diff options
Diffstat (limited to 'old/published/Webmonkey/Monkey_Bites/2007/04.30.07/Thu/quicktimepatch.txt')
| -rw-r--r-- | old/published/Webmonkey/Monkey_Bites/2007/04.30.07/Thu/quicktimepatch.txt | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/old/published/Webmonkey/Monkey_Bites/2007/04.30.07/Thu/quicktimepatch.txt b/old/published/Webmonkey/Monkey_Bites/2007/04.30.07/Thu/quicktimepatch.txt new file mode 100644 index 0000000..570af9f --- /dev/null +++ b/old/published/Webmonkey/Monkey_Bites/2007/04.30.07/Thu/quicktimepatch.txt @@ -0,0 +1,20 @@ +<img alt="Quicktime" title="Quicktime" src="http://blog.wired.com/photos/uncategorized/2007/04/25/quicktime.jpg" border="0" style="float: right; margin: 0px 0px 5px 5px;" />Just days after its discovery during a [hacking contest at the CanSecWest conference][4], Apple has released Quicktime update that patches a serious zero day flaw. The Quicktime update is recommended for both Windows and Mac users and can be [downloaded from the Apple site][1]. + +The Apple [security note][2] credits Dino Dai Zovi, the hacker who recently discovered the flaw, as well as TippingPoint and the Zero Day Initiative for the discovery of the flaw. + +It would seem that everybody wins in this scenario, Zovi took home the $10,000 prize and Apple patched the flaw giving Quicktime users a more secure platform, but security analysts Gartner industries is still unhappy. + +A [note on the Gartner site][3] reads: + +>Public vulnerability research and "hacking contests" are risky endeavors, and can run contrary to responsible disclosure practices, whereby vendors are given an opportunity to develop patches or remediation before any public announcements. Vulnerability research is an extremely valuable endeavor for ensuring more secure IT. However, conducting vulnerability research in a public venue is risky and could potentially lead to mishandling or treating too lightly these vulnerabilities -- which can turn a well-intentioned action into a more ambiguous one, or inadvertently provide assistance to attackers. + +While there is some merit to what Gartner is saying, the fact is the flaws exist, and security through secrecy is nearly always a flawed approach. To argue that vender notification trumps user notification means that Gartner believes users are better off left in dark while the vender attempts to fix the problem. + +In fact, notifying users that a problem exists alerts them to potential vulnerabilities. In this case once users were aware that the flaw existed they could exercise greater caution in downloading untrusted Quicktime Media. + +It's also worth noting that Gartner has a vested interest in maintaining insider knowledge of attacks, something they lose in public hacking contests. + +[1]: http://www.apple.com/support/downloads/quicktime716formac.html "QuickTime 7.1.6 for Mac" +[2]: http://docs.info.apple.com/article.html?artnum=305446 "About the security content of QuickTime 7.1.6" +[3]: http://www.gartner.com/DisplayDocument?doc_cd=148455 "QuickTime Vulnerability Exposed by Contest Poses Wide Risk" +[4]: http://blog.wired.com/monkeybites/2007/04/mac_hack_affect.html "Mac Hack Affects Windows As Well"
\ No newline at end of file |