Bad patching practices are a breeding ground for zero

Vulnerabilities can come back to bite you.

Customers of major software vendors take comfort whenever a vendor issues a security fix for a critical software vulnerability. The clients expect that software update to keep attackers from stealing sensitive information.

But new data from Google’s elite hacking team, Project Zero, suggests that assumption is misplaced. One in four “zero-day,” or previously unknown, software exploits that the Google team tracked in 2020 might have been avoided “if a more thorough investigation and patching effort were explored,” Project Zero researcher Maddie Stone said Wednesday.

In some cases, the attackers only changed a line or two of code to turn their old exploit into a new one. Many of the zero-day exploits were for popular internet browsers like Chrome, Firefox or Safari, exposing an array of users around the world.

Project Zero’s sample size is modest, covering just 24 exploits in all. But the data points to a need for greater scrutiny — from third-party researchers, technology users and journalists — of vendors’ commitment to fixing software flaws.

“Across the industry, incomplete patches — patches that don’t correctly and comprehensively fix the root cause of a vulnerability — allow attackers to use 0-days against users with less effort,” Stone wrote in a blog post.  

Some vendors only blocked a “proof of concept” exploit developed by researchers rather than addressing the vulnerability itself, Stone said. For their part, researchers sometimes don’t follow up on whether a software patch gets the job done, she added.

The sloppy patching has real-world consequences. More than two years ago, unidentified hackers began exploiting a vulnerability in Internet Explorer that could allow them to take full control of a user’s browser. The same attackers — whom Google said were targeting people in North Korea or who work on North Korean issues  — ended up exploiting three similar Internet Explorer bugs in the exact same manner in 2019 and 2020.

“Fixing these vulnerabilities comprehensively the first time would have caused attackers to work harder or find new 0-days,” Stone said.

While a simple concept, consistently issuing effective software patches can require vendors to invest significant resources and planning in doing so. The hope is that vendors realize that the cost of negligence — in the form of disaffected and victimized customers —  outweighs the cost of fixing the bug.  

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Dogged Russia-based botnet dismantled after 23-year run

• FBI raises alarm over deceptive phishing campaign targeting prominent people

• McKesson copes with fallout from data theft extortion attack

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure