Feeds

Zero-day WMF flaw underscores patch problems

Countdown to what?

Seven Steps to Software Security

The survey also found that Microsoft has apparently been successful in convincing security researchers to disclose vulnerability information to the software giant first. In 2003, the company learned about eight critical vulnerabilities through public disclosure, but that happened only half as many times in 2005, according to the Washington Post analysis.

Yet, those numbers may miss a critical trend in who is finding vulnerabilities. Increasingly, zero-day vulnerabilities are not being disclosed at all by those who find them, generally attackers bent on using the flaw to compromise a small number of high-value targets, said Mike Puterbaugh, senior director of product marketing with network protection firm eEye Digital Security.

"Anyone with a zero-day is going to use it for a specific purpose," Puterbaugh said. "They are not going to go after my grandmother. They are going to use it to go after Citigroup, a government contractor or a university."

That means that companies will increasingly have to worry - not about the potential zero-day attacks that make the headlines - but the ones that are targeted at small groups, a situation that makes patching an ineffectual defense, Puterbaugh said.

It's a threat that worries many companies, so much so that "zero-day defenses" has become a buzzword for the industry and new companies have sprung up to meet the need for new technology.

One such company, network security firm CounterStorm, has found that security managers are eager to find solutions to the zero-day issue.

"We have yet to meet the chief information security officer who is not worried about zero-day attacks and companies are freeing up the budget to deal with the problems," CounterStorm CEO Gil Arbel said in a recent interview.

Other companies see zero-day defenses as a way to free themselves from the chaos of emergency patches. A major benefit of deploying security technologies to defend against zero-day attacks is that firms can patch on a regular schedule. Continental Airlines, a client of eEye, has moved from patching multiple times a month to once a quarter, said Andre Gold, the director of information security for Continental.

Reducing the amount of time spent patching is as much a benefit as protecting against zero-day attacks, Gold said. Patching is not a security activity, but a system administration activity - playing continual catch-up with the legion of black-hat attackers is not good security, Gold said. Even Microsoft's monthly patches are too frequent for the company, he said.

"The ad-hoc scenario kept us in chaos around here," Gold said. "The monthly frequency allows us to schedule resources, but that is still too frequent for us because it does not allow us to do regression testing."

Zero-day attacks will not go away, according to Tom Liston, a handler with the SANS Institute, an education and training organization. Liston had recommended that people deploy the unofficial patch from Guilfanov as an emergency measure.

No operating system will be free from flaws, but the fact that Microsoft has to retain potentially insecure code to support backwards compatibility makes it more likely that the security community may face a similar situation to the vulnerability in the Windows Meta File format, he said.

"The whole issue here is caused by backwards compatibility issues," Liston said. "Not only does Microsoft have to support code for Windows, but also code that goes back 15 years and that is not going to change."

This article originally appeared in SecurityFocus

Copyright © 2006, SecurityFocus

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.