Wed, October 01, 2003 — CIO — Jeff Jones, senior director of Microsoft’s Trustworthy Computing security initiative, was quoted in late July in an Associated Press article making a statement that seems at first to be the understatement of the year. Referring to the online publication of code that could help hackers take advantage of a recently discovered flaw in most versions of Windows operating systems, Jones said, "We continue to believe that publication of exploit code in cases like this is not good for customers."

Jones’s conviction that giving hackers the key to the castle was not good for those of us who live inside the castle seemed, to most readers, to be a statement of the obvious. The strange thing is, the obvious isn’t so obvious to security experts. A great many security experts think the best way to make sure that security holes are plugged as quickly as possible is to get as much information as possible to the greatest number of people as quickly as possible. In other words, if more people are familiar with the problem, then more people will work on finding a solution. In the meantime, of course, posting that information is the equivalent of serving up a bomb for any company that has not yet installed the appropriate patches.

In July, several websites, following the lead of a "security research group" based in China, published the program that could allow hackers to gain control of a Windows operating system by entering the system through a hole in the Distributed Component Object Model Interface. Malicious hackers could put that knowledge to work creating mass-mailer worms that move from one computer to the next, leaving havoc in their wake. And while none of the code was published until nine days after Microsoft had announced the flaw and offered a patch, the publication ratcheted up the risk for those systems that had not installed the patch. On the other hand, its publication, and consequent publications (such as this one) about its publication, helped to warn of what some experts have called the worst Windows security hole in history.

The debate about whether to publish exploit code is clearly illustrated by the public response to this most recent episode. In this case, as in many cases, the first group to publish the code was not the group that discovered the flaw. That honor goes to a group of Polish experts known as The Last Stage of Delirium Research Group, or LSD, which found the flaw more than a month before it dutifully sent a message to Microsoft, which scrambled to create a patch. As it happens, LSD was not always such a good scout. Last April, the group was slammed by security experts after it released exploit code for a devastating Sendmail flaw. In response, LSD issued a public statement asserting its conviction that failure to publish detailed information about security flaws could be more damaging than publishing. This time around, LSD showed the kind of restraint that its critics had called for. The result: The group was slammed by security experts who agree with LSD’s public statement.