News

Windows 7 May Face Attacks in 2010

Windows 7 has the potential to become a security target in 2010, according to researchers, although it's held up so far.

Just days after Windows 7 was released to OEMs and partners in July, a serious vulnerability was reported in the operating system. However, Microsoft released an early patch, and no serious issues were reported in 2009.

"Many vulnerabilities did not affect Windows 7 itself but actually affected the release candidate of Windows 7," said Jason Miller, security and data team manager at Shavlik Technologies.

While Microsoft has already issued the first security patches for the new operating system, expect more vulnerabilities to come, according to Zulfikar Ramzan, a technical director and architect with Symantec Security Response.

"As long as humans are programming computer code, flaws will be introduced, no matter how thorough pre-release testing is," Ramzan said in an e-mail discussing Symantec's recent trends and predictions report. "And the more complex the code, the more likely that undiscovered vulnerabilities exist. Microsoft's new operating system is no exception, and as Windows 7 hits the pavement and gains traction in 2010, attackers will undoubtedly find ways to exploit its users."

Microsoft initiated its security development lifecycle (SDL) process as company-wide policy for developing its software in 2004. The policy likely has reduced vulnerabilities in software such as Windows 7, even though 2009 saw a record number of vulnerabilities in older Windows products -- approximately 80 bugs in all, including the infamous Conficker worm.

SDL essentially is a framework for building security into Microsoft's software. Results from its use appear to be good so far.

"If Microsoft's metrics are to be believed -- and I do believe them -- then yes [SDL has been a success]," said Randy Abrams, director of technical education at ESET. "The number of critical vulnerabilities found in the products under the SDL has dropped dramatically. The issue going forward is that critics will point out the vulnerabilities that make it through without the recognition of how many more vulnerabilities didn't make it through."

All software vendors face the challenge of responding to zero-day exploits. Much will depend on whether security experts choose to contact Microsoft privately about their discoveries or go public.

 "I recall a time [in 2009] when a panic was created around a vulnerability in Windows 7 before Microsoft had a chance to research and disclose the actual information around the vulnerability, causing deserved embarrassment for the researcher," Miller said. He added that such a jump-the-gun culture among some vendors doesn't help anybody -- not Microsoft, not researchers and definitely not users.

Going public may force Microsoft to become more responsive, but the importance of a bug can be a subjective call.

"Generally Microsoft is responsive to bug reports," Abrams said. "But there are cases when the nature of the bug is not adequately understood and it may be dismissed as far less of a problem than it really is."

For his part, Abrams suggests that Microsoft and vendors should play nicer this year.

"Both security vendors and independent researchers should report responsibly [to Microsoft]," Abrams said. "That said, the affected vendor, whether it is Microsoft or another company, needs to be responsive and transparently explain if a fix will take longer than seems to be reasonable."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

comments powered by Disqus

Featured

  • Xamarin.Forms 5 Preview Ships Ahead of .NET 6 Transition to MAUI

    Microsoft shipped a pre-release version of Xamarin.Forms 5 ahead of a planned transition to MAUI, which will take over beginning with the release of .NET 6 in November 2021.

  • ML.NET Improves Object Detection

    Microsoft improved the object detection capabilities of its ML.NET machine learning framework for .NET developers, adding the ability to train custom models with Model Builder in Visual Studio.

  • More Improvements for VS Code's New Python Language Server

    Microsoft announced more improvements for the new Python language server for Visual Studio Code, Pylance, specializing in rich type information.

  • Death of the Dev Machine?

    Here's a takeaway from this week's Ignite 2020 event: An advanced Azure cloud portends the death of the traditional, high-powered dev machine packed with computing, memory and storage components.

  • COVID-19 Is Ignite 2020's Elephant in the Room: 'Frankly, It Sucks'

    As in all things of our new reality, there was no escaping the drastic changes in routine caused by the COVID-19 pandemic during Microsoft's big Ignite 2020 developer/IT pro conference, this week shifted to an online-only event after drawing tens of thousands of in-person attendees in years past.

Upcoming Events