Slashdot Mirror
Windows Update Can Hurt Security
An anonymous reader writes "Researchers at Carnegie Mellon University have shown that given a buggy program with an unknown vulnerability, and a patch, it is possible automatically to create an exploit for unpatched systems. They demonstrate this by showing automatic patch-based exploit generation for several Windows vulnerabilities and patches can be achieved within a few minutes of when a patch is first released. From the article: 'One important security implication is that current patch distribution schemes which stagger patch distribution over long time periods, such as Windows Update... can detract from overall security, and should be redesigned.' The full paper is available as PDF, and will appear at the IEEE Security and Privacy Symposium in May."
Microsoft has cautioned its enterprise customers by responding with a white paper that finds security and profits to be independent variables. The widely criticized paper uses Microsoft's own software history as a model business thriving in this manner.
...
Seriously, a reason that the consumer needs Microsoft more to bail them out? I couldn't think of better news for Microsoft's future
You are damned either way. The only way to avoid complete damnation from security vulnerabilities is to run a large number of different operating systems, but then you are damned to live a life in complete confusion about system maintenance instead.
The onion principle is a general security term that has been defined a long time ago, but the fact that we are all online in some way or another all the time means that the onion is rotten.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
There is no good solution to this problem -- that fixing something makes it easier to find old problems. At some point, users need to be responsible enough to apply updates.
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
Profitability is key, not security. Think of sysadmins as janitors. We pay you to wipe up the mess. It's not worth our while to invest in systems that don't create a mess as long as janitors are cheap enough to come with their electronic mops and buckets.
And you are.
Sorry.
... patch based security is also the model linux uses (as far as I understand).
Furthermore, for Linux access to the unpatched code is also easy to obtain.
Somebody please correct me if I'm mistaken.
Tie two birds together: although they have four wings, they cannot fly. (The blind man)
"Alternatives"
Show me a non-Windows OS, and I'll show you a huge security hole in your network security.
Three are risks in everything we do... or don't do. No big surprise. But honestly... trying to say that updating your OS is bad security? That's a huge stretch, even for Slashdot.
Couldn't this process (modified of course) do the same thing to any update for any software at all?
How exactly is this news? I mean, I should update my software when there's a new patch anyway, but now that THIS has been developed I...need to update my software when there's a new patch... Automating it is a pretty neat trick, and it pretty much destroys any argument for security through obscurity, since it means you couldn't patch any hole to maintain the obscurity, but it's not like security through obscurity in the computer software realm has that amazing a track record in any case.
If you have a patch, you can diff the original and the patched file and find out what got fixed. No secret here.
So how can you close the gap between fixing and exploiting? That's nothing MS could fix. You have to. Patch early, patch often.
If any message is contained here, it's that if there is a patch out and you didn't use it, you're extremely vulnerable. That's pretty much it, nothing really new here.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
1) Isn't this an old problem? Not only is this old, but it applies to any computer system, so to single out Windows Update seems naive (as others have said).
2) I think we are forgetting that the exploits still need to be distributed, and the article refers to worms, but how is this different from any other worm/virus?
Smarter viruses will attack weaknesses that are yet widely known or patched, so those that use exploits based on public patches are 1) stupider and 2) more predictable.
So this is less of an "update how" problem, and rather more of an antivirus problem. The previous might be impossible to solve, but the latter we have solutions for.
And what happens when someone who has downloaded the encrypted patch has his system compromised because you're waiting for some idiot who hasn't to do so before you'll release the key that unlocks it? In a worst case scenario, you could end up facing a class action suit for not enabling the patch. I don't know if such a suit could be successful, but I'd bet someone would try it. At present, if someone has failed to update his system with the latest patch, it's not Microsoft's fault. Under this system, if Microsoft was refusing to actually make the patch available to one until others have it, that poses ethical and legal questions. I'm not a lawyer, and can't say what the legal answer would be, but I'm sure the question would arise.
Distribute an encrypted patch, and then once all clients have downloaded it reveal the key, which is short and can be sent in a single network packet.
Which shifts the problem from distributing the update to distributing the key.
Of course this does have another advantage: Distributing the encrypted update also distributes notification that there WILL be a key, and can tell the users when. Then it becomes a race to get the key and apply the patch before the bad guys can get the key, generate, and deploy an exploit.
And the downside: The bad guys also know the patch is coming, and when. So they can use their existing botnet(s) to grab a key as soon as possible, then (or simultaneously) DDOS the key distribution mechanism while they generate and deploy the exploit. This makes things WORSE: A much larger fraction of the machines are vulnerable when the exploit deploys.
Still worse: If the bad guys crack the encryption, or manage to break in and grab the key early, they get to automatically generate and deploy an exploit while NOBODY has the fix. Oops!
Ditto even if they don't crack the patch - but the patche exposes that a vulnerability exists and perhaps what module has it, and they find and exploit the vulnerability before the key deploys.
= = = =
In a battle between weapons and armor, weapons eventually win.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
You don't have any e-mail addresses? Where do you think most spam comes from?
Windows' crap security affects everyone.
Think of sysadmins as janitors. We pay you to wipe up the mess. It's not worth our while to invest in systems that don't create a mess as long as janitors are cheap enough to come with their electronic mops and buckets.
That works for small messes.
It doesn't work for somebody getting hold of the company's trade secrets, client list, bidding information, road map, and headhuntable employee names and pay scale.
It doesn't work for somebody cracking the information on the company accounts and transferring the cash reserves to themselves via untraceable paths.
It doesn't work for somebody destroying or corrupting the IT infrastructure - especially the databases - and taking the company out of business for days or forever, causing key employees to quit or be fired, etc.
It doesn't work for somebody corrupting industrial process control infrastructure and literally destroy plants and kill employees, or cause the company to build and ship defective products.
I could go on.
Cleaning up IT graffiti is one thing. Cleaning up IT nuclear strikes is quite another.
IMHO any corporate IT exec who treats malware like graffiti, rather than an early warning of something more serious, is negligent in his fiduciary duty to the shareholders and perhaps criminally negligent in his duty to protect the lives and health of the employees. (Pity that most of 'em do treat the threat in this way. B-( )
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
What's important about this is that it can quickly and automatically generate exploits given only OBJECT code - faster even than a good programmer could do it from source.
This negates the claim that hiding the source code increases security.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
While Apple may be more secure, until you get 50% market share your not going to get 50% of the effort put into attacking you.
IranAir Flight 655 never forget!
I think you mean "__________ ___________ Can Hurt Security". There's nothing Windows-specific about this approach. It would work just as well with apt-get.
The opinions stated herein do not necessarily represent those of anybody at all. Deal with it.