The Attack of the Clones: A Study of the Impact of Shared Code on Vulnerability Patching

摘要: Vulnerability exploits remain an important mechanism for malware delivery, despite efforts to speed up the creation of patches and improvements in software updating mechanisms. Vulnerabilities client applications (e.g., Browsers, multimedia players, document readers editors) are often exploited spear phishing attacks difficult characterize using network vulnerability scanners. Analyzing their lifecycle requires observing deployment on hosts around world. Using data collected over 5 years 8.4 million hosts, available through Symantec's WINE platform, we present first systematic study patch client-side vulnerabilities. We analyze process 1,593 vulnerabilities from 10 popular applications, identify several new threats presented by multiple installations same program shared libraries distributed with applications. For 80 our dataset that affect code two time between releases different is 118 days (with a median 11 days). Furthermore, as patching rates differ considerably among many one application but not other one. demonstrate novel enable exploitation invoking old versions used infrequently, installed. also find fraction vulnerable patched when released at most 14%. Finally, show rate affected user-specific application-specific factors, example, belonging security analysts automated have significantly lower times patch.