Windows updates don’t normally feature highly on this blog… after all, they come along every month, you test them (perhaps?), install them, and leave things along for a few weeks. Sometimes there’s an out of band patch release and that ought to indicate that there is a significant problem that requires attention. So why have I been hearing so much over the last few weeks about the Win32/Conflicker.B worm with people panicking to update systems, install the latest AV updates, and generally try and catch up after being so lackadaisical in the first place?

Let me explain what I mean… according to an e-mail I received from Microsoft last week:

“Win32/Conficker.B exploits a vulnerability in the Windows Server service (SVCHOST.EXE) for Windows 2000, Windows XP, Windows Vista, Windows Server 2003, and Windows 2008. While Microsoft addressed this issue in October with Microsoft Security Bulletin MS08-067, and Forefront antivirus and OneCare (as well as other vendor’s anit-virus products) helped protect against infections, many systems that have not been patched manually through Server Update Services and Microsoft/Windows Update or through Automatic Updates have recently come under attack by this worm. Attacked systems may lock out users, disable our update services and block access to security-related Web sites:

In response to this threat, Microsoft has:

• Updated the January version of the [MSRT] to detect and remove variants of Win32/Conficker.B. You can download this version from the MSRT from either the Microsoft Update site or through its associated Knowledge Base article.
• Created the KB article 962007 ‘Virus alert about the Win32/Conficker.B worm‘ to provide public details on the symptoms and removal methods available to address this issue.
• Announced the release of the items and the virus threat itself on the Microsoft Malware Protection Center blog.

It is our hope that these resources can assist you in resolving issues with unpatched, infected systems and that you can apply MS08-067 to any other unpatched systems as soon as possible to avoid this threat.”

I’m sure there are some people who feel that applying updates is an intrusion, an unnecessary interruption into the day (these are probably the same people that advocate turning off user account control…). Others will claim that other operating systems don’t need patching so often (I don’t know about the frequency of updates but patches on my Macs always seem pretty big and Linux is in one big patch cycle as the open source model is one of continuous improvement). Personally, I’m glad that Microsoft settled down to a predictable monthly cycle and for those who think that’s a problem because it gives hackers a predictable timeframe for reverse engineering patches and attacking weaknesses in unpatched systems it’s all the more reason why every organisation’s IT security people should be ready to look at the update announcements on the second Tuesday of every month and then to act accordingly. And when a patch comes along outside that predictable schedule to consider that, yes it’s a pain in the neck, but it might just be important…

Which brings me back to the point. Conficker (also known as Downadup). As F-Secure put it:

“First — It was an out-of-band update.

Second — It was given an ‘Exploitability Index Assessment’ of ‘1 – Consistent exploit code likely’.

That kind of speaks for itself, doesn’t it?

Third — It allows for Remote Code Execution, in numerous versions of Windows (particularly critical for 2000, XP, and Server 2003).

All of these combined factors equals something quite serious that should be patched as soon as possible. If you are having difficulties with Automatic Updates, the bulletin links to manual downloads.

Security Update for Windows XP
Security Update for Windows Server 2003

It’s always a good idea to be ready for out-of-band updates. You can subscribe to Microsoft Security Notifications here.”

The other thing that this worm has awakened is corporate IT departments saying things like “how can we check that all our machines are updated with the Microsoft update and with the latest antivirus signatures?”. Well guys, there’s a feature called Network Access Protection (NAP) and it’s implemented in Windows XP SP3, Windows Vista and Windows Server 2008. Whilst you’ve all been bleating about how Vista is bad, perhaps you should have looked a bit further and seen some of the advantages it could bring. If you still can’t stomach a Vista upgrade because somehow you think that Windows 7 will be easier from an application compatibility standpoint (I have news for you…) or think that Microsoft and security in the same sentence indicates an oxymoron then there are plenty of third party endpoint security systems with similar controls…

Perhaps we need an outbreak like this from time to time to wake up the IT Managers and persuade them to spend some money on security improvements within the infrastructure.

Here endeth the lesson. Now go and update your systems.

For more information, check out Centralised information about the Conficker Worm and MS08-067 Conflicker worm update.

Those of us whose history goes back to Windows NT remember when a service pack was exactly what its name suggests – no new features, just bug fixes, thoroughly tested (usually) – and when application of the latest service pack was no big deal (application of any other updates was not normally required, unless addressing a specific issues). Today the landscape is different, with irregular service packs often bringing major operating system changes and requiring extensive testing, and frequent updates issued on the second Tuesday of almost every month.

A couple of weeks ago I was at a Microsoft event where one of the presenters (Microsoft UK’s James O’Neill) suggested that service packs are irrelevant and that they actually serve to put some people off deploying new operating system releases. To be fair to James, he was specifically talking about the “don’t deploy until the first service pack has shipped” doubters and to some extent he is right – the many updates that are applied to a Windows Vista installation today have provided numerous incremental improvements to the operating system since the original RTM last year. Even so, I can’t help thinking that Microsoft has muddied the water to some extent – I always understood that service packs had a higher level of integration testing than individual updates but it seems the current Microsoft advice is to apply all applicable “patch Tuesday” updates but only to apply other hotfixes (those updates produced to patch a specific customer scenario) where they are absolutely necessary.

Regardless of this confusion around the different forms of update, service packs are not dead – far from it – with both Windows Vista SP1 and Windows XP SP3 in beta at the time of writing. Although largely update rollups, these service packs do introduce some new features (new networking features for XP, and a kernel change for Vista to bring it in line with Windows Server 2008) but I’ve been of the opinion for some time now that XP SP3 is long overdue.

Going forward, it’s interesting to note that Windows Server 2008 is expected to launch with SP1 included. If that sounds odd, remember that both Windows Vista and Windows Server 2008 were originally both codenamed Longhorn and that they are very closely related – it’s anticipated that the next Windows service pack (let’s call it SP2 for the sake of argument) will be equally applicable to both the client and server operating system releases.

I’ve been an advocate of Microsoft SUS/WSUS since the v1.0 release. Sure, there are better enterprise software deployment products out there (Microsoft even has one – Systems Management Server) but as a low cost (free) patch management solution for Windows, it’s hard to beat Windows Software Update Services (which, since version 2.0, will update more than just Windows – WSUS 2.0 can act as a local cache for all updates that are available through the Microsoft Update servers). Except that now it has been beaten – by Windows Server Update Services (note the subtle name change) 3.0.

WSUS 3.0 was launched a couple of months ago and I finally installed it this afternoon. Not only does it include some great new features (like e-mail notification, improved reporting and computer management) but it finally gets an MMC administration interface (a huge improvement on the previous web administration interface). There are database changes too – WSUS no longer supports SQL Server 2000/MSDE (after all, those products are shortly to be retired), although it will upgrade an existing database.

The only downside that I can see is that the product still relies on clients connecting to the server and pulling updates (there is no option to force updates on clients – at least not as far as I can see). That’s fine but it does introduce some latency into the process (i.e. if there is an urgent patch to deploy, then WSUS is probably not the right tool to use); however, for the basic operational task of keeping a Windows infrastructure patched (for Microsoft products) and reporting on the current state, WSUS is definitely worth considering.

Further Information

WSUS 3.0 distributed network improvements (white paper).
WSUS 3.0 Usability improvements (white paper).