The DEP controversy
I admit I'm getting rather tired of talking about this WMF exploit and hope to stop writing about it soon. But because we were the first security company to break the story, a lot of people have been coming to this blog and we feel we have a responsibility to keep people updated.
Context & Ripple Effects
Sunbelt broke the Windows WMF exploit story first, and its note on DEP the same day put Data Execution Prevention — Microsoft's built-in mitigation — at the center of an argument over whether it actually stops the attacks. The blog now carries an obligation the firm did not plan for: readers arriving for the original scoop expect running updates.
The story has traveled well beyond one blog on or about December 30: Spyware Confidential is tracking the exploit and ZDNet's coverage flags that 'lots of bad advice' is circulating alongside legitimate guidance — meaning the fastest-moving channel for mitigation information is also the least vetted.
First-order effects
- Users deciding whether to trust DEP as a defense are getting conflicting answers from blogs rather than the vendor, and some of the circulating workarounds are actively wrong.
- Sunbelt's first-mover status converts its blog into the de facto incident tracker, locking the company into continuous posting on an issue its author is openly tired of covering.
Second-order effects
- Other vendors and tech media are pulled into publishing their own WMF guidance to stay relevant, fragmenting the advice pool and raising the cost of distinguishing sound mitigations from noise.
- Public debate over whether DEP works pressures Microsoft to respond through official channels rather than letting third-party blogs define the state of the mitigation.
Third-order effects
- If independent security firms keep breaking exploits ahead of advisories, vendor blogs become a standing disclosure channel — shifting incident communication power away from the affected software maker and toward whoever publishes first.
- Mitigations like DEP start being judged in public in real time, so a mitigation's reputation can be damaged before its owner has said anything at all.
The trend: Security incidents are increasingly broken, tracked, and litigated by independent vendor blogs ahead of official advisories, with the effectiveness of built-in mitigations contested in public as the exploit unfolds.