Hackers can successfully attack Windows PCs months — even years — after Microsoft Corp. fixes a flaw, a security expert said today, because there’s always a pool of unpatched systems.
According to data that Qualys Inc. culled from scans of more than 80 million machines, between 5% and 20% of all systems are never patched for any vulnerabilities, including those disclosed by Microsoft in its monthly security updates.
Qualys, a provider of on-demand IT security systems, tracked four vulnerability bulletins issued by Microsoft in 2008 and in each case found that a sizable fraction of the PCs it scanned had not been patched, even though in some cases more than a year had passed since Microsoft issued fixes.
The four updates, all labeled “critical” by Microsoft when they were released, included the following:
* MS01-001, a two-patch update in January 2008 that plugged holes in three Windows TCP/IP protocols.
* MS08-007, a single February 2008 patch for Windows’ WebDAV Mini-Redirector, which defines how basic file functions such as Copy, Move, Delete and Create are performed using HTTP.
* MS08-015, a one-fix update in March 2008 for a bug in Outlook, Microsoft’s mail client, that could be exploited by tricking a user into visiting a malicious Web site.
* MS08-021, a two-patch update released in April 2008 for Windows GDI, or graphics device interface, a frequently-fixed core component of the operating system.
Even as late as this year, MS08-021 had not been applied to 20% of the PCs that Qualys scanned. The percentage of machines lacking the MS08-015 update, on the other hand, dipped at times to about 5%.
Read more »