Malware authors exploit Microsoft's monthly cycles

Summary:The creators of the Bofra worm may have timed the release of their worm to throw Microsoft's monthly patch cycle into disarray, say security experts

The creators of the Bofra worm, which exploits the recently discovered IFRAME vulnerability in Internet Explorer, may have timed the release of their worm to throw Microsoft's monthly patch cycle into disarray, say security experts.

In its latest monthly update, Microsoft was not been able to fix a serious vulnerability in Internet Explorer because the flaw was discovered only a few days before the company’s regular update was due. To make matters worse a worm exploiting the flaw was released on Monday, leaving the software giant without any option but to ignore the problem – for now.

Sean Richmond, senior technology consultant at Sophos Australia, told ZDNet UK sister site ZDNet Australia that it would have been impossible for Microsoft to create and test a reliable patch in four days – the time between the vulnerability being published and the date set for Microsoft's next patch.

"To release a stable patch for IE would be impossible [in that time] because they want to test it thoroughly before it goes out. The monthly patch cycle was designed to make it easier for system administrators to schedule their updates but a few days is just not enough time for Microsoft create and test a patch," said Richmond.

Ben English, security team leader at Microsoft Australia, told ZDNet UK sister site ZDNet Australia that Microsoft advocates a process of responsible disclosure and is "very keen" to discover any vulnerabilities before they are made public.

"The reasons are very obvious. We would not disclose any info about a vulnerability till we have mitigation in place. The worst scenario for us is that we release an update which has quality problems. We believe the downstream problems of releasing patches too quickly are even more serious than not putting in the quality that they deserve," said English.

English would not comment on whether Microsoft thought the timing of the worm -– and the vulnerability's disclosure –- was malicious but he said if the problem was serious enough the company would break its patch cycle to plug the gap.

"In terms of the timing I have no comment on whether there is malicious intent but in a sense it is academic because if this is a serious vulnerability and we have a patch available we will release it out of cycle," said English.

The IFRAME vulnerability and the Bofra worm appeared in the week leading up to the final release of Mozilla’s Firefox browser, which is unaffected by the worm and seen as the biggest threat to Microsoft’s dominance of the browser market for many years.

Munir Kotadia writes for ZDNet Australia. For more ZDNet Australia stories, click here.

Topics: Security


Munir first became involved with online publishing in 1998 when he joined ZDNet UK and later moved into print publishing as Chief Reporter for IT Week, part of ZDNet UK, a weekly trade newspaper targeted at Enterprise IT managers. He later moved back into online publishing as Senior News Reporter for ZDNet UK.Munir was recognised as Austr... Full Bio

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.