- home
- reviews
- news
- downloads
- cnet tv
On BNET: Vote: How will Apple blow it?
- log in
- join CNET
- welcome,
- my profile
- log out

Year in Review: Bugs/flaws

Zero-day mania

Security experts coined the term "zero-day Wednesdays" this year, most appropriately.

Cybercrooks found that they could take advantage of Microsoft's monthly patch cycle by timing new attacks right after the software maker released its fixes. Microsoft's patch day is on the second Tuesday of each month, and the company doesn't break its cycle unless an attack has a widespread impact.

Flaws in Office applications especially are favored by the bad guys. Microsoft and security firms repeatedly this year have had to warn of new, small-scale attacks that exploited yet-to-be-plugged security holes in applications such as Word, PowerPoint and Excel.

Some of these hardly visible attacks are the most dangerous ones, particularly for businesses. Widespread worms, viruses or Trojan horses typically get caught by security tools. The small-scale attacks may go under the radar and expose organizations to spy incidents and other unwelcome intrusions. Most experts predict an increase in these inconspicuous attacks.

Microsoft did break its patch cycle twice this year, rushing out fixes for flaws that were being exploited to drop malicious software onto Windows PCs. These attacks targeted consumers and attempted to install spyware and remote-control tools on vulnerable systems when people visited a malicious Web site or clicked on a malicious link.

Critics of Microsoft's patch process provided temporary fixes on both occasions. Experts typically don't recommend these third-party fixes, but in an unusual move some did advise users to apply an unofficial patch developed by European programmer Ilfak Guilfanov for a Windows flaw that surfaced in late 2005 and was fixed by Microsoft on January 5.

Microsoft was not the only one hit by the zero-day blues. Other software makers, including Apple Computer, Oracle and Mozilla, also had to deal with public releases of flaws before they could provide their customers with a fix. Bug hunters repeatedly taunted software makers advocating "responsible disclosure" of vulnerabilities.

Malicious software that targets Mac OS X systems is rare and has been limited largely to proof-of-concept code, instead of actual attacks. However, Apple has had a rough year when it comes to security. Hackers are increasingly targeting the Mac, which experts have said is not impervious to attacks.

In February, a pair of worms that target Mac OS X were discovered, along with an easily exploitable, severe security flaw. The vulnerability exposed Mac users to risks that are more familiar to Windows owners: the installation of malicious code through a bad Web site or e-mail. Apple patched the flaw, but had to redo the patch twice because of installation problems.

Apple stirred controversy at Black Hat briefings this year when it critiqued two security researchers for saying Macs were vulnerable to Wi-Fi hijacks. Since then, however, Apple has twice released fixes for security flaws in its AirPort Wi-Fi system, which, if exploited, could allow Macs to be compromised by sending malicious packets over wireless networks.

Still, flaws in Microsoft's software appear to be the most popular to exploit. That's something experts predict might change with Windows Vista, which Microsoft has touted as the most secure version of Windows yet. Hackers may shift their focus to applications that run on the Windows desktop, such as instant-messaging programs and security tools.

--Joris Evers

2006 Highlights