Compatibility Challenges coming for Google Chrome

January is a big month for both Microsoft and Google with Microsoft doing a big reveal on Windows 10 and the Google Create conference kicking off in sunny Mountain View. 

A highlight of the Google conference included an update to the Google Web Kit (Project) which is used by Google's web based products such as Google Wallet and AdWords.

Google's Ray Cromwell talked about the project's future direction and how future releases expected in the fourth quarter this year. Unusually one of the main topics was a break in backward compatibility for the Google Web kit. This is an unusual move for this Google team, as backward application compatibility was rigorously maintained through all previous versions since the project's inception back in 2006.

In his presentation on the planned updates to Google Web Kit, Chris Cromwell said;

“Now, because IE6, IE7, and IE8 are dead and there’s certain legacy things that we don’t want to support anymore because we need to target newer browsers and this new world of mobile, we want to deprecate these things,”

IE6, IE7 and IE8 are dead? Really?

I took the liberty of having a quick skim on some browser usage compilation sites and found that in fact IE8 is not dead. Especially if you are using a desktop.

You can find these results here. In fact I have always been suspicious of these market share reports, in that they under-report IE browser usage.

Many organizations that are likely to user a browser like IE8 (or even worse IE6) would lie behind a firewall that in some cases will remove usage tracker information from a particular user. 

Maybe the imminent death of IE8 is just wishful thinking on the part of the Google team. 

Google's 90-Day Exposure Policy

At the beginning of this month, I wrote a post about Google's new policy of researching vulnerabilities of other companies' technology and platforms, and then posting the details of the flaws and (more controversially) some sample exploit code.

Microsoft has responded with a blog posting from Chris Betz that called for better Coordinated Vulnerability Disclosure (CVD) where Chris comments that;

"Those in favor of full, public disclosure believe that this method pushes software vendors to fix vulnerabilities more quickly and makes customers develop and take actions to protect themselves. We disagree. Releasing information absent context or a stated path to further protections, unduly pressures an already complicated technical environment. It is necessary to fully assess the potential vulnerability, design and evaluate against the broader threat landscape, and issue a “fix” before it is disclosed to the public, including those who would use the vulnerability to orchestrate an attack. We are in this latter camp."

You can read more about Microsoft's disclosure approach (CVD) here. 

I am still struggling with my views on this topic, as I feel that Google may have slightly over-played their hand here, by publishing sample code and releasing the information the day before a patch was to be released from Microsoft. Google says that 90 days is enough to sort out a bug and deliver a patch. Really? For who? And, does Google have to support four desktop and server operating systems with over a billion users?

"Not my problem" says Google. 

Yeah, and not cool, either" I would say.

Chris Goettl, the Patch product manager from Landesk has this to say: 

"There was no public code examples or disclosure before Google announced this, and no known attacks were in the wild.  In this case I think Google acted irresponsibly. In the increasingly more dangerous Cyber world we live in, companies like Microsoft and Google should be setting examples to follow. This example is not an example I would urge vendors to follow."

I agree.

And now Google has published another Windows flaw, and this one is even worse (more dangerous) than the first reported issue. This flaw may result in an information disclosure scenario where Windows does not check the user identity when performing cryptographic operations. You can read more about this flaw here.

To their credit, Microsoft has been working on this issue, had developed a patch, but at the last minute encountered some compatibility issues with the security update. The fix is now scheduled for the February Patch Tuesday update cycle. 

Given that it takes some organizations between thirty and sixty days to fully deploy a patch to all their affected system, it looks like Google's "90-day disclosure policy" is  more like a "90-day exposure policy".

January Patch Tuesday ComputerWorld Posting

I have posted my latest update on my Computer World column: Patch Tuesday Debugged.

January was a pretty light update, with a single critical update and seven patches rated as Important. Most of the patches looked like pretty low-impact for most systems.
However, you may want wait a little while before deploying the kernel driver update.

You can find the full story here:

I will post another preview of Microsoft Patch Tuesday next month (Feburary) so, please watch this space.

Microsoft Changes is Patch Communication Strategy

As I have mentioned in this blog before, Microsoft is changing how it views and communicates with the world. And, given the recent challenges in communicating Patches with its Patch Tuesday release cycle (Microsoft holds back two security bulletins), it appears that Microsoft has decided how it communicates what patches are going to be released through the (now defunct) Advance Notification Strategy (ANS).

The ANS was a Patch Tuesday preview that was published initially one week in advance of the actual security update and patch release process. The ANS contained a basic list of the number of patches and what platforms would be affected by the updates. Recently (the past four months), this preview period was shortened to four days as the ANS was published on a Friday, rather than a week prior Tuesday.  I found this a useful service, but apparently the feedback that Microsoft received indicated otherwise as you can see with Chris Betz's latest blog posting;

"We are making changes to how we distribute ANS to customers. Moving forward, we will provide ANS information directly to Premier customers and current organizations involved in our security programs, and will no longer make this information broadly available through a blog post and web page."

