Zero Day - Where's the Patch?

Late in November 2005, semi-malicious security researchers told the world of a, "zero day" exploit in Internet Explorer.

I say, "semi-malicious" as they didn't give Microsoft any warning regarding the information they were going to release. There's nothing wrong with researching security issues, but accepted protocol is to notify the effected product's author, and give them a chance to fix it. Instead, these fellows publicized the full code needed to perform the exploit. Nearly one thousand websites have been identified that utilize the exploit for unclear purposes.

However, not to cut them any slack, Microsoft was aware of the general issue for about 6 months prior. The original issue only indicated a, "denial of service attack" was possible. A denial of service attack lets the perpetrator effectively shutdown or crash another computer.

The new variation of the exploit allows a website to take control of the victim's computer. Possible incentives for doing this would be harvesting information, or forcing the computer to join a botnet in order to send unwanted email. A botnet is a collective of hacked computers, capable of performing the, "owners" tasks in massive parallel operations.

Spammers make heavy use of botnets as email sent by them can be difficult to intercept by using spam protection software. This helps ensure a high percentage of delivery, which can maximize profits of any given campaign.

It's now December 9th and about 2 weeks have past since the problem was publicized. How many systems have been affected is not known. What is known is that Microsoft hasn't released a patch, or a palatable fix to the problem for end-users. It is possible to disable some features within Internet Explorer to avoid the problem, but many websites require the disabled functionality.

Microsoft has made noises regarding the release of an, "out of cycle" patch. Microsoft usually publishes new patches and security notices once a month. However, to date none has been published.

While an anti spam email software warrior / author by night, my, "day job" involves managing security for a few dozen workstations. To quote many others, "now would be a good time."

Back