Microsoft's "monkeys" find first zero-day exploit

Microsoft's "monkeys" find first zero-day exploit
Robert Lemos, SecurityFocus 2005-08-08

Microsoft 's experimental Honeymonkey project has found almost 750 Web pages that attempt to load malicious code onto visitors' computers and detected an attack using a vulnerability that had not been publicly disclosed, the software giant said in a paper released this month.

Colapse all | Post comment

Microsoft's "monkeys" find first zero-day exploit 2005-08-09
DCrawford (2 replies)

It would be nice to see this list so the websites can be blocked all-together. I suppose the list is not public for legal reasons. Has anyone seen the list or any hint of the sites that are on it?...

[ more ] [ reply ]

Re: Microsoft's "monkeys" find first zero-day exploit 2005-08-12
Roger

If they published the list, all it would achieve is those sites would move elsewhere -- plus the honeymonkeys would no longer work, and would need to be set up again with a new list (secret this time).

The only winners from publishing the list would be the bad guys operating the malicious sites (...

[ more ] [ reply ]

Re: Microsoft's "monkeys" find first zero-day exploit 2005-08-13
Don

I think MS is doing it the right way. Don't reveal who they've found and build a legal case for prosecution. Start to cut the number of bad guys and make it unprofitable to generate the malicious code....

[ more ] [ reply ]

Microsoft's "monkeys" find first zero-day exploit 2005-08-10
Spetz (5 replies)

Instead of telling that they have found these

malicious websites, Microsoft should inform the

public so the user can block their IP's or add

the URL to the restricted zone. Typical Microsoft

warning people for dangers but not doing anything

useful with it. More reason to use Firefox or any

oth...

[ more ] [ reply ]

Re: Microsoft's "monkeys" find first zero-day exploit 2005-08-10
Monkeygirl

So if they publish this list of questionable sites, what do you think the folks with the sites will do? start up new sites with the same garbage or remove the malicious code? If you are watching a criminal with the intent of catching them in the act, do you warn the public first, to beware of them ...

[ more ] [ reply ]

Re: Microsoft's "monkeys" find first zero-day exploit 2005-08-11
Paul Nofs

IANAL But isn't this kind of browser exploitation by a malicious web site, illegal? Will subpoenas be forth coming?...

[ more ] [ reply ]

Re: Microsoft's "monkeys" find first zero-day exploit 2005-08-11
Pixl

Wouldnt the hackers just move the attacks to new ip addresses or domain names? Just look what has happened with spam since RBL's block many if not most of the open relay's out there, trojans now are smtp relays. ...

[ more ] [ reply ]

Re: Microsoft's "monkeys" find first zero-day exploit 2005-08-12
Kevin

Telling users what the sites are is the worst thing they can do. If users block those sites, then the information will just appear somewhere else. The nature of the internet makes anything like that very hard to contain. But by keeping it secret, they can monitor it regularly.

The point of this...

[ more ] [ reply ]

Re: Microsoft's "monkeys" find first zero-day exploit 2005-08-12
Anonymous

Microsoft's response is, rightfully, to fix the vulnerability being exploited....

[ more ] [ reply ]

Microsoft's "monkeys" find first zero-day exploit 2005-08-12
Anonymous

I agree. Telling they've found something, but not revealing anything isn't helpful at all.

I'm pretty much done with Microsoft, and I've moved off. At least in the open-source world, they tell you something is bad, and give you ways to avoid or fix the issue....

[ more ] [ reply ]

It would be nice to have seen mention of Kathy Wang's honeyclient research as well 2005-08-12
grey

While it's great to see this technique being applied to useful purpose by Microsoft, it should also be noted that Kathy Wang was talking on honeyclients (which as a term makes more sense) for a while already. She even presented some publically available tools at REcon back in June.

http://www.sy...

[ more ] [ reply ]

Microsoft's "monkeys" find first zero-day exploit ridicolous 2005-08-13
MSIE IV (1 replies)

This is ridicolous ! Microsoft has all the Sources of their products and conduct "Blackbox - Tests"

???!!!!

Somebodyelse

...

[ more ] [ reply ]

Re: Microsoft's "monkeys" find first zero-day exploit ridicolous 2005-08-14
MonkeyMan (2 replies)

I think you are missing the point, by using honeymonkeys with differing vulnerability levels MS has just proactively located websites that are actively trying to exploit those vulnerabilities. I think this is brilliant. It will be even more brilliant if a) it helps shut down some bad sites b) helps ...

[ more ] [ reply ]

Re: Re: Microsoft's "monkeys" find first zero-day exploit ridicolous 2005-08-17
Anonymous

Yes, this is a very good approach. Having the source to the products does not mean the author knows all the flaws or where the next expliot thrust will occur. This project is in the spirit of the unix crashme program (http://people.delphiforums.com/gjc/crashme.html) which exposed many user-mode ve...

[ more ] [ reply ]

Re: Re: Microsoft's "monkeys" find first zero-day exploit ridicolous 2005-08-21
Anonymous (2 replies)

This all boils down to the fact that M$ Corp cxant code to save there miserable lives THEY OWN all therr source code THEY could IF THEY WANTED TO solve like 99% of there problems BEFORE getting you to pay them for testing there products and then moanig when there products frell things up due to THER...

[ more ] [ reply ]

Re: Re: Re: Microsoft's "monkeys" find first zero-day exploit ridicolous 2005-08-22
Anonymous

If you really believe that conspiracy theory crap, you should move to the Nevada desert and go spy on aliens....

[ more ] [ reply ]

Re: Re: Re: Microsoft's "monkeys" find first zero-day exploit ridicolous 2006-09-11
Anonymous

You obviously don't know anything about computers. I have been a developer for over 20 years. I hate Microsoft as much as the next guy, but I have to say that many of the vulnerabilities are not necessarily bugs in their code. Often times, vulnerabilities are good intentions gone bad. For exampl...

[ more ] [ reply ]

Microsoft's "monkeys" find first zero-day exploit 2008-03-27
Anonymous

Black Hats live for these senarios...Remember that a true cracker is himself an idealogist; always have a completely 'rationale' (by their own sight) for doing what they do....for some its politics, money, power, challenge, religion, etc...With regards to MS struggles - in my country a copy of windo...

[ more ] [ reply ]