Slashdot Mirror
Microsoft Taking Longer to Fix Flaws
An anonymous reader writes "A look back at the last three years of security patches from Microsoft shows Redmond is taking at least 25 percent longer to issue patches for "critical" vulnerabilities, now averaging around 135 days to issue a fix. The exception appears to be with "full disclosure" flaws, for which Redmond issued fixes in an average of 46 days last year."
Seems as though the reason stems from the fact that Microsoft actually has to make sure their patches are compatible with the rest of the things they support. As they support more and more hard and software, the total can only go up.
The most interesting result of Security Fix's study is that Microsoft took longer to fix a problem if the researcher waited to disclose the problem until after Microsoft published the patch.
I'd like to know if the time to issue a fix also depends on existing exploits, i.e. is Microsoft faster if there is already an exploit out there. If yes, than it seems obvious that Microsoft does not really put as much afford into fixing bugs as they claim, they're "motivated" by public pressure.
One explanation for additional delay in case of a not yet disclosed or not yet exploited problem may be more thorough testing, so it may not even be a bad thing. But I'm afraid that the delay is not really "in the best of the customers", more in the best of Microsoft. I have no prove, but it seems to be the general company policy.
Chriss
--
memomo.net - brush up your German, French, Spanish or Italian - online and free
memomo: free web based language trainer DE-EN-ES-FR-IT
In the Linux world, the deployment of a bug fix and discovery of any potential bugs is part of the testing cycle. So you get a quick turn around time when a bug is reported.
.. whatever it takes to make sure it is tested is a GOOD thing. I don't want to be their beta tester :)
When Microsoft has to issue a bug fix (and all jokes aside about not testing), I am sure they have a team devoted to testing it, then it has to get sent to all internal Microsoft employees and tested, and then probably even has some initial customer testing with the bigger companies to make sure nothing breaks, and then finally gets released to the public.
Hopefully 165 or 365 days
Focusing on the exploits or not, 46 days is a long time to wait for a critical fix.
While it is certainly interesting (if true) that Microsoft takes longer to release patches with no known exploits roaming around, I would find it far more interesting to see which causes more harm: the longer patch times or the full disclosure.
Just because Microsoft releases a patch quicker when full disclosure is used doesn't mean this results in less harm to users. It might take Microsoft 200 days to release a patch, but if the only people who know about the bug are the researchers who discovered it and Microsoft, then the end result is that little harm was done to the users.
If, however, an easily understandable exploit is posted before Microsoft has fixed the bug, those 45 days might be a lot more dangerous for those users than the 200 days in the previous example.
Of course, it's very difficult to know if the security researchers who discovered the bug are the only ones with knowledge of that bug. Could other people know about it and be actively using it to compromise machines? Maybe. But I would really like to see some data on this.
I suspect that the vast majority of major worms and viruses take advantage of well known exploits published on the Internet by usually well meaning security researchers. Certainly all of the major worms I can think of off the top of my head follow this pattern. (MYTOB, LOVGATE, NETSKY, SASSER, ZAFI, SOBER, BAGEL, etc.)
If so, people really are safer when the exploit is not published before Microsoft releases a patch despite the significant lag time for those fixes.
So I guess which approach you take depends on your goal. If your goal is the glory of a 0-day exploit, then post away. But if your goal is the security of the end user, maybe you should keep it to yourself for the time being.
when you're accountable to that many customers with so many "supported" configurations, it takes a while to test. They don't have the luxury of most linux distro's where if it breaks some obscure program they can go "whupps, well, tell the author to write a fix for his app".
For the love of God, please learn to spell "ridiculous"!!!
Assuming that the more important repairs are done in under thirty days,
I'm willing to overlook the 365 day fixes that push the average way up.
Is it a day?
Is it a week?
Is it a month?
Doesn't Microsoft have enough money to maintain images of different configurations just for such testing?
Doesn't Microsoft have the people who could automate such testing?
Is the problem that they don't have enough money? Or that they don't have people who are smart enough? Or that they just aren't doing it?
The timeframe doesn't seem entirely unreasonable. When you think that they are releasing a patch which will be automatically downloaded and installed on literally tens of millions of computers, most of which without any system administrator to aid in the process.
That is a daunting task, and I can imagine theres a very lengthy process a patch must go through.
To Microsofts credit, I can hardly remember a time that a patch was released which cuased any major problems, which in itself is a great achievement given the amazing variety of hardware and software the users may have. There was of course alot of hype over compatibility issues in SP2, but to the best of my knowledge any actual issues were understood ahead of time and due to compromises that were made intentionally for one reason or another.
Big ones, small ones, some as big as yer 'ead!
Give 'em a twist, a flick o' the wrist...
when you're accountable to that many customers
When who's accountable? The disclaimer included with the last MS security update I downloaded read as follows:
Now, unless I misunderstood, it's telling me that if I install said security patch, and it breaks something, I can't hold MS accountable.
