Hype Helps Windows Users Patch Fast

It's the publicity around zero-day bugs that drive Windows users to patch their software quickly, not the fact that Microsoft sounds the alarm by issuing an emergency update, a researcher said today.

Windows users rush to patch whenever a zero-day vulnerability is involved, even when Microsoft doesn't deliver the fix in an out-of-band update, said Wolfgang Kandek, chief technology officer at Qualys, a California-based security risk and compliance management provider.

Kandek analyzed data acquired from several hundred thousand PCs that Qualys monitors for its customers, and concluded that the existence of a zero-day bug -- a vulnerability for which exploit code has gone public before a fix is ready -- is the driver for faster patching. He found that the patching speed of two Microsoft updates that addressed zero-days in Internet Explorer were nearly identical, even though one had been released as part of the company's standard Patch Tuesday, and the other was issued as an out-of-band update.

According to Kandek, MS09-072, a December 2009 Patch Tuesday update that fixed five flaws in IE, including one zero-day, reached "half-life" in 10 days. Qualys defines "half-life" as the point where 50% of the machines have been patched. Meanwhile, MS10-002, a January 2010 patch that Microsoft rushed out the door ahead of schedule to fix an IE zero-day, made it to the half-life mark in nine days.

Both zero-day vulnerabilities were widely reported on the Internet, including on Computerworld.com , although the January out-of-band update was covered more widely, since it had been involved in attacks against Google , Adobe and other major technology companies.

"This tells me that media coverage is what helps," said Kandek. "While [the media] covers the usual Patch Tuesday updates, it doesn't come close to the attention a zero-day receives."

Kandek speculated that publicity may prompt network administrators to put shoulders to the wheel because of pressure from managers who had seen reports of the zero-day, and wanted fixes pronto.

The two zero-day fixes reached half-life about 36% faster than operating system-level updates overall, said Kandek. Last year, Qualys calculated the average half-life of those updates as 15 days.

And they were applied even faster than a benchmark update Kandek selected, MS10-001, the year's first Patch Tuesday release. MS10-001 patched just one vulnerability, which was rated "critical" only for Windows 2000. For all other editions of Windows, the bug was ranked as "low," the least dangerous of the company's four-step threat scoring system.

At 21, the half-life of MS10-001 was more than double that of either zero-day patch.

Although an out-of-band update may not be applied any faster than a "standard" Patch Tuesday zero-day fix, the fact that Microsoft accelerates the former means that users are protected sooner than if the company waited until the next round of monthly updates. If Microsoft had delayed MS10-002 until its intended release date of Feb. 9, it would have taken until Feb. 18 before approximately 50% of all PCs were patched. As it was, the 50% mark was reached on Jan. 30, nearly three weeks sooner.

Qualys' numbers also show how lethargically many updates are deployed. And that's bad for business.

"Microsoft's exploitability index is only for 30 days," Kandek said, referring to the monthly index where Microsoft takes its best guess on how quickly a vulnerability will be used by hackers. "Microsoft's essentially saying that most of the vulnerabilities can be exploited after 30 days, that [attackers] could probably have exploits if they wanted them. They would like us to patch within 30 days as the minimum standard."

Reality, however, is different. Not only does it take some organizations longer than 30 days to patch, some never apply the updates Microsoft provides. "I don't understand why," Kandek admitted.

Qualys measures something it calls "persistence," which is the percentage of machines that are never patched against a specific vulnerability. By Qualys' scanning data, the percentage of unpatched PCs typically stabilizes at between 5% and 10%, even for the most critical vulnerabilities.

Four months after the MS09-072 update was released, for example, its persistence level is at 8%, right in the middle of the average range. The three-month old MS01-001, on the other hand, has a persistence level hovering between 20% to 30%, much higher than normal.

Coincidentally, Microsoft is slated to issue 2010's second out-of-band update later today. The cumulative update for IE will include a patch for a zero-day vulnerability that has been used by attackers for several weeks at the least.

Kandek's advice should come as no surprise: "Patch it out-of-band," he said.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld . Follow Gregg on Twitter at @gkeizer , or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@ix.netcom.com .

Read more about security in Computerworld's Security Knowledge Center.

Subscribe to the Security Watch Newsletter

Comments