Microsoft beat up, then defended over ancient IE8 zero-day
The war between security researchers (particularly from Google) and Microsoft is heating up, again, over an old bug in IE8 that was reportedly disclosed to Microsoft years ago. Once again, it seems like there aren't any good guys looking out for the users. On Friday, Google security researcher Chris Evans, in a fit of frustration over what he said was Microsoft's lack of action, posted a link to proof-of-concept code for the bug to the Full Disclosure mailing list.
This prompted Microsoft's Security Response team to Tweet an acknowledgment of the hole on Friday. It said,"We’re aware of a publicly disclosed issue involving Internet Explorer. We’ll continue to investigate over the weekend.6:52 PM Sep 3rd via web."
This Tweet prompted Computerworld's Gregg Keizer to write a story today, "Microsoft investigates two-year-old IE bug." This prompted Jason Miller, data and security team manager from security patch vendor Shavlik Technologies to send journalists such as me an e-mail this afternoon defending Microsoft and declaring that nothing is a zero-day until the vendor confirms that it is.
