Microsoft’s recent release of a scaled-down removal tool for the MSBlaster worm was an unprecedented move aimed at reaching an elusive element of the destructive worm: home PC users.
As part of its bid to reach dial-up subscribers who haven’t bothered to download a patch that removes the worm, the software giant’s security unit stripped out as much as they could from the tool in order to make the patch a faster download.
The scaled-down approach illustrates a persistent problem in patch-management: how to load the patches on home users’ PCs.
“It [the Blaster removal tool] was one of the smallest things we’ve posted to our downloads section in the past few years,” said Christopher Budd, security program manager with Microsoft’s security
response center. “It was designed specifically to go in and look for the Blaster infection. We stripped it down
specifically to keep the file size small and to accommodate dial-up users.”
Budd told internetnews.com that the file size and
complicated nature of security patches are a “definite hurdle” the company
faced in its attempts coax users with a dial-up Internet connection to wait through the download and then install the software fix. It is an “intractable engineering
problem,” Budd said.
“The smaller the patch, the less of a hurdle it will be to reach
narrowband customers,” he added. “That’s the most effective thing we can focus on. I
think we can reduce patch sizes and get it to an acceptable level but, it
will always be a problem because of the way patches are designed.”
He said the Blaster removal tool was released as a
317 KB download (about three minutes for dial-up connections). “We’re
targeting the residue from the major [Blaster] outbreak from late last year.
We’ve never released a tool like this and once we realized that home users
were still infected and were actively transmitting the worm, we had to make
the tool specifically for them,” Budd explained.
He said the tool was built after consultations with anti-virus
partners in the Virus Information Alliance (VIA), which includes companies that work together on battling viruses.
For Gartner analyst John Pescatore, there’s no easy answer
to the problem of reaching dial-up subscribers. “If home users were
downloading every incremental patch release, it won’t be that big a deal for
dial-up users. But, the reality is that they download the patches once a
year or when a big alert reaches the mainstream media and then you’re
looking at tens of megabytes of patches,” he told
internetnews.com.
Still, Pescatore believes the biggest problem isn’t the size of the patch
but the mindset of home users who are unaccustomed to looking for software
fixes. “The mom and pop home users don’t have IT shops. You can’t expect
home users to be continually checking for a software patch because they
think of it as their car of their TV set. They take the car in for repairs
when something breaks or when they get a letter from the manufacturer
warning about a recall,” he added.
Pescatore believes that continued broadband penetration would help solve the
conundrum but, in the meantime, he said Microsoft will have to take a
hard look at shipping free CDs to home users to avoid the download problem
altogether. “When they put out the next service pack for Windows XP, that’s probably
something they should be giving out on CDs. There’s no way you can expect every
dial-up home user to download that service pack.”
Microsoft’s Budd said there have been some discussions internally about
releasing large patches on CDs but he declined to get into specifics. “As
we improve the patch process, we need to find ways to make the patches
smaller. Eventually, you will see our patches getting smaller and broadband
penetration getting bigger and that convergence will improve the patch
application ecosystem,” he said.
But Gartner’s Pescatore said that’s at least two years away, and that home users are probably going to be stuck in the meantime. “A lot
of home users who went through the pain of downloading the patch find that
the installation is too complicated. They download it and assume that the
installation is complete and that’s a bigger problem. A lot of home users
don’t even know how to apply a patch,” Pescatore added.
Pescatore believes home users will see immediate benefits when the security-centric SP2 for XP ships later this year. “For home users, turning on the software update
feature to automatically get fixes is a good idea. It will also turn on the
personal firewall by default so there’s some relief coming with the service
pack.”
The Windows XP service pack is now in beta. It comes with a major
overhaul of the company’s flagship Internet Explorer browser and the
ability to monitor browsing, e-mail and instant messaging for malicious
attachments or code.
The service pack will also disable unnecessary services that open ports
to potential hacks by worms or spam and include protection against buffer overflows, the most common software security flaw. New compiler
technology will be added to XP to detect buffer overruns and stop malicious
code from running on the computer.
“From a security perspective, the service pack does a lot of good things
but Microsoft has to take the extra step to distribute it on CDs. For the
next few years, that’s the only way they’ll be able to reach the dial-up
home users,” Pescatore said.
