Reverse-engineering security patches to automatically generate exploits

[Theophylact]

Uh-oh:

Automatic Patch-Based Exploit Generation
David Brumley, Pongsin Poosankam, Dawn Song, and Jiang Zheng

Abstract
The automatic patch-based exploit generation problem is: given a program P and a patched version of the program P', automatically generate an exploit for the potentially unknown vulnerability present in P but fixed in P'. In this paper, we propose techniques for automatic patch-based exploit generation, and show that our techniques can automatically generate exploits for vulnerable programs based upon patches provided via Windows Update.

In many cases we are able to automatically generate exploits within minutes or less. Although our techniques may not work in all cases, a fundamental tenet of security is to conservatively estimate the capabilities of attackers. Thus, our results indicate that automatic patch-based exploit generation should be considered practical. One important security implication of our results is that current patch distribution schemes which stagger patch distribution over long time periods, such as Windows Update, may allow attackers who receive the patch first to compromise the significant fraction of vulnerable hosts who have not yet received the patch. Thus, we conclude update schemes, such as Windows Update as currently implemented, can detract from overall security, and should be redesigned.

What does this mean?
Attackers can simply wait for a patch to be released, use these techniques, and with reasonable chance, produce a working exploit within seconds. Coupled with a worm, all vulnerable hosts could be compromised before most are even aware a patch is available, let alone download it. Thus, Microsoft should redesign Windows Update. We propose solutions which prevent several possible schemes, some of which could be done with existing technology.

Read the full paper: PDF

Hat tip to Bruce Schneier.

[SeanC]

Interesting. Another reason to stay up to date on patches for the OS and programs. That would only hit those that don't update or don't update often enough.

[Dude111]

Its sad people stop @ nothing to hurt people they dont even know.....

Very sad and sickening........

[Keymaker]

This exactly why my paranoid view on computer security has all programs not auto update!

One thing I find about these so called security holes, is that the finders themselves add more damn fuel to the fire.

http://www.pandora.com/music/song/u2/bullet+blue+sky

[EXreaction]

I don't see how there would be any possible way around this. As soon as you release a patch the user can reverse engineer it and find the place it patches, and there really is no way of releasing patches without letting people have access to the patch files.

Originally Posted by Keymaker

This exactly why my paranoid view on computer security has all programs not auto update!

Wait, so you are saying that you turn off auto updates because you think you are keeping yourself more secure?

[Keymaker]

No, I update manually. Guess I should have stated that..

[sr71000]

that still makes no sense. It's imperative to get the updates installed before an exploit can be reverse engineered. Do you wait up on patch nights just waiting for the patch to be released, then run around on all your machines and immediately install it?

Anyways, this just further demonstrates the need for a firewall to keep them away from your inherently flawed software.

/edit - I can't wait to go through this paper and see their proposed solutions.

[Keymaker]

Believe the solution was to encrypt the patch being sent...

My purpose of turning off auto updates is to reduce any vulnerability in the update routine. Like a hijack of some type.