Microsoft's emergency patch for a critical Windows bug issued six weeks ago, when attacks were in underway, got a poor response from users, a security company has claimed.
Based on scans of between 200,000 and 300,000 Windows PCs owned by its customers, Qualys concluded that the patching pace for the October update - which Microsoft released "out-of-cycle," or outside its normal monthly schedule - was similar to the rate at which users fixed flaws that the company disclosed several weeks later on its usual Patch Tuesday.
"When Microsoft releases a patch out-of-cycle, we tend to think, 'Wow, why are they doing this? There must be a reason,'" said Wolfgang Kandek, Qualys' chief technology officer. "But it doesn't look like people pick up on that."
Over a six-week span, Qualys tallied the machines vulnerable to the MS08-067 vulnerability Microsoft patched off-schedule in October and counted the PCs vulnerable to a pair of patches released on 11 November, tagged MS08-068 and MS08-069.
"We counted them, and normalized them against the scan numbers," said Kandek.
The result was surprising. "While we saw reductions in the number of [vulnerability] occurrence found every week, they are fairly even and in line with normal patching distributions we have seen before," said Kandek.
Only in the last week or so did Qualys' data show a sudden drop in the number of machines not yet patched with MS08-067.
Kandek had a ready explanation. "We saw it move [down] when Microsoft and Symantec and Trend Micro said(together) last week. 'We found a worm, here it is and it's spreading,'" he said.
On Monday of last week, Trend Micro's researchers said that the worm was a key component in the build-up of a massive botnet , and had already hijacked half a million machines.
So even though Microsoft hit the alarm button for MS08-067, it wasn't until news broke about the Conficker.a worm that users began applying the patch at a higher-than-usual rate, Kandek concluded.
Six weeks after it released the emergency fix, Qualys' data indicated that the number of unpatched PCs had been reduced by about 70 per cent.
"The number [of unpatched systems] is down, but 70 percent -that's still bad," said Kandek, considering that Microsoft tagged the update as so critical it departed from its usual schedule, something it had not done since April 2007.
"We [wanted] to see how Microsoft customers apply these patches and if they pay special attention to the highly critical out-of-band vulnerabilities," Kandek said. "Unfortunately, that does not seem to be the case."