Researchers slate 'month of bugs' launch for Wednesday

Claim to have unpatched vulnerabilities in Excel, IE and other Microsoft, Apple and Mozilla software

A little-known group of security researchers will kick off a month of bug disclosures starting tomorrow that target unpatched vulnerabilities in software from Abode, Microsoft, Mozilla, Apple and others.

But the researcher who launched the month-long bug festival practice four years ago isn't optimistic that reviving the practice would have an impact.

The "Month Of Abysssec Undisclosed Bugs" (MOAUB) will feature flaws in Microsoft's Excel and Internet Explorer, the Linux-based cPanel Web hosting control panel, and other software, said Abysssec Security Research in a post to the firm's blog earlier this month.

"They're threatening -- at least, the companies affected will see it as a threat -- to release vulnerabilities on all kinds of software, from desktop applications to browsers," said Jamz Yaneza, threat research manager at Trend Micro, today.

Microsoft , which figured prominently in the MOAUB announcement, said it's aware of the group's plan. "As always, if and when a vulnerability is publicly disclosed, Microsoft will take immediate action to determine the appropriate response for our customers," said Jerry Bryant, group manager with the Microsoft Security Response Center (MSRC).

Yaneza said he had not heard of Abysssec before this.

According to the group's Web site, it is made up of four researchers -- none of whom were identified by a full name -- that specialize in penetration testing, exploit development and application security review. Abysssec's Web site was registered in 2008, but the WHOIS record is hidden behind a privacy wall.

However, LinkedIn listed Shahin Ramezany, of Albany, N.Y, as a researcher with Abysssec. The group did not reply to an e-mailed request for an interview.

"Starting on the 1st of September, we will release a collection of [zero-days], Web application vulnerabilities, and detailed binary analysis (and [proof-of-concepts]) for recently released advisories by vendors such as Microsoft, Mozilla, Sun, Apple, Adobe, HP [and] Novel [sic]," the foursome said.

Yaneza said users should pay attention to the MOAUB disclosures, but he didn't seem worried about the threat.

"It's all going to be low-hanging fruit," he said, referring to the term that describes easily-found vulnerabilities. "We've seen vulnerabilities on these [programs]. I'm not too much concerned. If users patch as usual and keep their automatic patching turned on, they should be fine."

Bug-of-the-month collections were popular several years ago, but the practice has been little used since 2007. In July 2006, HD Moore, now the chief security officer of Rapid7, used a "Month of Browser Bugs" event to showcase vulnerabilities in Internet Explorer 6 (IE6), Firefox, Safari and Opera.

Moore's month-long bug event was quickly followed by others, including "Month of Kernel Bugs" in November 2006, and a "Month of Apple Bugs" in January 2007.

Yaneza called Abysssec's upcoming bug month a "publicity stunt" designed to attract attention to the group.

Moore agreed.

"Sure, they are publicity stunts, but that's not the point," he said today. "Projects like Month of Brower Bugs, and the kernel and Apple ones, they get vendors to patch lots of vulnerabilities, dozens and dozens, and focus security research on a necessary area."

But he wasn't sure MOAUB would do that. "Other projects focused on one general area, like browsers or Apple," Moore said. "But this seems like it's just a bunch of vulnerabilities. I don't know if this will have the same impact."

Microsoft's Bryant also took Abysssec to task. "Disclosing vulnerabilities publicly only puts customers at risk," he said in an e-mail, repeating a long-time stance by the company.

Abysssec will post its findings on the Exploit Database Web site throughout September.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Cybercrime and HackingAppleMicrosoftsecurityMalware and Vulnerabilitiesmozilla

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?