Feeds

Zero-day WMF flaw underscores patch problems

Countdown to what?

The Essential Guide to IT Transformation

The survey also found that Microsoft has apparently been successful in convincing security researchers to disclose vulnerability information to the software giant first. In 2003, the company learned about eight critical vulnerabilities through public disclosure, but that happened only half as many times in 2005, according to the Washington Post analysis.

Yet, those numbers may miss a critical trend in who is finding vulnerabilities. Increasingly, zero-day vulnerabilities are not being disclosed at all by those who find them, generally attackers bent on using the flaw to compromise a small number of high-value targets, said Mike Puterbaugh, senior director of product marketing with network protection firm eEye Digital Security.

"Anyone with a zero-day is going to use it for a specific purpose," Puterbaugh said. "They are not going to go after my grandmother. They are going to use it to go after Citigroup, a government contractor or a university."

That means that companies will increasingly have to worry - not about the potential zero-day attacks that make the headlines - but the ones that are targeted at small groups, a situation that makes patching an ineffectual defense, Puterbaugh said.

It's a threat that worries many companies, so much so that "zero-day defenses" has become a buzzword for the industry and new companies have sprung up to meet the need for new technology.

One such company, network security firm CounterStorm, has found that security managers are eager to find solutions to the zero-day issue.

"We have yet to meet the chief information security officer who is not worried about zero-day attacks and companies are freeing up the budget to deal with the problems," CounterStorm CEO Gil Arbel said in a recent interview.

Other companies see zero-day defenses as a way to free themselves from the chaos of emergency patches. A major benefit of deploying security technologies to defend against zero-day attacks is that firms can patch on a regular schedule. Continental Airlines, a client of eEye, has moved from patching multiple times a month to once a quarter, said Andre Gold, the director of information security for Continental.

Reducing the amount of time spent patching is as much a benefit as protecting against zero-day attacks, Gold said. Patching is not a security activity, but a system administration activity - playing continual catch-up with the legion of black-hat attackers is not good security, Gold said. Even Microsoft's monthly patches are too frequent for the company, he said.

"The ad-hoc scenario kept us in chaos around here," Gold said. "The monthly frequency allows us to schedule resources, but that is still too frequent for us because it does not allow us to do regression testing."

Zero-day attacks will not go away, according to Tom Liston, a handler with the SANS Institute, an education and training organization. Liston had recommended that people deploy the unofficial patch from Guilfanov as an emergency measure.

No operating system will be free from flaws, but the fact that Microsoft has to retain potentially insecure code to support backwards compatibility makes it more likely that the security community may face a similar situation to the vulnerability in the Windows Meta File format, he said.

"The whole issue here is caused by backwards compatibility issues," Liston said. "Not only does Microsoft have to support code for Windows, but also code that goes back 15 years and that is not going to change."

This article originally appeared in SecurityFocus

Copyright © 2006, SecurityFocus

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.