Google Exposes Severe Windows Flaw Before Fix Due

Microsoft has publicly lashed out at Google for revealing a severe security flaw in Windows 8.1 before it was able to release a fix. The public disclosure has reawakened a longstanding dispute about how to go about reporting security flaws. Comments on Google's website suggest that the same bug also affects Windows 7 Professional 64bit, with Service Pack 1; if true, it's equally likely the bug also affects other earlier versions of the Windows operating system, including Windows XP, which is no longer supported by Microsoft and will therefore remain unpatched.

The bug involves the way user privilege levels are set within the operating system. It appears that anyone with authorized access to a Windows computer is able to create an ordinary user account, and then 'trick' Windows into elevating the account with administrator privileges.

The attack can easily be pulled off by remote or locally and can result in significant damage, including but not limited to: malware infection, identify theft, and access to otherwise sensitive data as a result of the elevation to administrator privileges. (Source: google.com)

Fix Due in January's 'Patch Tuesday'

Microsoft is due to release a fix for the problem in this month's standard monthly security update, which starts rolling out Tuesday, January 13th (today).

Google revealed the details of the security flaw to the public this past Sunday (January 11th, 2015) -- a full 90 days after it made Microsoft aware of the problem. The timing of public disclosure is what has caused the spat between the two.

Microsoft says it, and many other firms, promotes a philosophy called responsible security disclosure, in which researchers that discover bugs should keep the details secret until the relevant software developers have had enough time to find and issue a fix.

Google Accused of Inflexible Deadline

Google supports the idea of responsible security disclosure, but believes it may allow developers too much room to drag their feet before finding and releasing fixes. Its policy is to inform developers as soon as it finds a bug and give them 90 days to find the fix before going public, which it believes is a reasonable deadline.

Microsoft says that in this case, Google refused a specific request that it hold off two extra days until the fix was distributed to users in its regular monthly security update. It says that although Google stuck rigidly to its own published timetable, its decision to refuse Microsoft's request "feels less like principles and more like a 'gotcha,' with customers [being] the ones who may suffer as a result. " (Source: technet.com)

Google has not commented publicly on this specific incident.

What's Your Opinion?

Should Google have waited the extra two days before going public with this announcement, knowing that Microsoft was planning to release a fix only a few days away? Or, do you believe that Google has the right to stick to its 90-day deadline to help ensure that software firms deal with incidents more quickly? Can you think of a better solution that gives the right to full disclosure to the public, but also keeps would-be hackers from learning about and exploiting the same bugs before they are properly fixed?