----- Original Message -----
Sent: Wednesday, March 29, 2006 8:39
PM
Subject: [Full-disclosure] Third party
patches, a matter of trust by n3td3v
Third party patches, a matter of trust by n3td3v
Why are third party patches a bad thing?
They force Microsoft to rush out a patch before
Q.A testing has been
fully completed in the time scale
Microsoft would have initially hoped.
Is it responsible for eEye to release a third party patch before
Microsoft?
No, its very bad because it confuses the consumer and brings up the issue
of trust
in the mind of the consumer. Once you start dangling multiple
vulnerability fixes infront of
consumer, it opens the door for malicious
hackers, script kids and phishers to compromise
security.
What do you mean "irresponsible"?
Yes, because the delivery of a third party patch cannot reach a world wide
audience if the
news of third party patch avaiability is only on that of
U-S based news media outlets.
Microsoft since service pack two have automatic update functionality on its
software, allowing
a patch to be delivered essentially to all of its
customers world wide, eEye just don't have that kind of reach available to
them.
How could a third party patch be used against people?
Script kids compromise systems, and then patch them with the third party
patch.
If the trend of third party patches continue, malicious users can play upto
the multiple patch sources available, and setup fraud scams to compromise a
user system with bogus patches, which have inserted malicious code. A lot of
the time the malicious code will have additional vulnerabilities attached. The
third party patch merely acts as a deliver system to socially engineer the
mind of the consumer. Once the consumer gets the idea of patches being
available from multiple sources, then thats where the problems will spiral out
of control, and that element of trust really comes into play.
Should Microsoft take legal action against third party patch developers
like eEye?
Yes, I think so. The idea of thrid party patches being released by big
companies like eEye is very irresponsible and offers a grave danger to the
public at large, by making the patch available to the worlds malicious users,
where then, the magnitude of the situation is blown up and makes the situation
more intense because fixes are being made available for 0-day before Microsoft
has had the chance to fully develop a secure realible patch and deliver it to
world wide customers.
Should Micorsoft release a patch for critical public 0-day before patch
tuesday?
Yes, and no. No, If it wasn't for eEye compromising security by forcing
Microsoft to push out a patch before
the required time frame, then there
would be no need to release a patch early. Yes, because since the WMF flaw,
third party developers are releasing patches and Microsoft must get ontop of
the trend before consumers start to trust third party sources in place of the
legitimate Micrsoft patch.
What can consumers do to protect themselves from third party patches?
Never download a third party patch, even if its from a "trusted" source.
Real patches will only ever come from Microsoft and the Automatic Update
functionaility on Microsoft products. Remember, Microsoft can offer you
support if their patch becomes faulty. If you download from a third party
source, your system may become corrupt with errors, or in the worst case
scenario, you may be victim to a malicious patch claming to fix a
vulnerability.
Should the industry get behind the idea of making third party patches an
unacceptable alternative to a Microsoft patch?
Yes. The future of security world wide depends on the industry not
recommending these patches, no matter how safe the patch may appear or if the
source can be trusted. The only real patch can be offered by Microsoft, and
the only people who really do know how to fix a vulnerability is Microsoft.
With the WMF flaw, many folks were shocked to see SANS etc recommending a
third party patch. This time around it seems to be different. The big players
are finally listening to folks like n3td3v and the grave dangers attached to
making the trend of third party patches for Microsoft products a bad pratice,
whcih shouldnt be encouraged under any circumstance. Sure, its healthy to
develop your own patch solutions in private for your own research and
development, but as soon as you offer that patch to the wild, then its surely
going to be picked up by malicious users and used against the consumer ten
times over before legitimate users can see or hear of your third party patch.
_______________________________________________
Full-Disclosure - We
believe in it.
Charter:
http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored
by Secunia - http://secunia.com/
Internal Virus Database is out-of-date.
Checked by AVG Free
Edition.
Version: 7.1.375 / Virus Database: 268.2.6/288 - Release Date:
22/03/2006
