Computer Security
10.4. Updates

The ideas earlier in this chapter have provided the motivation for organisations to keep their systems up to date - it’s an important defensive measure. Once a weakness is found in widely used software (either because a good hacker has reported it, or a malicious hacker has been observed exploiting it), the organisation is at risk since the weakness is probably widely known.

Of course, users don’t like having the system “down for maintenance” or being forced to log off while updates are made. Fortunately, many updates can be done without people noticing, but either way, procedures are needed to ensure that every device in the organisation is up to date. A single weak device could be a gateway for an attacker to get into the organisation.

Here are some examples of weaknesses being patched by updates:

• SolarWinds Orion in 2020:

  • September 2019: SolarWinds Orion, which is a tool used by many organisations to monitor their environment and networks, is infected with malware that allows attackers to steal data about the networks they monitor.
  • December 2020: A Security Research company (FireEye) found the weakness as part of some internal investigations of their own systems.
  • December 12 2020: FireEye told SolarWinds about the problem, and SolarWinds tried to fix it (this communication was kept private).
  • December 13 2020: The news became public because the US government was informed and released a public advisory. However, no fix was available.
  • December 15 2020: Fix released. This is only 2 days after the issue was made public, but it is a long time considering the customers impacted (US Government, Health companies). In those 2 days, trust was lost in SolarWinds as their “Orion software” that was available via download still had the malware in it.

• The Meltdown and Spectre vulnerabilities affected a very wide range of computers in January 2018. Google independently discovered the Meltdown and Spectre vulnerabilities in some microprocessors, but needed to make sure it was fixed in the relevant operating systems without the issue becoming widely known. The Google incident management team worked for months with Intel/ARM/AMD to develop patches. Here is an article about this.

• Another example is when Shadow Brokers were releasing information about the NSA online - the National Security Agency of the United States of America gave Microsoft a quiet heads-up about some vulnerabilities they had been secretly using. They suspected the vulnerabilities would be leaked by Shadow Brokers, and sure enough they were. These same vulnerabilities were used by the Wannacry malware, and NotPetya not long after. These were both devastating attacks (costing an estimated $4 billion and $10 billion USD in damages respectively) because organisations had not applied Microsoft's updates. Almost a million machines are still vulnerable (see avast.com).