Google outs unpatched Windows 8.1

Google outs unpatched Windows 8.1 vulnerability, and debate rages on both sides

A Google researcher has disclosed an unpatched vulnerability in Windows 8.1 after Microsoft didn’t fix the problem within a 90-day window Google gave its competitor.

The disclosure of the bug on Google’s security research website early this week stirred up a debate about whether outing the vulnerability was appropriate.

The bug allows low-level Windows users to become administrators in some cases, but some posters on the Google site said the company should have kept its mouth shut. Google said it was unclear if versions of the Windows OS earlier than 8.1 were affected by the bug.

“Automatically disclosing this vulnerability when a deadline is reached with absolutely zero context strikes me as incredibly irresponsible and I’d have expected a greater degree of care and maturity from a company like Google,” one poster at the Google site wrote.

The vulnerability is “your average” local privilege escalation vulnerability, the same poster wrote. “That’s bad and unfortunate, but it’s also a fairly typical class of vulnerability, and not in the same class as those that keep people like me up at night patching servers,” the poster said. “The sad reality is that these sort of vulnerabilities are a dime a dozen on Windows.”

Another poster, in what may be a slight overstatement, suggested the versions of Windows affected are run by “billions” of computer users. “Exposing vulnerabilities like this has far reaching consequences,” the poster wrote. “People could get hurt by this and it doesn’t bring anyone closer to a solution. When an organization is as big and powerful as [Google], people working there need to think of themselves as stewards of a great power and work to be fair and regulate the harm that can come of misusing this great power when possible.”