Feeds

Zero-day WMF flaw underscores patch problems

Countdown to what?

5 things you didn’t know about cloud backup

For four days in January, network administrators and security-savvy home users had a choice: download and install an unofficial open-source fix for the critical flaw in the Windows Meta File (WMF) format, or wait an estimated week for an official patch from Microsoft.

With security experts warning about the spread of exploits for the flaw in Microsoft's Windows operating system, tens of thousands of people downloaded the patch from the website of security software developer Ilfak Guilfanov and other websites that hosted the file, according to numbers provided to SecurityFocus.

The quick release of the patch showed the power of community-created code, but also the pitfalls. While source code accompanied the patch and Guilfanov made it easy to uninstall, the decision to install the patch came down to a single question: did the user trust the software developer, Ilfak Guilfanov?

"The patch was caveat emptor - let the patcher beware," said Richard Ford, associate professor of computer science at the Florida Institute of Technology. "Users are not sophisticated. It is hard for them to tell the difference between a genuine third-party patch developed by a white hat, and a program created by a black hat that looks like a patch."

A day later, several security groups vouched that the patch did what Guilfanov said it did, reducing the risk of an untrustworthy patch. Yet, even the patch's creator recognized the inherent problems in the situation. Having to make a decision about whether to trust a third-party patch should not be necessary in order to protect systems.

"As a general rule, (third-party patches) should not be applied," Guilfanov said. "The current situation was, in my perception, a bit different. First there was the danger, then I saw a relatively simple and clean, risk-free fix. If I could help my knowledgeable audience - who could do their own testing - why not? People are postings exploits all the time, why not post a solution for a change?"

The unofficial patch debate underscored the problems with relying on software fixes to secure systems. While Microsoft released its official patch for the problem last Thursday - five days early - attackers had already started using the vulnerabilities in the Windows Meta File (WMF) format - putting the vast majority of users at risk. The situation emphasized the fact that neither Microsoft's patches nor community-created fixes will ever be able to defeat the threat of a zero-day attack.

"Speeding up the patch process is never going to solve the problem, it is never going to be fast enough," the Florida Institute of Technology's Ford said. "We need to be investing very heavily in zero-day defenses, because another zero-day will happen. There is a lot of talk about whether (the software vendor has) gotten the patch out in time, but the real conversation should be about risk removal, not risk mitigation."

However, even in the best case, Microsoft may not be able to shave much more time off its response.

The software giant's delay in getting a patch to users was mainly due to quality control. The software giant had a patch candidate in less than 24 hours, but testing the patch against all its operating systems, as well as popular applications, took far longer. And, if the company had to make the choice all over again, it would still make the same decision, because breaking even a small number of systems' functionality is unacceptable, commented Kevin Kean, director of the Microsoft Security Response Center (MSRC).

"Let talk about the consequences of someone not having confidence in your patch," Kean said. "If Microsoft blows it, if people cannot trust our patches, they will not deploy them. It is critical that people have confidence in our patches, and that has been built into our ethos."

The software giant put more than 200 people on fixing the flaw and testing the patch, Kean said. The company's product teams vetted hundreds of applications to make sure that the patch caused no conflicts. As a result of the all-out development effort, Microsoft released the patch nine days after first learning about the vulnerability.

That may be the fastest the software giant has turned around a fix on a widespread software flaw. In a survey of security advisories released by Microsoft in the past three years, the Washington Post found that Microsoft has taken longer to fix vulnerabilities privately reported to the company, but has shortened its time to respond to public disclosures, which includes zero-day attacks. Microsoft took three months on average to fix issues privately disclosed to the company in 2003, a response time that shot up to 4.5 months in 2004 and 2005, according to the analysis. Yet, the company response to a publicly disclosed flaws has quickened, from 71 days in 2003 to 46 days in 2005.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.