Microsoft Reveals That Google Released Details On Windows Vulnerability Despite Their Request To Delay It

A Google Researched found an unpatched security vulnerability in Windows 8.1 and he posted the bug on Google Security Research page and it was subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public. With this policy, Google published the vulnerability information on the web. It was an irresponsible move from Google to publish a vulnerability on a product such as Windows which is being used by millions of people everyday.

Today, Microsoft confirmed that they requested Google to delay this process for 2 days until they release their fix. But, Google declined the request happily without worrying about millions of users.

CVD philosophy and action is playing out today as one company – Google – has released information about a vulnerability in a Microsoft product, two days before our planned fix on our well known and coordinated Patch Tuesday cadence, despite our request that they avoid doing so. Specifically, we asked Google to work with us to protect customers by withholding details until Tuesday, January 13, when we will be releasing a fix. Although following through keeps to Google’s announced timeline for disclosure, the decision feels less like principles and more like a “gotcha”, with customers the ones who may suffer as a result. What’s right for Google is not always right for customers. We urge Google to make protection of customers our collective primary goal.

Microsoft has long believed coordinated disclosure is the right approach and minimizes risk to customers. We believe those who fully disclose a vulnerability before a fix is broadly available are doing a disservice to millions of people and the systems they depend upon. Other companies and individuals believe that full disclosure is necessary because it forces customers to defend themselves, even though the vast majority take no action, being largely reliant on a software provider to release a security update. Even for those able to take preparatory steps, risk is significantly increased by publically announcing information that a cybercriminal could use to orchestrate an attack and assumes those that would take action are made aware of the issue. Of the vulnerabilities privately disclosed through coordinated disclosure practices and fixed each year by all software vendors, we have found that almost none are exploited before a “fix” has been provided to customers, and even after a “fix” is made publicly available only a very small amount are ever exploited. Conversely, the track record of vulnerabilities publicly disclosed before fixes are available for affected products is far worse, with cybercriminals more frequently orchestrating attacks against those who have not or cannot protect themselves.

Another aspect of the CVD debate is related to timing – specifically the amount of time that is acceptable before a researcher broadly communicates the existence of a vulnerability. Fixing a bug in web service completely different from fixing a bug in Windows which is a decade old OS.

Read more about it from Microsoft’s blog post.