Microsoft puts Mac users at risk with patch policy, says researcher

PowerPoint patch delay runs counter to 'responsible disclosure' practice

A security researcher has called foul on Microsoft for doing exactly what it has thrashed hackers over for years: revealing information that can be used to hijack computers before a patch is available.

Swa Frantzen, one of the analysts at SANS Institute's Internet Storm Center (ISC) criticized Microsoft for issuing patches yesterday that fix the Windows versions of PowerPoint while announcing that patches for the same flaws in the Mac editions would not be released until June.

"Microsoft is the one big company screaming loudest over 'responsible disclosure,'" said Frantzen in a post to the ISC blog late Tuesday. Responsible disclosure, a practice Microsoft has aggressively pushed, demands that researchers delay any disclosure until the bug has been patched. "They want an unlimited amount of time to release their patches before those who found the problem are allowed to publish," said Frantzen. "[But the] policy cuts both ways: You need to obey the rules yourself just as well as demand it from all others involved."

Microsoft, claimed Frantzen, broke its own rules of responsible disclosure yesterday by revealing that Office for Mac 2004 and Office for Mac 2008 contain three unpatched vulnerabilities, and by releasing information about the same bugs in Windows. The combination, he said, could be used by hackers to craft exploits targeting Macs.

"We all know from past experience [that] the reverse engineering of patches back into exploits starts at the time -- if not before -- the patches are released," said Frantzen. ",So in the end, Microsoft just released what hackers need to attack."

An online poll that Frantzen posted on the ISC site showed that 47% agreed Microsoft had been irresponsible in omitting patches for the Mac, while about 24% thought Microsoft made the best-possible decision.

John Pescatore, an analyst for Gartner who covers security, agreed with the minority. "I think Microsoft did the right thing here," he said in an e-mail. "I would much rather see solid, well-tested patches for the highest risk vulnerabilities -- which means first the ones where there are active exploits out -- come out first, rather than wait for all versions to be patched simultaneously, or to rush out immature patches quickly and require re-patching later."

Andrew Storms, director of security operations at nCircle Network Security, took a middle path. "I wouldn't say that [Frantzen] has gone too far. Microsoft really owns 'responsible disclosure,' both in the PR sense and in the sense that they've been able to get researchers to do it," said Storms. "You don't break your own mantra.

"Regardless, I disagree with him," Storms continued, "simply because the proof-of-concept code has been out there for a month." If no one has taken that sample code, and used it to investigate, then create a working exploit for the Mac in the past month and more, Storms argued, it was very unlikely that they would go to the additional work of reverse engineering the Windows patches to figure out how to build an exploit for the Mac.

"Why would they take the harder path," Storms asked, "when they haven't taken the easier?"

Microsoft was not able to immediately provide someone from its security response center to argue the company's side of the responsible disclosure debate, but yesterday it explained the decision to release PowerPoint patches for Windows but not for Mac OS X.

"None of the [PowerPoint] exploit samples we have analyzed will reliably exploit the Mac version, so we didn't want to hold the Windows security update while we wait for Mac packages," said Jonathan Ness, an engineer with the Microsoft Security Response Center, in a post to a company blog.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Microsoftmicrosoft patches

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Bitdefender 2019

This Holiday Season, protect yourself and your loved ones with the best. Buy now for Holiday Savings!

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?