I see Secunia quoted as saying "Failing to do so is playing Russian Roulette with your IT security ? it is only a question about time ? and luck ? when your system will be compromised."
Yes, patching is an important part of a defense-in-depth strategy, but considering the "stopping power" of certain mitigations, such as a disallowed-by-default Software Restriction Policy combined with a low-rights user account, they're getting a little carried away with the sweeping generalizations. Dramatic, but not accurate.
With the time frame for an exploit to become an inseparable part of a web malware exploitation kit shrinking, and with the average Internet user’s over-confidence in an antivirus scanner’s ability to detect and block exploits (Secunia: popular security suites failing to block exploits) it shouldn’t come as a surprise that Secunia’s recently released WorldMap shows a relatively high rate for insecure programs found on a single PC.
The WorldMap of patched and unpatched PCs is released prior to an updated version of Secunia’s Personal Software Inspector, with the latest version finally filling a niche left open potentially undermining the usefulness of the handy tool in general - measuring the exploitability of cross-browser plugins such as Adobe Flash Player, QuickTime, or Sun’s Java.
Let’s take a look at some of their stats.
North America is led by Cuba with 15 insecure programs on average, and with 4 insecure programs on average, Canada and Mexico lead the U.S which has 3 insecure applications installed per PC. However, Secunia’s emphasis on the big picture points out that there are at least 2.7 billion vulnerable programs installed in the U.S alone.
The fact that US based PC users have more than 2.7 billion vulnerable programs installed are shocking! And quite frankly I am very surprised, we had an idea it would be bad, but couldn’t imagine the enormous scope of this problem. And to make things even worse, the picture formed in the US is the same all over the world. PC users need to patch! They need to patch all their vulnerable programs and they need to do so as fast as possible after the patch has been issued from the vendor. Failing to do so is playing Russian Roulette with your IT security – it is only a question about time – and luck – when your system will be compromised.
South America is led by Guadeloupe with 12 insecure programs in average, San Marino with its 11 insecure programs on average leads Europe, and Yemen with 12 insecure programs on average tops Asia’s chart. These results should be considered as very conservative, with the real data itself much more disturbing if only all the Internet users in these countries were running the PSI.
Despite the fact that according to Secunia’s WorldMap there are countries like Burkina Faso with 20 insecure programs per PC, or Cuba with 15, it only takes a single unpatched application or a browser plugin in order for the cybercriminal to successfully exploit the host on-the-fly through a mix of popular exploits (Cybercriminals release Christmas themed web malware exploitation kit) embedded within a particular kit.
Prior to the official announcement of PSI 1.5, Secunia stated that “patching is more important than having an Anti-Virus program and a personal firewall.”
What do you think? Talkback.
