Feeds

Researcher: No emergency patch for critical Windows bug

Redmond defenses neuter exploit code

Secure remote control for conventional and virtual desktops

A security researcher has downplayed the significance of publicly released attack code exploiting a critical vulnerability in newer versions of Windows, saying it isn't reliable enough to force Microsoft to issue an emergency patch.

The exploit, which on Monday was folded into the open-source Metasploit penetration testing kit, is at best successful only 50 percent of the time, said Dave Aitel, CTO of security firm Immunity. Given the burden of releasing out-of-schedule patches, Microsoft is unlikely to do so in this case.

"To move something like Microsoft you've got to have something major and this isn't quite it," Aitel, whose company released its own attack code two weeks ago. "It's going to be a lot of work to take the exploit where it is to something that works enough that they will do that."

The vulnerability, which surfaced three weeks ago, resides in file-sharing technology called SMB2, short for server message block version 2, which was first added to Windows Vista and later made its way into newer versions of the operating system. While the Metasploit exploit is sophisticated, it is frequently thwarted by a security measure known as ASLR. Short for address space layout randomization, it picks a different memory location to load system components each time the OS is started.

Without being able to predict where required code will be located, the Metasploit attack isn't reliable enough to prompt Microsoft to take the drastic step of releasing a patch outside of the regularly scheduled update cycle. The software giant adopted the patch routine to make life easier on system administrators by allowing them to plan and test updates before installing them on huge numbers of business critical machines.

The Metasploit exploit in many cases is able to get around ASLR by targeting memory locations that are predictable when Windows is running on VMware. But when the exploit targets the OS running directly on a computer, the success rate can be as low as 10 percent.

"You haven't heard of 1,000 machines getting owned with this and there's a reason for that," Aitel said. "I know it doesn't work on the ones we have here in the lab."

By contrast, the exploit released by Immunity, is much more reliable, Aitel said, "but we poured a ton of resources into it." Based on his review of the Metasploit code, he predicted it would take another two weeks for it to become fully reliable.

The SMB2 bug is significant because it can allow attackers to remotely execute malware and affects code that was added to Vista under Microsoft's SDL, or secure development lifecycle, a rigorous process designed to prevent precisely these kinds of vulnerabilities. Microsoft has yet to offer the world a post mortem explaining how the code reviews mandated under program failed to spot a hole big enough to drive a truck through.

No doubt, Microsoft's security team is looking forward to that discussion about as much as their next root canal procedure. But at least they'll be able to take comfort in knowing that ASLR, which was also added under the SDL - and which remains half-baked in Apple's Mac OS X - is making it significantly harder for bad guys to exploit the vulnerability in the real world. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?