Windows users indifferent to Microsoft patch alarm, says researcher
Users treated October's emergency patch like other fixes, says Qualys
Computerworld - When Microsoft Corp. issued an emergency patch for a critical Windows bug six weeks ago, it warned that attacks were in progress and told users to patch immediately.
The message didn't sink in, a security company claimed today.
Based on scans of between 200,000 and 300,000 Windows PCs owned by its customers, Qualys Inc. concluded that the patching pace for the October update -- which Microsoft released out of cycle, or outside its normal monthly schedule -- was similar to the rate at which users fixed flaws that the company disclosed several weeks later on its usual "Patch Tuesday."
"When Microsoft releases a patch out of cycle, we tend to think, 'Wow, why are they doing this? There must be a reason,'" said Wolfgang Kandek, Qualys' chief technology officer. "But it doesn't look like people pick up on that."
Over a six-week span, Qualys tallied the machines vulnerable to the MS08-067 vulnerability Microsoft patched off-schedule in October and counted the PCs vulnerable to a pair of patches released on Nov. 11, tagged MS08-068 and MS08-069. "We counted them, and normalized them against the scan numbers," said Kandek.
The result was surprising. "While we saw reductions in the number of [vulnerability] occurrence found every week, they are fairly even and in line with normal patching distributions we have seen before," said Kandek.
Only in the past week or so did Qualys' data show a sudden drop in the number of machines not yet patched with MS08-067.
Kandek had a ready explanation. "We saw it move [down] when Microsoft and Symantec and Trend Micro said last week, 'We found a worm, here it is and it's spreading,'" he said, referring to the reports this week and last week of a worm, dubbed Conficker.a by Microsoft and Downadup by Symantec, that was aggressively exploiting the MS08-067 vulnerability.
Monday, Trend Micro's researchers said that the worm was a key component in the buildup of a massive botnet and had already hijacked half a million machines.
So even though Microsoft hit the alarm button for MS08-067, it wasn't until news broke about the Conficker.a worm that users began applying the patch at a higher-than-usual rate, Kandek concluded.
Six weeks after it released the emergency fix, Qualys' data indicated that the number of unpatched PCs had been reduced by about 70%. "The number [of unpatched systems] is down, but 70% -- that's still bad," said Kandek, considering that Microsoft tagged the update as so critical it departed from its usual schedule, something it has not done since April 2007.
"We [wanted] to see how Microsoft customers apply these patches and if they pay special attention to the highly critical out-of-band vulnerabilities," Kandek said. "Unfortunately, that does not seem to be the case."
MS08-067, which patches a bug in the service Windows uses to connect to file and print servers, can be downloaded via Windows Update, Microsoft's default update service.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts