Cloud

2/14/2018
05:43 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Windows 10 Critical Vulnerability Reports Grew 64% in 2017

The launch and growth of new operating systems is mirrored by an increase in reported vulnerabilities.

The number of critical vulnerabilities reported for Windows 10 increased 64% between 2016 and 2017. In total, 587 vulnerabilities were reported across Windows Vista, Windows 7, Windows 8.1/RT 8.1, and Windows 10 over the course of last year.

Researchers at Avecto analyzed data issued by Microsoft via the Security Update Guide throughout 2017. The guide focuses on security vulnerabilities affecting Microsoft products and services. They compiled the data into a yearlong overview to see if vulnerabilities increased.

Overall, they learned the number of reported Microsoft vulnerabilities increased 111% between 2013 and 2017. There has been a 54% increase in Critical Microsoft vulnerabilities reported since 2016, and a 60% increase over the 2013-2017 timeframe.

"I think it's the standard pattern for new operating systems," says Peter Firstbrook, vice president at Gartner, of the increase in reported Windows vulnerabilities. "Bugs generally get discovered as new operating systems launch and get popular."

To his point, the increase in flaws doesn't mean Microsoft's technology is less secure, analysts report. There are several factors at play here, including the growth of the Windows operating system, increasing complexity of services, data leaks, and a larger pool of security researchers.

"The pervasiveness of Windows, of technology means more [vulnerabilities] get identified," says Avecto COO Andrew Avanassian. There are more interconnected devices and shorter time to market, both of which increase the chance that bugs will be discovered. The problem isn't that Windows is less secure, it's that more machines are being used and attacked.

Microsoft's technology has steadily grown more complex, increasing the likelihood that vulnerabilities will evade detection, says Jeff Pollard, principal analyst serving security and risk professionals at Forrester. The company's security development lifecycle (SDL), has improved software security, but flaws in old and new software still slip through the cracks.

Avecto's research isn't limited to the Windows OS alone. There was an 89% increase in Office vulnerabilities between 2013-2017, during which Critical vulns in Microsoft browsers went up 46%.

"The downside to vulnerability discovery is you don't know when that code was written," he points out. "This could have been code written for Office 2005, or 2013, that was carried forward and we just discovered in 2017 … part of what we don't know is how much might be carried forward from prior architecture and prior processes."

Pollard also emphasizes the idea that external events have had a particular impact on reported Windows vulnerabilities. In particular, activity from the Shadow Brokers and the Vault 7 data leak led to the disclosure of many previously unknown vulnerabilities.

"Whenever you have a new vulnerability discovered or a new type of vulnerability, what you find is more stuff pops up around it," he says. Security researchers add a "follow-on" effect when they use these events as starting points to hunt for more bugs. Overall, he says, businesses are becoming more diligent about penetration testing and application testing.

Compliance dictates breaches and vulnerabilities should be acknowledged faster, and there are more organizations and volunteers identifying them.

"The increase in bounties has helped increase disclosure and patches before malware discovers them," says Firstbrook. "Continuous updates with Windows 10 will help patch faster by removing patching delays."

Patches, Admin Rights, and Mitigating Risk

"The biggest takeaway is the sheer number and volume of critical vulnerabilities that could be mitigated by the removal of administrative rights," says Avanessian.

Researchers dug into the data to see which vulnerabilities could be mitigated by removing administrative rights. Their report states 80% of Critical vulnerabilities reported in 2017 could have been mitigated if admin privileges were taken away.

"In security we tend to put an alarm on our house to stop intruders but leave the front door wide open," he adds. "Many organizations could be in a better, more secure place if they did this simple thing."

Pollard agrees that removing administrative rights is one of the best things that could prevent problems, but it does penalize users and interrupts workflow. "You need to know which employees don't have administrative rights and which employees do," he points out.

He points to patch management as a key step to take in mitigating risk. When considering the range of vulnerabilities reported, it's important to consider how many patches need to be deployed to mitigate them. In many cases, a single patch will address multiple issues.

"We need better code quality, we need to make sure the trend doesn't continue … but at the same time, it's not like it was a massive issue to patch all of them." However, he acknowledges patch management can be complicated for many organizations and they may not be able to deploy patches if workloads, applications, and infrastructure get in the way.

Other steps businesses can take include application whitelisting, or having a catalogue of software that can run and another catalogue of software that cannot. Multi-factor authentication is also important.

Related Content:

 

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mystic2020
50%
50%
Mystic2020,
User Rank: Apprentice
2/16/2018 | 9:56:59 AM
Avecto's Microsoft Vulnerabilities Report 2017
The insight in this report is awesome. Hopefully companies start to wake up to the growing threats! Thanks for sharing.
8 Ways Hackers Monetize Stolen Data
Steve Zurier, Freelance Writer,  4/17/2018
Securing Social Media: National Safety, Privacy Concerns
Kelly Sheridan, Staff Editor, Dark Reading,  4/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.