Marc Maiffret Quotations

One of our customers asked which patch they should deploy if there starts to be a lot of third-party patches. I told them, it's just like picking a dentist or a plumber -- you're going to go with someone who's got a good reputation.

Obviously these things (fixes) are experimental in nature but considering the options of being vulnerable or at least having a fighting chance--well, I think you get the point. Again, this is just another mitigation option until Microsoft releases their patch, which last was scheduled for April 11th, or 16 days from now.

It is definitely a stretch to call this a backdoor. Every security flaw ever found in Windows could have been a backdoor, and we would never have known. I think it's a bit 'tin foil hat' to try to say they are backdoors.

We have a good working relationship with Microsoft. We may disagree on a lot of things, especially how long it takes them to come up with a patch, but we agree on the most important thing, which is keeping customers protected.

We are definitely going to see dangerous exploits for it because it's not really technically challenging to write the exploit code.

The race is definitely going to be won by the exploit writers, because they're going to be able to publish an exploit in the next couple of days, ... It's such a glaring bug, I don't know how anybody else didn't discover it.

You have to wonder why it took more than 220 days to create that patch if they missed these flaws.

Companies like Microsoft are not equipped to deliver protection in a timely manner.

This is the type of vulnerability that's been exploited many times, and those two worms are the biggest examples because they had the biggest impact,

For large organizations, it's just infeasible. One day is pretty fast.

It's kind of like having the cure and not sharing it with anybody.

It just allows for a lot of ways that you can manipulate systems or services to basically use UPnP to either hide attacks or use UPnP as a jump point for other attacks,

It's basically almost any Windows PC right now that you can compromise if you can trick a person to going to the wrong Web site or opening the wrong e-mail.

The bad part is the exploits were released so quickly, most people haven't patched them yet.

It's disappointing that Microsoft says the threat isn't big because it's only been found on 200 URLs. Why are they thinking about these attacks like they think about network worms? The risk of the quiet, targeted attack is very, very high and this should be an emergency situation for Microsoft.

It's really unclear. There's a good chance we will never know where it came from.

That's a long time to leave several million Windows users without any sort of protection.

The flaw can be exploited if the user opens a wrong file or goes to a wrong Web site. Then the attacker can execute code as the user, who is viewing the file or Web site.