News

Windows 7 May Face Attacks in 2010

• By Jabulani Leffall
• 01/04/2010

Windows 7 has the potential to become a security target in 2010, according to researchers, although it's held up so far.

Just days after Windows 7 was released to OEMs and partners in July, a serious vulnerability was reported in the operating system. However, Microsoft released an early patch, and no serious issues were reported in 2009.

"Many vulnerabilities did not affect Windows 7 itself but actually affected the release candidate of Windows 7," said Jason Miller, security and data team manager at Shavlik Technologies.

While Microsoft has already issued the first security patches for the new operating system, expect more vulnerabilities to come, according to Zulfikar Ramzan, a technical director and architect with Symantec Security Response.

"As long as humans are programming computer code, flaws will be introduced, no matter how thorough pre-release testing is," Ramzan said in an e-mail discussing Symantec's recent trends and predictions report. "And the more complex the code, the more likely that undiscovered vulnerabilities exist. Microsoft's new operating system is no exception, and as Windows 7 hits the pavement and gains traction in 2010, attackers will undoubtedly find ways to exploit its users."

Microsoft initiated its security development lifecycle (SDL) process as company-wide policy for developing its software in 2004. The policy likely has reduced vulnerabilities in software such as Windows 7, even though 2009 saw a record number of vulnerabilities in older Windows products -- approximately 80 bugs in all, including the infamous Conficker worm.

SDL essentially is a framework for building security into Microsoft's software. Results from its use appear to be good so far.

"If Microsoft's metrics are to be believed -- and I do believe them -- then yes [SDL has been a success]," said Randy Abrams, director of technical education at ESET. "The number of critical vulnerabilities found in the products under the SDL has dropped dramatically. The issue going forward is that critics will point out the vulnerabilities that make it through without the recognition of how many more vulnerabilities didn't make it through."

All software vendors face the challenge of responding to zero-day exploits. Much will depend on whether security experts choose to contact Microsoft privately about their discoveries or go public.

 "I recall a time [in 2009] when a panic was created around a vulnerability in Windows 7 before Microsoft had a chance to research and disclose the actual information around the vulnerability, causing deserved embarrassment for the researcher," Miller said. He added that such a jump-the-gun culture among some vendors doesn't help anybody -- not Microsoft, not researchers and definitely not users.

Going public may force Microsoft to become more responsive, but the importance of a bug can be a subjective call.

"Generally Microsoft is responsive to bug reports," Abrams said. "But there are cases when the nature of the bug is not adequately understood and it may be dismissed as far less of a problem than it really is."

For his part, Abrams suggests that Microsoft and vendors should play nicer this year.

"Both security vendors and independent researchers should report responsibly [to Microsoft]," Abrams said. "That said, the affected vendor, whether it is Microsoft or another company, needs to be responsive and transparently explain if a fix will take longer than seems to be reasonable."