Feeds

Zero-day WMF flaw underscores patch problems

Countdown to what?

Security for virtualized datacentres

For four days in January, network administrators and security-savvy home users had a choice: download and install an unofficial open-source fix for the critical flaw in the Windows Meta File (WMF) format, or wait an estimated week for an official patch from Microsoft.

With security experts warning about the spread of exploits for the flaw in Microsoft's Windows operating system, tens of thousands of people downloaded the patch from the website of security software developer Ilfak Guilfanov and other websites that hosted the file, according to numbers provided to SecurityFocus.

The quick release of the patch showed the power of community-created code, but also the pitfalls. While source code accompanied the patch and Guilfanov made it easy to uninstall, the decision to install the patch came down to a single question: did the user trust the software developer, Ilfak Guilfanov?

"The patch was caveat emptor - let the patcher beware," said Richard Ford, associate professor of computer science at the Florida Institute of Technology. "Users are not sophisticated. It is hard for them to tell the difference between a genuine third-party patch developed by a white hat, and a program created by a black hat that looks like a patch."

A day later, several security groups vouched that the patch did what Guilfanov said it did, reducing the risk of an untrustworthy patch. Yet, even the patch's creator recognized the inherent problems in the situation. Having to make a decision about whether to trust a third-party patch should not be necessary in order to protect systems.

"As a general rule, (third-party patches) should not be applied," Guilfanov said. "The current situation was, in my perception, a bit different. First there was the danger, then I saw a relatively simple and clean, risk-free fix. If I could help my knowledgeable audience - who could do their own testing - why not? People are postings exploits all the time, why not post a solution for a change?"

The unofficial patch debate underscored the problems with relying on software fixes to secure systems. While Microsoft released its official patch for the problem last Thursday - five days early - attackers had already started using the vulnerabilities in the Windows Meta File (WMF) format - putting the vast majority of users at risk. The situation emphasized the fact that neither Microsoft's patches nor community-created fixes will ever be able to defeat the threat of a zero-day attack.

"Speeding up the patch process is never going to solve the problem, it is never going to be fast enough," the Florida Institute of Technology's Ford said. "We need to be investing very heavily in zero-day defenses, because another zero-day will happen. There is a lot of talk about whether (the software vendor has) gotten the patch out in time, but the real conversation should be about risk removal, not risk mitigation."

However, even in the best case, Microsoft may not be able to shave much more time off its response.

The software giant's delay in getting a patch to users was mainly due to quality control. The software giant had a patch candidate in less than 24 hours, but testing the patch against all its operating systems, as well as popular applications, took far longer. And, if the company had to make the choice all over again, it would still make the same decision, because breaking even a small number of systems' functionality is unacceptable, commented Kevin Kean, director of the Microsoft Security Response Center (MSRC).

"Let talk about the consequences of someone not having confidence in your patch," Kean said. "If Microsoft blows it, if people cannot trust our patches, they will not deploy them. It is critical that people have confidence in our patches, and that has been built into our ethos."

The software giant put more than 200 people on fixing the flaw and testing the patch, Kean said. The company's product teams vetted hundreds of applications to make sure that the patch caused no conflicts. As a result of the all-out development effort, Microsoft released the patch nine days after first learning about the vulnerability.

That may be the fastest the software giant has turned around a fix on a widespread software flaw. In a survey of security advisories released by Microsoft in the past three years, the Washington Post found that Microsoft has taken longer to fix vulnerabilities privately reported to the company, but has shortened its time to respond to public disclosures, which includes zero-day attacks. Microsoft took three months on average to fix issues privately disclosed to the company in 2003, a response time that shot up to 4.5 months in 2004 and 2005, according to the analysis. Yet, the company response to a publicly disclosed flaws has quickened, from 71 days in 2003 to 46 days in 2005.

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.