Malware authors exploit Microsoft's monthly cycles

The creators of the Bofra worm, which exploits the recently discovered IFRAME vulnerability in Internet Explorer, may have timed the release of their worm to throw Microsoft's monthly patch cycle into disarray, say security experts.

In its latest monthly update, Microsoft was not been able to fix a serious vulnerability in Internet Explorer because the flaw was discovered only a few days before the company’s regular update was due. To make matters worse a worm exploiting the flaw was released on Monday, leaving the software giant without any option but to ignore the problem – for now.

Sean Richmond, senior technology consultant at Sophos Australia, told ZDNet UK sister site ZDNet Australia that it would have been impossible for Microsoft to create and test a reliable patch in four days – the time between the vulnerability being published and the date set for Microsoft's next patch.

"To release a stable patch for IE would be impossible [in that time] because they want to test it thoroughly before it goes out. The monthly patch cycle was designed to make it easier for system administrators to schedule their updates but a few days is just not enough time for Microsoft create and test a patch," said Richmond.

Ben English, security team leader at Microsoft Australia, told ZDNet UK sister site ZDNet Australia that Microsoft advocates a process of responsible disclosure and is "very keen" to discover any vulnerabilities before they are made public.

"The reasons are very obvious. We would not disclose any info about a vulnerability till we have mitigation in place. The worst scenario for us is that we release an update which has quality problems. We believe the downstream problems of releasing patches too quickly are even more serious than not putting in the quality that they deserve," said English.

English would not comment on whether Microsoft thought the timing of the worm -– and the vulnerability's disclosure –- was malicious but he said if the problem was serious enough the company would break its patch cycle to plug the gap.

"In terms of the timing I have no comment on whether there is malicious intent but in a sense it is academic because if this is a serious vulnerability and we have a patch available we will release it out of cycle," said English.

The IFRAME vulnerability and the Bofra worm appeared in the week leading up to the final release of Mozilla’s Firefox browser, which is unaffected by the worm and seen as the biggest threat to Microsoft’s dominance of the browser market for many years.

Munir Kotadia writes for ZDNet Australia. For more ZDNet Australia stories, click here.