Survey: Microsoft patches ignored

"punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">The results of an conducted by U.K. anti-virus firm Sophos found thatmore often than not, PC users don't install Microsoft's monthlypatches."punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">The results, released on Monday, were gathered from 40 days' worthof data from a sample group of 580 PCs in corporate environments,80 percent of which failed one or more basic security tests."punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">Moreover, 63 percent were found lacking at least one Microsoftpatch on the OS level, the Office and application levels, or thebrowser and media player component levels."punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">Bill Emerick, Sophos' vice president of product management, said ina prepared statement, "Machines that fail such a test represent'low-hanging fruit' for cybercriminals and [are] a real danger totheir corporate networks.""punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">But according to Randy Abrams, director of technical education forIT consultancy ESET, these reports can sometimes be like "two blindmen, touching different parts of an elephant. [They] may get thesame results, but it doesn't cover the whole body.""punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">"I think we have to remember that the sample sets and controlgroups in tests like these need to be taken into consideration,"said Abrams, himself a former Microsoft security pro. "That said,we don't need a survey to tell us that people are lax aboutpatching their systems. I think the evidence of that is that thereare far fewer zero-day or new patches than there are those that areresponding to a direct set of vulnerabilities.""punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">There are several reasons for IT pros and even individual users todelay, or altogether skip, patching their systems -- one being thefact that not every patch may apply to them."punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">Many enterprises also hold off patching to evaluate the cost, or toavoid either or seeing their particularly tailored systems ."punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">There's also some lingering for Microsoft patches, Abrams explained."In these cases, the systems sometimes reboot...while you're awayto automatically install the patches," he said. "I think this was acase with a good intention and bad implementation on Microsoft'spart.""punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">"punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">Microsoft announced last week that it was reissuing a "critical"patch relating to Bluetooth wireless technology that was releasedlast week as part of its June update cycle. The patch addresses howBluetooth interoperates with Windows components andapplications."punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">Microsoft originally released the patch on , saying that it resolved "a privately reported vulnerabilityin the Bluetooth stack in Windows." The vulnerability could allow ahacker carte blanche over an enterprise system, with edit, delete,change and write capabilities."punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">The amended critical is designed to plug security holes when running various versions ofWindows, especially XP Service Packs 2 and 3, according toChristopher Budd, security response communications lead forMicrosoft."punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">"Customers who in particular [are] running Windows XP SP2 or SP3should download and deploy these new security updates," Budd statedin an e-mail to Redmondmag.com. "Customers running other versionsof Windows who have already applied the original security updatesdo not need to take action.""punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">Budd added that the updated versions of the affected securityupdates will be made available through the usual distributionchannels, which include Windows Update and Windows Server UpdateServices."punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">IT security pros, including Tyler Reguly, security engineer withSan Francisco-based network security firm nCircle, said that thiscritical patch is an important one because it doesn't require userparticipation and is a vector many hackers find increasingly easyto use."punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">"Microsoft definitely wants to get it right," Reguly said. "I findthis interesting simply because we're seeing a vulnerability in awireless protocol that is quite popular. People travelling withlaptops are probably the most likely to have Bluetooth enabled.It's important to keep in mind the limited range of Bluetooth,which is what, in my opinion, somewhat limits the severity of thevulnerability.""punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">For its part Microsoft is still investigating what may have gonewrong with a few downloads of this particular patch over the pasttwo weeks."punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">Writing on Microsoft's , Budd explainedthat his division launched the investigation after it "learned thatthe security updates for Windows XP SP2 and SP3 might not have beenfully protecting against the issues discussed in thatbulletin.""punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">So far, it appears that Redmond's engineers have indentified "twoseparate human issues involved," according to Budd. "When we'redone with our investigation, we'll take steps to better prevent itin the future.""punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">The Bluetooth reissue was one of a few patch reissues released inthe first six months of this year. The reissue with the highestprofile came in March, when an Excel bug caused some versions of its popular spreadsheetapp to apply incorrect math formulas in individual rows and columnson the program's document interface."punctuation-wrap: hanging; text-autospace: ideograph-numeric ideograph-other">