Feeds

Researcher: No emergency patch for critical Windows bug

Redmond defenses neuter exploit code

Top 5 reasons to deploy VMware with Tegile

A security researcher has downplayed the significance of publicly released attack code exploiting a critical vulnerability in newer versions of Windows, saying it isn't reliable enough to force Microsoft to issue an emergency patch.

The exploit, which on Monday was folded into the open-source Metasploit penetration testing kit, is at best successful only 50 percent of the time, said Dave Aitel, CTO of security firm Immunity. Given the burden of releasing out-of-schedule patches, Microsoft is unlikely to do so in this case.

"To move something like Microsoft you've got to have something major and this isn't quite it," Aitel, whose company released its own attack code two weeks ago. "It's going to be a lot of work to take the exploit where it is to something that works enough that they will do that."

The vulnerability, which surfaced three weeks ago, resides in file-sharing technology called SMB2, short for server message block version 2, which was first added to Windows Vista and later made its way into newer versions of the operating system. While the Metasploit exploit is sophisticated, it is frequently thwarted by a security measure known as ASLR. Short for address space layout randomization, it picks a different memory location to load system components each time the OS is started.

Without being able to predict where required code will be located, the Metasploit attack isn't reliable enough to prompt Microsoft to take the drastic step of releasing a patch outside of the regularly scheduled update cycle. The software giant adopted the patch routine to make life easier on system administrators by allowing them to plan and test updates before installing them on huge numbers of business critical machines.

The Metasploit exploit in many cases is able to get around ASLR by targeting memory locations that are predictable when Windows is running on VMware. But when the exploit targets the OS running directly on a computer, the success rate can be as low as 10 percent.

"You haven't heard of 1,000 machines getting owned with this and there's a reason for that," Aitel said. "I know it doesn't work on the ones we have here in the lab."

By contrast, the exploit released by Immunity, is much more reliable, Aitel said, "but we poured a ton of resources into it." Based on his review of the Metasploit code, he predicted it would take another two weeks for it to become fully reliable.

The SMB2 bug is significant because it can allow attackers to remotely execute malware and affects code that was added to Vista under Microsoft's SDL, or secure development lifecycle, a rigorous process designed to prevent precisely these kinds of vulnerabilities. Microsoft has yet to offer the world a post mortem explaining how the code reviews mandated under program failed to spot a hole big enough to drive a truck through.

No doubt, Microsoft's security team is looking forward to that discussion about as much as their next root canal procedure. But at least they'll be able to take comfort in knowing that ASLR, which was also added under the SDL - and which remains half-baked in Apple's Mac OS X - is making it significantly harder for bad guys to exploit the vulnerability in the real world. ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.