Slackware
A common argument of those who oppose full disclosure is that it does harm by allowing the development of worms, and provides infection vectors for Spyware. I personally think the widespread worms are a good thing. The act like wildfire clearing the underbrush of vulnerable machines.
What really concerns me is not some 14 year kid in Bulgaria playing "my botnet is bigger than yours" games. I'm concerned about hostile governments, terrorist groups, and organized criminals who already have a stable of zero day holes to attack my company's systems. These are the threats that keep corporate and government security teams awake at night. All the piddly little public nuisances are just ploys to get funding.
Yesterday, eEye released information about a Windows hole that they reported over 5 months ago. The WMF hole was known to Microsoft long ago, and has existed for YEARS! Does anyone really believe that the REAL bad guys don't have the knowledge to get inside any (at at least very nearly any) company in the world. The US military is getting hacked for God's sake.
I say full disclosure now. It won't make us less secure, it will only appear to.
-SHP
For the love of God, please learn to spell "ridiculous"!!!
Now, unless I misunderstood, it's telling me that if I install said security patch, and it breaks something, I can't hold MS accountable.
You may or may not be able to hold them accountable in court, but third party adjudication is not the only form of accountability.
If Microsoft didn't bother to test their patches carefully they'd risk upsetting their corporate customers, and hence their bottom line.
Why? Because the black hat community is very, very nice to MS.
I've never met a truly destructive worm or trojan. I don't mean one that disabled systems as a side effect of its operation. I mean one specifically designed to destroy data, and/or BIOS/CMOS/anything flashable.
A 4 month patch cycle. I imagine that if North Korea, or whoever felt angry about the global economy, decided to try and do something devestating that they could easily prepare some kind of trojan payload that would install itself, replicate for a week or so, and then destroy the system in question. Blow away the BIOS (won't be determined until a reboot), blow away the partition table, and then start writing loads of garbage all over the disk.
Such a worm would break MS. MS execs would be brought before a congressional hearing.
That is, after banks, airlines, and major companies managed to rebuild some kind of IT infrastructure.
MS is very luck that no black hats have decided to do such a thing. I guess its most likely because no one wants to bring THAT kind of heat down upon themselves.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
"I guess it all depends on how serious the flaw is."
Or how much press they're getting for not having one.
Let's say MS releases a patch that ends up causing major problems for mission critical systems at a nonzero number of Fortune 500 companies. The next time those companies are looking at major systems overhauls, do you think they're going to seriously consider MS products?
Good point. Similarly, Let's say MS releases a product that ends up causing major problems for mission critical systems at nearly every Fortune 500 company, a product that requires them to spend exorbitant amounts of money and resources on keeping the systems free of malware, which occasionally gets through anyway, wreaking havoc on productivity. The next time those companies are looking at major systems overhauls, do you think they're going to seriously consider MS products?
Oh, wait...
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
This would be akin to having the anology of cars without modern safety features. "Personally, I have NEVER had a serious injury while driving any car because I take simple preventative measures like buying seat belts, safety glass, and air bags." The question one should be asking is why does the user have to buy "seat belts, safety glass, and air bags" for their computer in the first place?? Shouldn't these things be standard features? Turning around responsiblity to the user is allowing MS off the hook. Users are using Windows as designed and getting sometimes serious malfunctions. It would be one thing if people were abusing their machines and breaking them. It is something else to be normally surfing the internet, reading email, or doing any other nominal activity and hitting a serious problem that leaves their system bare to the hackers. This is squarely Microsoft's problem not the users!!
I'm tired of this kind of applogetic excusing for Microsoft. As much as people want to blame the users, its still all in MS's lap since many of the problems stem from software doing things that it should never be allowed to do in the first place. AV software, hardware and software firewalls, malware scanners...its all a hack to stop users from breaking their machines doing normal operations because MS won't or can't engineer a system that disallows it.
Years of experience on other systems have shown that computers are complex machines with complex interactions all of which are prone to error and worst exploit if not carefully designed. On the other hand Microsoft sold most of the world on the promise that Windows is as easy to use as a VCR and requires just as much maintaince and look at where we are. We have to throw more and more money and time into work arounds while MS takes longer and longer to fix up things. Why aren't more people asking why does Windows work this way?
We're dealing with a number of different dates, some of which are often months or years apart:
Somehow, being a political movement / cult, MS becomes exempt from the rules of a normal business and from what customers expect. No other device or appliance has had even a fraction of the defects as MS' without going through a major product recall. Our dear Chairman Bill will go down in history as the man that made bad engineering acceptible aka the Microsoft Effect
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
You mean they will upset the companies IT department. I hardly think that would trouble management that much.
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft