You might be familiar with the cliché that the cure can be worse than the disease. When it comes to patching software, Microsoft’s David Aucsmith now appears to be saying that the cure is frequently the cause of the disease.
Addressing the E-Crime Congress organized by Britain’s National Hi-Tech Crime Unit, Aucsmith – of Redmond’s Security business unit – was reported by the BBC to say that crackers are, essentially, lazy louts who wait for a security patch to be released and then reverse-engineer it to find the vulnerability. Unpatched systems then can be compromised. He cited the recent critical problem dubbed “ASN.1,” which was discovered in July 2003 but for which a patch wasn’t issued until last month. He said the first exploit of the vulnerability didn’t occur until three days after the patch was released.
Following his argument to its invariable conclusion, it would appear that the best course would be never to issue a patch at all. That way, the lazy crackers would have nothing to work with.
I’ll go along with the thought that most of today’s nefarious hackers (and they have brought into ill repute what was once a term of respect) are lazy. But I think they’re too lazy even to do a spot of reverse-engineering. All they need to do is to read the Microsoft Knowledgebase article detailing the extent and cause of the vulnerability to help them create an exploit by adapting someone else’s real hacking work.
The BBC also quoted Aucsmith as saying “We have never had vulnerabilities exploited before the patch was known.” But a few paragraphs later, the story reports that Aucsmith said he could only think of one instance when a vulnerability was exploited before a patch was available. There’s a long way from a categorical “none” to an admission of one and the actual truth, which is “at least a handful.”
His solution, by the way, wasn’t to stop issuing patches but for users to apply them more quickly so as to limit the window the lazy crackers have to do damage. All that’s left is for Aucsmith to tell us how to limit the damage ill-advised patches often do.
Tip of the week
Steve Ballmer is always good for a catchy line, but rarely one that NetWare stalwarts might agree with. But in telling Canada’s eChannelLine why Windows was the only viable operating system, he dismissed NetWare by saying “even Novell is trying to get off of the Novell platform and onto Linux.”
