discovered that a flaw in Microsoft's Internet Explorer could let hackers steal private user information from Web files known as "cookies," the Finnish company faced a difficult decision.
Should it whisper the news to Microsoft so the software giant could fix the problem? Or should it announce the so-called "bug" to the world so Explorer users could protect themselves before a hacker discovered the same vulnerability?
This dilemma has intensified recently, with Microsoft promoting a campaign to persuade security companies to keep quiet for a month when a potentially damaging flaw in software is found.
Some security experts are skeptical of Microsoft's motives -- and the campaign itself.
The company argues that devastating computer worms such as Code Red and Nimda were unleashed by hackers who learned details of Microsoft vulnerabilities on the Web -- then picked up "exploit tools" -- blueprints for how to exploit the flaws.
"For a very long time there has been an argument about whether releasing exploit tools is helpful or harmful, but it's largely been a theoretical discussion," said Scott Culp, who manages Microsoft's company's security response center. "We've now got proof."
Microsoft's campaign won the support of five security companies at the "Trusted Computing" forum it hosted on its campus here last week. But many other computer experts say the concept is unlikely to gain momentum.
They contend that keeping flaws quiet would be more damaging to online security -- even if announcing details sometimes plays into the hands of malevolent hackers.
For example, Oy Online Solutions at first consulted with Microsoft but ultimately opted to disclose details of the Internet Explorer bug on Nov. 9. The security company said Microsoft was taking too long to make a patch that could fix the problem, leaving millions of users at risk.
Opponents of Microsoft's stance say such "full disclosure" is the only way system administrators can be sure that a patch successfully closes a breach in security -- and the only way consumers can take proper precautions.
"Full disclosure is a necessary evil. I don't think anybody likes it, even the advocates of it, simply because we know what the results are," said Elias Levy, chief technology officer of Security Focus Inc. The company, based in San Mateo, California, hosts Bugtraq, a Web forum devoted to programming errors such as the Internet Explorer flaw.
Some critics believe Microsoft's ulterior goal is to improve its image by quashing news of its products' failings.
Microsoft put out 60 patches to fix security problems in 1999, 100 last year and 55 this year. Some of the flaws have been in such important programs as Windows XP and Microsoft's Internet server software, known as IIS. After Nimda and Code Red attacked holes in IIS, an influential Gartner analyst advised clients to look for alternatives.
"They don't take security seriously. They treat security as a public relations problem," said Bruce Schneier, chief technical officer of Counterpane Technologies Inc, an online security services company. "It's much easier to hide the information than to fix the problem. That's their motivation here."
Just about every computer program in the world has defects. For years, computer scientists followed a protocol of "bug secrecy," notifying only the programmers that their work needed to be fixed. But that offered little incentive to completely fix problems or alert customers.
By the early 1990s, "you could literally break into every single computer on the Internet ... because security wasn't taken seriously," Levy said.
So researchers began publicizing flaws they discovered -- and releasing detailed information, including in some cases tools that could be used to exploit the flaw, so companies could not dismiss the findings as theoretical or inaccurate.
Now Microsoft's Culp believes the pendulum has swung too far, creating what he calls "information anarchy." A proposal developed at Trusted Computing calls for researchers to be careful "not to disclose details that can be directly used to exploit the vulnerability." If a software vendor fails to fix a problem within 30 days, more details could be disseminated. Many bugs are fixed well within 30 days.
"We're not saying full disclosure goes away -- we're saying, is there a responsible way to provide this information, to minimize its ability to be a hacker tool?" said Chris Klaus, founder of Atlanta-based Internet Security Systems Inc, which is pushing for the new standard.
Klaus dismissed the claim that Microsoft just wants to cover up its bug problems, and said those who want to publicize vulnerabilities are interested mainly in attracting attention to themselves.
"Our priority is to help the customer, and I think this thing solves that," Klaus said.
"Whether it helps or hurts Microsoft is not the intention of the security group."
‘NOT AN INCH’: The president said after incursions by Chinese warplanes that there should be very smooth collaboration between the executive and military branches President Tsai Ing-wen (蔡英文) yesterday said that Taiwan would not budge “an inch” on issues of sovereign territory and would stalwartly defend its democratic freedoms. Tsai made the remarks during an inspection of surface-to-air missiles at an air force base in Hualien. She was accompanied by National Security Council (NSC) Secretary-General Wellington Koo (顧立雄), Minister of National Defense Yen De-fa (嚴德發), Chief of the General Staff Huang Shu-kuang (黃曙光) and Republic of China Air Force Commander Hsiung Hou-chi (熊厚基). After attending a briefing, Tsai was given a demonstration of procedures for a missile launch. Tsai granted the base a one-time subsidy to boost troop
RIVERSIDE CAMP: As rescuers continued their search for a missing man, Taipower said that the floodgates at a hydro plant on the Lishi Creek opened due to a malfunction Three people have been confirmed dead and one was missing after being swept away by a flash flood while camping in Nantou County’s Renai Township (仁愛), police said yesterday. Six people from two families were camping near Lishi Creek (栗栖溪) when the riverbanks were suddenly flooded just after 4am, carrying away four of the campers — including two children — who were asleep in their tents, police said. A man who was among those swept away was able to climb ashore and call for help, police said, adding that another man had gone missing in the turmoil at the campsite.
ON THEIR OWN: The KMT has decided not to participate as a party at this year’s forum, and if any members do go, they would not be representing the party, Alicia Wang said The Chinese Nationalist Party (KMT) yesterday announced that it would not send a delegation “as a political party” to this year’s Straits Forum, after a Chinese TV program described the planned visit to the annual meeting as “suing for peace.” The 12th forum is scheduled to open in Xiamen, China, on Saturday. On Tuesday last week, the KMT announced that former legislative speaker Wang Jin-pyng (王金平) would lead the party’s delegation to the forum, with KMT Secretary-General Lee Chien-lung (李乾龍) as deputy head. However, on Thursday last week, China Central Television’s (CCTV) Yangshipin (央視頻) program, hosted by Li Hong (李紅), included a headline
‘NO EQUILIBRIUM’: Taiwan’s increased defense spending is a good step, but it needs to do more to have the ability to deter aggression from China, a senior US official said The US plans to sell as many as seven major weapons systems — including mines, cruise missiles and drones — to Taiwan, four people familiar with the discussions said. Pursuing seven sales at once is a rare departure from years of precedent in which US military sales to Taiwan were spaced out and carefully calibrated to minimize tensions with Beijing. However, US President Donald Trump’s administration has this year become more aggressive with China, and the sales would land as relations between Beijing and Washington are at their lowest point in decades over accusations of spying, lingering trade tensions, disputes about the