know the flaws. beat
the clock. defend the
enterprise.
|
|
|
Just In Time: Microsoft's Time to Exploit 3 Download PDF September - December 2005 infectionvectors.com December 2005
Overview
This report continues the story of Microsoft-product-based vectors in 2005; the “Time to Exploit” series consists of two previous parts:
Time to Exploit 1: January through April 2005 Time to Exploit 2: May through August 2005
Part three examines the fallout from the Zotob worm (released right after the notification for a security flaw in August) and the malcode associated with “0-day” flaws in Internet Explorer.
Second Half Blues
After a relatively quiet first half of the year, Microsoft was hit with two noisy problems in the latter part of 2005. Right after the release of part two of this document, the Zotob worm garnered media attention. This worm, a cousin to the Mytob series of worms distributed throughout 2005, was released four days after Microsoft’s bulletin announcing the flaw in Windows 2000’s Plug and Play service. Although infection numbers have not been proven to be especially large, the high profile infections that were verified (CNN, etc.) made for a lot of press coverage.
In November, Internet Explorer found itself in the crosshairs of security analysts yet again a DoS javascript flaw from the summer was redrafted to allow for remote code execution.
The associated Proof of Concept and malware code for Microsoft vulnerabilities in 2005 is below:
As with the previous installation, there is always a danger that the worst worm of Internet history will be deployed right after the publication of the report. Except for the malware associated with the earliest and latest bulletins, 2005 saw relatively few spikes in worms. Even those that did exist were rather localized – Zotob, a worm that only affected Windows 2000 systems (an OS that is now over 5 years old in production), did the most damage in terms of broad infectors. Email-based attacks such as the very successful Sober.X worm did not take advantage of operating system or application flaws to spread.
Please note that this report in no way attempts to correlate the number of bulletins that turn into worms as a measure of an operating system’s security.
Over half of the bulletins released did not have correlating public proof-of-concept code, and more than that had no corresponding malware. Certainly, there is still a need to patch vulnerable systems as fast as prudently possible as malware that was released hit the streets very quickly. Of the malware in circulation:
Using tables like the above to come to any serious conclusion, however, is ridiculous. By combining all of the malware and averaging the days to exploit, one would have to start with and assumption that all malware coders began working on applications as soon as they heard of a flaw and did not stop until something was produced. Furthermore, writing a worm like Dasher throws the entire “averaging” system off in favor of Microsoft. Arbitrarily removing certain “inconsequential” or outlying examples skews the table in favor of the anti-Microsoft zealots. There is no sense in trying to make an overarching conclusion about how well Microsoft is doing based on when malcode is released.
With that said, the time to exploit table could be of research value, especially when compared to the release cycle of other operating systems. In addition, it would appear to be a good year for Microsoft operating systems in terms of severe network-based malware outbreaks, which were extremely limited.
Based on the popularity of the “time to exploit” research, this report is likely to be a recurring feature in 2006. Please check with infectionvectors.com for updates. |
Copyright Ó 2005 infectionvectors.com. All rights reserved.
