The Attack of the Clones: A Study of the Impact of Shared Code on Vulnerability Patching

Abstract

Vulnerability exploits remain an important mechanism for malware delivery, despite efforts to speed up the creation of patches and improvements in software updating mechanisms. Vulnerabilities in client applications (e.g., browsers, multimedia players, document readers and editors) are often exploited in spear phishing attacks and are difficult to characterize using network vulnerability scanners. Analyzing their lifecycle requires observing the deployment of patches on hosts around the world. Using data collected over 5 years on 8.4 million hosts, available through Symantec's WINE platform, we present the first systematic study of patch deployment in client-side vulnerabilities.We analyze the patch deployment process of 1,593 vulnerabilities from 10 popular client applications, and we identify several new threats presented by multiple installations of the same program and by shared libraries distributed with several applications. For the 80 vulnerabilities in our dataset that affect code shared by two applications, the time between patch releases in the different applications is up to 118 days (with a median of 11 days). Furthermore, as the patching rates differ considerably among applications, many hosts patch the vulnerability in one application but not in the other one. We demonstrate two novel attacks that enable exploitation by invoking old versions of applications that are used infrequently, but remain installed. We also find that the median fraction of vulnerable hosts patched when exploits are released is at most 14%. Finally, we show that the patching rate is affected by user-specific and applicationspecific factors; for example, hosts belonging to security analysts and applications with an automated updating mechanism have significantly lower median times to patch.

Security Events and Vulnerability Data for Cybersecurity Risk Estimation

“…This requires the definition of models that jointly evaluate attacker's and defender's strategies: (89) several independent studies showed that most attacks are driven by a handful of vulnerabilities only, suggesting that attackers choose vulnerabilities to exploit as opposed to launching attacks drawn randomly from a pool of exploits for all vulnerabilities. (46,47,103) Capturing these aspects may require to integrate socioeconomic models to evaluate attacker's incentives in marketing or buying a new vulnerability (91,102) or choosing a target. (89) We consider these aspects for future work.…”

An Empirical Study of Android Security Bulletins in Different Vendors

“…Similar to other software, Android vendors maintain the security of their devices by developing and issuing patches regularly. Nappa et al [27] studied the vulnerabilities life cycle in client applications, and Li and Paxson [22] investigated the patch development life cycle in open source software projects. The issues of automatic updates and semi-automatic updates have been investigated in [10] and [24], respectively.…”

A Screening Test for Disclosed Vulnerabilities in FOSS Components

“…To sketch a trade-off model that would allow to perform a retrospective analysis for "global" security maintenance of the whole FOSS component, we attempt to generalize the above "local" decision support. Similarly to Nappa et al [49], who employed survival analysis to analyze the time after a security patch is applied to a vulnerable host, we used it to analyze the persistence of vulnerable coding that we extracted from the sample of FOSS projects (shown in Table 2) with our screening tests. Survival analysis is the field of statistics that analyzes the expected duration of time before an event of interest occurs [50], and is being widely used in biological and medical studies.…”