19 Quotes by Michael Sutton

We pay people directly for their submissions, and then we also have various programs to reward our loyal contributors and keep them working with us. This is our latest effort to further reward them.

Even though Windows Media Player is not something generally used to render images, it has the capability of doing that. It's not difficult to create a Web page that uses Windows Media Player to display an image instead of the default application. I think it's a ripe target for exploitation if we see public exploit code for it.

There's always code reuse in development, which is a good thing. No one writes an entire application from scratch. But if you're using someone else's code, you're relying on the security of that code. Developers need to apply the same level of security testing to those shared pieces as they do to their own code.

A DLL is canned functionality, so if you include a vulnerable DLL in an application, that application is by default vulnerable.

This is relatively easy to exploit. It takes some degree of social engineering -- the attacker would have to draw people to a malicious Web site -- but after that, there's no further intervention required. An attacker could leverage this to write to a file on the hard drive. And once you can write to a person's machine, you have full control.

It seems like there is some flaky code in portions of the libraries that handle the WMF files. It wouldn't surprise me if we see more vulnerabilities emerge, which I am sure will be followed by more media coverage.

It was definitely a surprise to see Cisco's reaction. I don't think that's the best approach. I do feel that it is happening less and that vendors are realizing that we don't want to work against them, but with them.

The attraction is that we are not bogged down in tremendous bureaucracies and processes that make it difficult to get the transactions done.

The vulnerability still exists in Internet Explorer in that it's very lenient in how it pulls CSS, but right now nobody is publishing a way that it can be leveraged to do something useful. That's not to say that somebody won't find a way. I'm sure somebody will come up with a creative way to leverage it to do something evil.