Hi All! I had some time on my lunch break and a little time on breaks from class, so I decided to write my first post on security! With the emergence of Punxsutawney Phil, I was reminded of the movie “Groundhog Day”. You know, the one with Bill Murray stuck in an infinite loop of sheer madness, with some hard life lesson to learn before being released from his consistently failing cyclic redundancy check. (Sorry, had to make a bad pun there.)
That, in turn, got me to thinking about patches since yesterday was a patch/maintenance day in my favorite online time-waster. The process of patching (especially those annoying Windows updates) may make many feel as though managing patches for their computer has become their own little spot in Hell, where it seems as though every day they face the ugly fact that something – somewhere – needs to be updated. Some of you are probably reading this and thinking to yourself “Why?! What is the point?!” Well, for my first security related blog post, let’s explore this issue in a little more depth.
Let’s start with a definition of “patch.” At the most basic level, a patch is a piece of code that is designed to plug up a hole in another piece of code. This can be to fix a bug, sew up a vulnerability, or for various other reasons. A lot of software patches today are designed to protect you from exploits by hackers that leave gaping holes for backdoor access to your computer, however, some applications do a lot of bug patching – something you see a lot in the world of MMOs such as World of Warcraft. Regardless, it is safe to say that if you are getting a patch delivered to you via download, there is a problem with some software application that you have installed – one that either leaves you vulnerable to attack or has the risk of making your system unstable or your programs not behave appropriately.
So why are patches so frequent? Well, the best answer is that this Earth is populated with humans, and humans are both fallible and incredibly resourceful. On the side of the fallible, you have developers. While I would like to be able to write on this blog that all developers are the coding equivalent of Albert Einstein and Stephen Hawking’s lovechild, they really aren’t. We’re human and we make mistakes, and when we write a piece of code, we may not catch every possibility for exploitation. Those developers (and or code testers) who are more security minded may make a valiant attempt at processes such as software fuzzing or any other number of vulnerability testing efforts. However, the truth is that developers and testers are as varied as any other subsection of society. Some find security testing a fun game, others a chore that they avoid at all costs. So, because there may be any number of possibilities that they have not dreamed up, or due to sheer lack of interest in testing for exploits, developers are fallible and will miss opportunities to protect your system before the product ships.
Similarly, real hackers (I use the emphasis as so many today are really script-kiddies rather than true hackers) are resourceful. There is a lot of information available on the internet and with proper research, exploits can be found in almost any program out there. The number of possible avenues to exploit a given program are numerous, and as such, with some time an effort, almost anything can be achieved. The best example of this today is the Conficker Virus, which has infiltrated millions of computers worldwide, stumped researchers for a long time. Each step that was taken to defeat the virus was met with a mutation that made the virus that much more “deadly.” The estimated combined computing power of the Conficker Virus is now enough that had it ever be activated and used for a true attack, it could have taken an entire country off the grid. A good article with all of this information and more about this specific virus can be found here in the Conficker Working Group’s Lessons Learned report. However, as this article points out, while the virus has been beaten – it is not gone. This virus is just one good example of how the ingenuity of hackers will forever keep those working in security one step behind, guessing what the next move will be. The only hope lies in convincing end-users that they need to be proactive in the way they handle their own patching. This includes installing updates and restarting when needed, as well as safe net browsing and usage behaviors.
The biggest problem with beating the Conficker Virus was that even when researchers had a good way for defeating it, the laxity with which so many patch their computers left holes open for too long. By the time sufficient numbers of computers had managed to update and patch holes in their systems that would prevent the virus from communicating with its controller, the virus had already mutated to take advantage of a different exploitable flaw on the system. In fact, the virus originally appeared on the scene when it took advantage of security flaws from a November 2008 Microsoft patch which end-users had failed to install (factoid taken from the Lessons Learned report above). Had users worldwide been adequate in their maintenance of their own systems, Conficker may have been stopped (or at least slowed down) a lot sooner. In essence, end-users tend to be the Groundhogs delivering their own endless Winter.
So, what should you do to protect yourself? A quick glance over at the Wikipedia article gives a good starting point. Microsoft has traditionally (for as long as this author can remember) released all of their patches on the Second Tuesday of every month. This means two things. First, you can set your clock by the release of Microsoft’s patches. Second, hackers know the best time to exploit your computer – right after the patch comes out. As the Wikipedia article points out, the day after “Patch Tuesday” has come to be known as exploit Wednesday. Banking on the fact that users will be slow about updating their machines with the latest patches, virus writers are able to tailor their viruses to the exploits fixed by Microsoft’s patch. If you take two weeks to download and install the latest update, the virus writer then has 14 days to access your computer and prevent the patch from doing its job when you finally do install. If he misses that window, there’s always next month, when he or she is banking on you taking two weeks again. As you can see, patches (if not installed immediately upon release) ultimately become a weapon to be used against the end-user. That is why it is imperative that you check for patches frequently, and install and reboot your system as soon as they are available.
Lastly, keep in mind that Windows isn’t your only vulnerability! Mac users, this affects you too! Those Mac OSX updates, the annoying pop-ups from Adobe and Java – these are all patches and versions that you need to install. In order to best protect yourself, check all of your software for updates regularly.
The good news is, if this post has hit a nerve with you: all hope is not lost! With a little patience, a little time, and a heap of diligence, you can be the Groundhog of your own Early Spring!
