Researchers from Carnegie Mellon have developed a way to semi-automatically develop exploits from patches (cf. story on SecurityFocus).
Actually, this isn't such a new twist to the old disclosure debate - reverse engineering of patches has always been possible; the news is that it's possible to develop a program that does so.
The principal problem this poses is shortening implementation cycles of patches. All other parameters are basically unchanged. We can't not publish patches, obfuscation will only provide a temporary (and probably very brief) obstacle to attackers, and secondary controls (relating to defense-in-depth) will only mitigate, not prevent an exploit.
Organizations will need to get used to a shifted balance between stability and security. Extensive compatibility testing of patches might simply be a thing of the past.
- Peter Berlich's blog
- Login or register to post comments