Windows users patch fast when zero-day hype heats up

Computerworld - It's the publicity around zero-day bugs that drive Windows users to patch their software quickly, not the fact that Microsoft sounds the alarm by issuing an emergency update, a researcher said today.

Windows users rush to patch whenever a zero-day vulnerability is involved, even when Microsoft doesn't deliver the fix in an out-of-band update, said Wolfgang Kandek, chief technology officer at Qualys, a California-based security risk and compliance management provider.

Kandek analyzed data acquired from several hundred thousand PCs that Qualys monitors for its customers, and concluded that the existence of a zero-day bug -- a vulnerability for which exploit code has gone public before a fix is ready -- is the driver for faster patching. He found that the patching speed of two Microsoft updates that addressed zero-days in Internet Explorer were nearly identical, even though one had been released as part of the company's standard Patch Tuesday, and the other was issued as an out-of-band update.

According to Kandek, MS09-072, a December 2009 Patch Tuesday update that fixed five flaws in IE, including one zero-day, reached "half-life" in 10 days. Qualys defines "half-life" as the point where 50% of the machines have been patched. Meanwhile, MS10-002, a January 2010 patch that Microsoft rushed out the door ahead of schedule to fix an IE zero-day, made it to the half-life mark in nine days.

Both zero-day vulnerabilities were widely reported on the Internet, including on Computerworld.com, although the January out-of-band update was covered more widely, since it had been involved in attacks against Google, Adobe and other major technology companies.

"This tells me that media coverage is what helps," said Kandek. "While [the media] covers the usual Patch Tuesday updates, it doesn't come close to the attention a zero-day receives."

Kandek speculated that publicity may prompt network administrators to put shoulders to the wheel because of pressure from managers who had seen reports of the zero-day, and wanted fixes pronto.

The two zero-day fixes reached half-life about 36% faster than operating system-level updates overall, said Kandek. Last year, Qualys calculated the average half-life of those updates as 15 days.

And they were applied even faster than a benchmark update Kandek selected, MS10-001, the year's first Patch Tuesday release. MS10-001 patched just one vulnerability, which was rated "critical" only for Windows 2000. For all other editions of Windows, the bug was ranked as "low," the least dangerous of the company's four-step threat scoring system.

At 21, the half-life of MS10-001 was more than double that of either zero-day patch.

Although an out-of-band update may not be applied any faster than a "standard" Patch Tuesday zero-day fix, the fact that Microsoft accelerates the former means that users are protected sooner than if the company waited until the next round of monthly updates. If Microsoft had delayed MS10-002 until its intended release date of Feb. 9, it would have taken until Feb. 18 before approximately 50% of all PCs were patched. As it was, the 50% mark was reached on Jan. 30, nearly three weeks sooner.

Windows users patched two IE zero-day bugs, one issued as a rush update, one not, at about the same speed. Credit: Qualys