Yes, this means no more Advance Notification Service. Actually, premier customers can still access this service and Microsoft has created a new web-based dashboard service for a customized patch view called myBulletins. In addition, the Microsoft Deployment Priority matrix has been discontinued and the Exploitability Index has been upgraded to include more threat scenarios.

I found the Advance Notification Service really helpful as it allowed me to plan the week. Finding out if you had to deal with four or fourteen patches a few days in advance is helpful - but, maybe it was a real pain for Microsoft. I have already had a bit of play with the myBulletin service and have found it .... well, pretty incomprehensible. As I have to cover most Microsoft products (like all my peers) the dash board listed forty-five pages worth of information. Hmmm...

I will see how this Patch Tuesday goes and report back...

Microsoft sweeps away IE for a clean Spartan look

For those who have followed the trials of tribulations of Internet Explorer (IE) over the past few years you may not be surprised to hear that Microsoft may now end the IE lineage with the release of a new browser currently called "Spartan". IE is dead, long live IE. 

Microsoft IE has a lot of history and some will say a lot of "baggage" with repeated security issues, compatibility and standards compliance issues cropping up over the years. I think some of these negative views are little unjustified as the security landscape has changed rapidly and dramatically over the past years. Microsoft has also made great strides in both rendering and JavaScript standards compliance. In fact, the Microsoft you see today, the one that embraces standards, open software and even other OS platforms (apparently Microsoft loves Linux) is very different from the striving, slightly isolationist monolith that it was (or was represented as by the press) even a few years ago.

Today, Microsoft is really different. And, maybe now is time for a change. Time for a new browser

The new browser codenamed "Spartan" will probably run along side IE11 (my educated guess) with the release of Windows 10. And there probably will be a parallel development and support path for both browser options for a while.  Microsoft has to support IE10 (and potentially IE11?) for a while, but not as long as you might think.

Generally, Microsoft will offer 5-6 years of mainstream support for its products. For example, Windows 8 was released on 10/30/2012 and mainstream support will end on 1/9/2018.

If you check the Microsoft Support Lifecycle Support page (found here) for IE you will find something very different from any other product or platform;

"Beginning January 12, 2016, only the most current version of Internet Explorer available for a supported operating system will receive technical support and security updates."

This is a big change, from previous support narratives, but given the nature of the security landscape and the rapid pace of change of Internet standards, an understandable stance to take.  Given that we are now in 2015, and Windows 10 is currently scheduled for release in late 2015, Microsoft's venerable browser may disappear quicker than you think.

Google lights the fuse on a Microsoft time-bomb

As the first post of the year, I wonder if this entry will set the tone for 2015. That is, one company publishing another company's security vulnerabilities before they can be fixed - potentially exposing us users.

Google, through it Project Zero program has published a Windows 8.1 vulnerability that allows certain users to gain administrative privileges through an elevation of privileges attack.  Google has a 90-day embargo policy where if it discovers a bug, it will notify the affected vendor and give them 90 days to respond (i.e. fix the bug or close the security hole).  If the company (in this case Microsoft) does not respond in time, then Google will publish the vulnerability with a sample exploitation. 

Reading from the code example given on Google's development site, you can follow these steps yourself;

1. Put the AppCompatCache.exe and Testdll.dll on disk
2. Ensure that UAC is enabled, the current user is a split-token admin and the UAC setting is the default (no prompt for specific executables). 
3. Execute AppCompatCache from the command prompt with the command line "AppCompatCache.exe c:\windows\system32\ComputerDefaults.exe testdll.dll". 
4. If successful then the calculator should appear running as an administrator. If it doesn't work first time (and you get the ComputerDefaults program) re-run the exploit from 3, there seems to be a caching/timing issue sometimes on first run. 

There are a number of opinions about this kind approach to security. Google has the following to say about this;

"On balance, Project Zero believes that disclosure deadlines are currently the optimal approach for user security — it allows software vendors a fair and reasonable length of time to exercise their vulnerability management process, while also respecting the rights of users to learn and understand the risks they face..."

To be fair, Google is not just researching vulnerabilities in Microsoft products, it is targeting Apple as well. However, what Google has done here, is to set a time-bomb. Once the vulnerability has been published by Google, then the bug will automatically be released 90-days after. Regardless of the impact or the effort from the affected vendor. If the issue is fixed, fine. If not, then you can add this to your list of worries.

However, as a user who is now more exposed and potentially compromised by this security issue, I feel a little less comfortable with this approach. In this case, it's not what Microsoft didn't do, its what Google has done.

You can read the specifics about this issue here.