Feeds

Zero-day WMF flaw underscores patch problems

Countdown to what?

Security for virtualized datacentres

The survey also found that Microsoft has apparently been successful in convincing security researchers to disclose vulnerability information to the software giant first. In 2003, the company learned about eight critical vulnerabilities through public disclosure, but that happened only half as many times in 2005, according to the Washington Post analysis.

Yet, those numbers may miss a critical trend in who is finding vulnerabilities. Increasingly, zero-day vulnerabilities are not being disclosed at all by those who find them, generally attackers bent on using the flaw to compromise a small number of high-value targets, said Mike Puterbaugh, senior director of product marketing with network protection firm eEye Digital Security.

"Anyone with a zero-day is going to use it for a specific purpose," Puterbaugh said. "They are not going to go after my grandmother. They are going to use it to go after Citigroup, a government contractor or a university."

That means that companies will increasingly have to worry - not about the potential zero-day attacks that make the headlines - but the ones that are targeted at small groups, a situation that makes patching an ineffectual defense, Puterbaugh said.

It's a threat that worries many companies, so much so that "zero-day defenses" has become a buzzword for the industry and new companies have sprung up to meet the need for new technology.

One such company, network security firm CounterStorm, has found that security managers are eager to find solutions to the zero-day issue.

"We have yet to meet the chief information security officer who is not worried about zero-day attacks and companies are freeing up the budget to deal with the problems," CounterStorm CEO Gil Arbel said in a recent interview.

Other companies see zero-day defenses as a way to free themselves from the chaos of emergency patches. A major benefit of deploying security technologies to defend against zero-day attacks is that firms can patch on a regular schedule. Continental Airlines, a client of eEye, has moved from patching multiple times a month to once a quarter, said Andre Gold, the director of information security for Continental.

Reducing the amount of time spent patching is as much a benefit as protecting against zero-day attacks, Gold said. Patching is not a security activity, but a system administration activity - playing continual catch-up with the legion of black-hat attackers is not good security, Gold said. Even Microsoft's monthly patches are too frequent for the company, he said.

"The ad-hoc scenario kept us in chaos around here," Gold said. "The monthly frequency allows us to schedule resources, but that is still too frequent for us because it does not allow us to do regression testing."

Zero-day attacks will not go away, according to Tom Liston, a handler with the SANS Institute, an education and training organization. Liston had recommended that people deploy the unofficial patch from Guilfanov as an emergency measure.

No operating system will be free from flaws, but the fact that Microsoft has to retain potentially insecure code to support backwards compatibility makes it more likely that the security community may face a similar situation to the vulnerability in the Windows Meta File format, he said.

"The whole issue here is caused by backwards compatibility issues," Liston said. "Not only does Microsoft have to support code for Windows, but also code that goes back 15 years and that is not going to change."

This article originally appeared in SecurityFocus

Copyright © 2006, SecurityFocus

Secure remote control for conventional and virtual desktops

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.