Windows Secrets Newsletter • Issue 62 • 2005-10-13 • Circulation: over 400,000

By Ryan Russell

The last few years, I’ve found myself doing quality-assurance work for a vendor that sells software to large enterprise customers. That means, among other things, that I’m responsible for checking the updates and patches that go out to those customers.

I also find myself somewhat sympathetic to other vendors regarding how long it takes to prepare a good patch release.

I don’t think there’s a one-size-fits-all amount of time before a patch must be released. However, I can see that the 30 to 60 days that some vulnerability researchers call for is often on the low side.

To be sure, there’re some extreme cases that I find appalling. For example, David Litchfield claims Oracle took around two years to release a set of patches, which reportedly failed to actually fix many of the problems. I’ll take David’s word for it, since he found those issues in the first place. Against that standard, Microsoft doesn’t look too bad.

In fact, Microsoft has a very good reason to try to get its patches perfect the first time, every time. Two reasons, actually.

First, most of the advisories from security researchers are now released on Patch Tuesday. It used to be that Microsoft’s patch releases were irregularly scheduled, so responsible researchers wouldn’t know exactly when to put out their advisories. This would usually leave at least a few hours after a Microsoft announcement before a researcher’s advisory (sometimes with exploit details) was publicly posted. Now the details come out almost simultaneously with the patch.

Second, the patched binary files themselves are often the most useful roadmaps showing exactly where vulnerabilities lie.

Today’s tools easily decode patches

If a researcher can discover the exact vulnerability from the binary patch itself, the cat is out of the bag the moment the patch is released. This means Microsoft really only has one shot to get the patch right before the clock starts ticking. If the Redmond company makes an error that prevents people from immediately deploying the patch, the exploit authors get a head start.

It turns out that they don’t need much of a lead. The technique of comparing an old binary with the patched one to discover the differences must be as old as patches themselves.

Several years ago, I used such a technique myself when Microsoft released patches for vulnerabilities they’d discovered in-house. I needed to write an IDS (intrusion detection system) rule to catch exploitation attempts. The only place to see the problem was in the patch file itself.

In my case, I was doing it by hand, and it was painfully tedious. Nowadays, there are tools that make this kind of work a snap. These utilities include BinDiff by Halvar Flake and Process Stalker by Pedram Amini.

Halvar even released a Flash movie recently, in which he demonstrates how he found the vulnerability that’s fixed by MS05-025. It takes him 20 minutes.

How often does Microsoft blow it?

I’m one of the moderators of the PatchManagement.org mailing list. As such, I get to see just how often people have trouble with Microsoft patches.

To be completely fair, Microsoft is not at all alone in having problems, and I’d tend to rate them better than most. In the recent past, there have been discussion threads regarding patch woes with Adobe, McAfee, and Cisco. But most of the discussion is about Microsoft patches, probably because that’s the core of the community that’s formed.

In August 2005, there was a widely reported problem. Several of the patches would not install, depending on exactly how and where you downloaded them.

Turns out that some of the uploads to Microsoft’s various distribution points didn’t succeed. The patches, which were IE updates, were essentially corrupt. The digital signatures didn’t verify, so servers didn’t even try to install the corrupt patches, which is a good thing. The bad thing is that some patch-installation mechanisms were temporarily broken. Meanwhile, anyone who wanted to write an exploit could find a good copy of the patch and start their work.

It wasn’t as bad as it might have been. Both the Microsoft Update and Windows Update download locations worked. This meant home users typically could still get the patch fine, and knowledgeable admins still did have a place to could go to find a good copy. But not all of them did.

Only five days ’til the worm turns

That’s the same week Zotob (and its friends) came out. You remember those worms, right? They’re the ones that started crashing computers at large news agencies, including CNN, ABC, and the New York Times. Lo and behold, these worms became big news because of that. It took a scant 5 days after Aug. 9 — which was Patch Tuesday — to the release of Zotob.A on August 14.

The news agencies didn’t start reporting on the worm in a big way until a couple of days after that. That’s because the copycat worms that came out a few days after Zotob had bugs that caused crashes. That’s right — those same news agencies had probably been riddled with Zotob all along but didn’t know it because it was a relatively well-behaved critter. It wasn’t until the variants, which had the nasty habit of crashing things, came along that they noticed, because then the on-air talent couldn’t compute.

I hope no one reading this newsletter has to have badly written malware infect them before they notice a problem. But I digress.

Which patch will spawn the worst worm?

It looks like everyone’s favorite candidate this month is MS05-051. This patch fixes a very similar set of vulnerabilities as MS05-039, the August 2005 bulletin that generated Zotob. One difference this time is that XP and Windows Server 2003 don’t run some of the vulnerable services by default.

This means that when the inevitable worm is released, you can expect a lot of infected Windows 2000 machines. In theory, XP SP0 will have a large share of problems, too. Can you really be using XP these days without at least installing SP2?

A year ago, Kevin Mitnick (coauthor of The Art of Intrusion) and I did a study for USA Today. We connected some unprotected XP (and other) machines to the Internet and watched unpatched XP boxes get owned in as little as 4 minutes.

Granted, you can do hotfixes and such and maybe get by, but it’s difficult to imagine not having XP SP2 be your firm, minimal baseline. Are any readers getting by with less than SP2 on XP? I’d be curious to hear about it. [Editor's Note: Submit tips using our contact page.]

Please put MS05-051 on your fast track to install. But that’s not the only one. MS05-050 and MS05-052 are also rated “Critical.” Note that MS05-052 affects IE, for those of you who use Microsoft’s browser.

There are many spammers, phishers, spyware authors, and other general scum who are dying to have a working exploit for the critical holes. They badly want you for your identity and your financial information and to run their botnets on your CPU. They’re often willing to pay other black hats cold cash in exchange for their exploits to be quietly installed on your PCs.

The coming days will show us just how easy these holes will be for the bad guys to take advantage of. For now, assume that’s it’s very practical, and don’t wait to prepare yourself.

Ryan Russell is quality assurance manager at BigFix Inc., a configuration management company. He moderated the vuln-dev mailing list for three years under the alias “Blue Boar.” He was the lead author of Hack-Proofing Your Network, 2nd Ed., and the technical editor of the Stealing the Network book series.