Windows 7 May Face Attacks in 2010

Windows 7 has the potential to become a security target in 2010, according to researchers, although it's held up so far.

Just days after Windows 7 was released to OEMs and partners in July, a serious vulnerability was reported in the operating system. However, Microsoft released an early patch, and no serious issues were reported in 2009.

"Many vulnerabilities did not affect Windows 7 itself but actually affected the release candidate of Windows 7," said Jason Miller, security and data team manager at Shavlik Technologies.

While Microsoft has already issued the first security patches for the new operating system, expect more vulnerabilities to come, according to Zulfikar Ramzan, a technical director and architect with Symantec Security Response.

"As long as humans are programming computer code, flaws will be introduced, no matter how thorough pre-release testing is," Ramzan said in an e-mail discussing Symantec's recent trends and predictions report. "And the more complex the code, the more likely that undiscovered vulnerabilities exist. Microsoft's new operating system is no exception, and as Windows 7 hits the pavement and gains traction in 2010, attackers will undoubtedly find ways to exploit its users."

Microsoft initiated its security development lifecycle (SDL) process as company-wide policy for developing its software in 2004. The policy likely has reduced vulnerabilities in software such as Windows 7, even though 2009 saw a record number of vulnerabilities in older Windows products -- approximately 80 bugs in all, including the infamous Conficker worm.

SDL essentially is a framework for building security into Microsoft's software. Results from its use appear to be good so far.

"If Microsoft's metrics are to be believed -- and I do believe them -- then yes [SDL has been a success]," said Randy Abrams, director of technical education at ESET. "The number of critical vulnerabilities found in the products under the SDL has dropped dramatically. The issue going forward is that critics will point out the vulnerabilities that make it through without the recognition of how many more vulnerabilities didn't make it through."

All software vendors face the challenge of responding to zero-day exploits. Much will depend on whether security experts choose to contact Microsoft privately about their discoveries or go public.

 "I recall a time [in 2009] when a panic was created around a vulnerability in Windows 7 before Microsoft had a chance to research and disclose the actual information around the vulnerability, causing deserved embarrassment for the researcher," Miller said. He added that such a jump-the-gun culture among some vendors doesn't help anybody -- not Microsoft, not researchers and definitely not users.

Going public may force Microsoft to become more responsive, but the importance of a bug can be a subjective call.

"Generally Microsoft is responsive to bug reports," Abrams said. "But there are cases when the nature of the bug is not adequately understood and it may be dismissed as far less of a problem than it really is."

For his part, Abrams suggests that Microsoft and vendors should play nicer this year.

"Both security vendors and independent researchers should report responsibly [to Microsoft]," Abrams said. "That said, the affected vendor, whether it is Microsoft or another company, needs to be responsive and transparently explain if a fix will take longer than seems to be reasonable."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

comments powered by Disqus


  • Creating Reactive Applications in .NET

    In modern applications, data is being retrieved in asynchronous, real-time streams, as traditional pull requests where the clients asks for data from the server are becoming a thing of the past.

  • AI for GitHub Collaboration? Maybe Not So Much

    No doubt GitHub Copilot has been a boon for developers, but AI might not be the best tool for collaboration, according to developers weighing in on a recent social media post from the GitHub team.

  • Visual Studio 2022 Getting VS Code 'Command Palette' Equivalent

    As any Visual Studio Code user knows, the editor's command palette is a powerful tool for getting things done quickly, without having to navigate through menus and dialogs. Now, we learn how an equivalent is coming for Microsoft's flagship Visual Studio IDE, invoked by the same familiar Ctrl+Shift+P keyboard shortcut.

  • .NET 9 Preview 3: 'I've Been Waiting 9 Years for This API!'

    Microsoft's third preview of .NET 9 sees a lot of minor tweaks and fixes with no earth-shaking new functionality, but little things can be important to individual developers.

  • Data Anomaly Detection Using a Neural Autoencoder with C#

    Dr. James McCaffrey of Microsoft Research tackles the process of examining a set of source data to find data items that are different in some way from the majority of the source items.

Subscribe on YouTube