Comments on: Attack code comes on heels of Microsoft patches

Just a day after patches for vulnerabilities are released, code designed to exploit those weaknesses appears on Net.

[thedreaming]

interesting

Microsoft puts out security patches and almost overnight, we get the first attacks using those same patched security gaps.

<CONSPIRACY>
Did Microsoft find out about the expoit code from the wild and create patches for them so that when the attacks began they would be stopped before they began or did they manufacture the whole thing, the exploits, the patches, the media stories?
</CONSPIRACY>

OOPPS! Sorry about that, went into conspiracy mode again.

[cbarn]

Roadmaps

It could all be a conspiracy. ;-)

But conspiracies aside for the moment, one of the problems with security patches is that they provide a nicely packaged roadmap to a vulnerability. A cracker may not be able to determine how to effectively exploit a given vulnerability given nothing but its description. But with the patch in hand the cracker can see exactly what modules are affected, and by comparing to unpatched versions can even determine exactly what code has been changed (and is thus vulnerable pre-patch).

That's one reason why quickly applying a critical security patch is so important - even if there aren't exploits in the wild when the patch is released, the exploits can evolve VERY quickly to take advantage once the patch is out.

[thedreaming]

interesting

Microsoft puts out security patches and almost overnight, we get the first attacks using those same patched security gaps.

<CONSPIRACY>
Did Microsoft find out about the expoit code from the wild and create patches for them so that when the attacks began they would be stopped before they began or did they manufacture the whole thing, the exploits, the patches, the media stories?
</CONSPIRACY>

OOPPS! Sorry about that, went into conspiracy mode again.

[cbarn]

Roadmaps

It could all be a conspiracy. ;-)

But conspiracies aside for the moment, one of the problems with security patches is that they provide a nicely packaged roadmap to a vulnerability. A cracker may not be able to determine how to effectively exploit a given vulnerability given nothing but its description. But with the patch in hand the cracker can see exactly what modules are affected, and by comparing to unpatched versions can even determine exactly what code has been changed (and is thus vulnerable pre-patch).

That's one reason why quickly applying a critical security patch is so important - even if there aren't exploits in the wild when the patch is released, the exploits can evolve VERY quickly to take advantage once the patch is out.