After IE Attacks, Microsoft Eyes Security Betas

With hackers actively exploiting an unpatched bug in Internet Explorer (IE), and some users unhappy that a fix for the problem may still be two weeks away, Microsoft says it is looking at ways of providing more rapid security updates.

Hackers began circulating code that exploited this newest IE vulnerability late last week, and to date it has been used on several hundred maliciously encoded websites, according to security vendor Websense.

With Microsoft on track to patch the problem on April 11, some in the security community are saying the software giant is too slow to respond to serious threats.

Microsoft’s practice of holding security fixes until the second Tuesday of each month, called “Patch Tuesday” by administrators, can sometimes hurt home users because they may not have the benefit of the “layers and layers” of protection that are typical in corporate environments, said Todd Towles, a security consultant based in Austin, Texas.

“In the past, I wouldn’t have a problem with the Microsoft delay, but this is happening too much,” he said. “Microsoft waits for Patch Tuesday to make corporate patch management teams happy, but this is only hurting the millions of home users that live at a higher security risk.”

Microsoft is looking at ways to provide a speedier update, although at present it has no plan to release beta versions of its security updates, said Stephen Toulouse, a security program manager with Microsoft’s security response center. “There are some huge challenges to that,” he said.

First and foremost is the issue of quality control. Microsoft must ensure that its updates work on a wide range of platforms, many of which have been changed for use in different parts of the world. “We can’t leave anybody behind,” Toulouse said. “And unfortunately you might be introducing new problems. So whenever we look at even a quick hack … it’s got to be of quality. That’s what customers have told us time and again.”

“That’s not to say that we’re not examining some ways that we could … have an accelerated or maybe a less tested update, but we haven’t made any determinations on that,” he added.

The idea of releasing unsupported software is not exactly new to Microsoft. The company has been releasing beta versions of its products to early testers for years now, and in recent months it has moved to be more transparent and more agile in the way it releases code that will be in upcoming products.

Still, a beta process that works for commercial software may not be well suited for security updates.

If Microsoft were to release an early patch of an unknown security vulnerability, for example, it could be tipping off hackers to a new type of attack.

“There might be privately reported issues that end up being in that update that haven’t been disclosed yet,” Toulouse said. “When we put out the bulletin, we talk about the information in the vulnerabilities … with a beta, how does that work exactly? Do you put out a kind-of-a-bulletin?”

Whatever changes Microsoft may be considering, its slow response to critical bugs is creating a void that others have been filling over the past few months.

On Monday, security vendors eEye Digital Security and Determina posted patches that fixed the latest IE bug. And two months ago, software developer Ilfak Guilfanov released a widely adopted patch that fixed a similarly critical IE bug.

Users who want to be sure to avoid this latest vulnerability can either turn off the browser’s Active Scripting capability or install one of the unsupported patches. The latter option is not recommended by Microsoft, which says it cannot recommend third-party patches that “modify the way the product itself operates” because they might not be compatible with other applications.

Towles believes Microsoft should go ahead and release early security updates. “Microsoft stays on the side and lets vendors push out test patches, letting them take the blame for anything that might break,” he said. “They let us use SQL [Server] beta, why not provide a beta IE patch?”

The eEye patch is available online, as is Determina’s.

Read Microsoft’s comments on these patches.

-Robert McMillan, IDG News Service

For related news coverage, check out Security Vendor Patches Dangerous IE Bug and Microsoft Tests Fix for IE Bug as Exploits Appear.

Keep checking in at our CSO Security Feed page for updated news coverage.