Malware authors exploit Microsoft's monthly cycles

Malware authors exploit Microsoft's monthly cycles

Summary: The creators of the Bofra worm may have timed the release of their worm to throw Microsoft's monthly patch cycle into disarray, say security experts

TOPICS: Security

The creators of the Bofra worm, which exploits the recently discovered IFRAME vulnerability in Internet Explorer, may have timed the release of their worm to throw Microsoft's monthly patch cycle into disarray, say security experts.

In its latest monthly update, Microsoft was not been able to fix a serious vulnerability in Internet Explorer because the flaw was discovered only a few days before the company’s regular update was due. To make matters worse a worm exploiting the flaw was released on Monday, leaving the software giant without any option but to ignore the problem – for now.

Sean Richmond, senior technology consultant at Sophos Australia, told ZDNet UK sister site ZDNet Australia that it would have been impossible for Microsoft to create and test a reliable patch in four days – the time between the vulnerability being published and the date set for Microsoft's next patch.

"To release a stable patch for IE would be impossible [in that time] because they want to test it thoroughly before it goes out. The monthly patch cycle was designed to make it easier for system administrators to schedule their updates but a few days is just not enough time for Microsoft create and test a patch," said Richmond.

Ben English, security team leader at Microsoft Australia, told ZDNet UK sister site ZDNet Australia that Microsoft advocates a process of responsible disclosure and is "very keen" to discover any vulnerabilities before they are made public.

"The reasons are very obvious. We would not disclose any info about a vulnerability till we have mitigation in place. The worst scenario for us is that we release an update which has quality problems. We believe the downstream problems of releasing patches too quickly are even more serious than not putting in the quality that they deserve," said English.

English would not comment on whether Microsoft thought the timing of the worm -– and the vulnerability's disclosure –- was malicious but he said if the problem was serious enough the company would break its patch cycle to plug the gap.

"In terms of the timing I have no comment on whether there is malicious intent but in a sense it is academic because if this is a serious vulnerability and we have a patch available we will release it out of cycle," said English.

The IFRAME vulnerability and the Bofra worm appeared in the week leading up to the final release of Mozilla’s Firefox browser, which is unaffected by the worm and seen as the biggest threat to Microsoft’s dominance of the browser market for many years.

Munir Kotadia writes for ZDNet Australia. For more ZDNet Australia stories, click here.

Topic: Security

Munir Kotadia

About Munir Kotadia

Munir first became involved with online publishing in 1998 when he joined ZDNet UK and later moved into print publishing as Chief Reporter for IT Week, part of ZDNet UK, a weekly trade newspaper targeted at Enterprise IT managers. He later moved back into online publishing as Senior News Reporter for ZDNet UK.

Munir was recognised as Australia's Best Technology Columnist at the 5th Annual Sun Microsystems IT Journalism Awards 2007. In the previous year he was named Best News Journalist at the Consensus IT Writers Awards.

He no longer uses his Commodore 64.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


1 comment
Log in or register to join the discussion
  • Maybe if Microsoft were a little more conscientious about following standards and bodies of work that are not their own, and abandoned their embrace, extend and extinguish tactics, maybe the other kids in the sandbox would play nicer regarding them.

    So why doesnt IE support the hover psuedo class on anything but an anchor anyway?

    Same question.... Certainly with their financial mass and code secrecy they can certainly hire more people to find and extinguish their own software flaws. All of them :)

    What someone does with their hard earned discovery of Microsoft flaws is _their_ intellectual property and owes the big guy no quarter whatsoever.

    Maybe Microsoft can dish it out but cant take it