Re: Two bulletins from Microsoft on Patch Tuesday

[Valdis.Kletnieks () vt edu]

On Fri, 07 Nov 2008 07:18:18 GMT, Col said:

> I don't think any hacker is going to bother spending 5 days looking
> for a needle in a haystack when he can reverse engineer specific files
> once the patch is released. I know very little of looking for pointers
> in DLLs but from what I've seen it looks like a bit of a nightmare.
> The best way is to "diff" two files - the un-patched and the patched
> then you see where the changes are.

You're closer than most, but nobody's nailed the *actual* trade-off involved:

1) Large sites need a heads-up so they can form at least a rough estimate
of how much time/effort they will need to put in to deploying patches before
the guys who are doing diffs of binaries get their exploits.  If it's a low
rating, they can afford to do a lot of regression testing and deploy on a
relaxed timetable ("Oh, the guys over in XYZ have their weekly consolidation
run tonight, we'll upgrade them *tomorrow* night" versus "Screw the XYZ
run, we're pushing this in 2 hours whether they like it or not").

2) There's a very high chance that at least some percent of the black-hat
community is sitting on a 0-day exploit for these, that they've been using
for directed attacks under the radar (and in fact, a good chance that the
bulletin was issued because somebody's attack *didn't* go under the radar,
and that's how the white hats got a copy of the exploit).  This bulletin
is a heads-up to those black hats that their 0-day is going to be dropping
in value a lot starting Tuesday - so it's "smoke em if you got em" time.

For bonus points - compute what percent of advisories released next week
that *claim* to be reverse-engineering of the binary diff are actually
drops of 0-days that just became useless... ;)

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/