In a recent episode of the Security Now! podcast, Steve Gibson brought up a question that’s been bobbing around in my mind for several years. Despite the name of the podcast, on this episode he offered a more sedate perspective on the issue of zero-day vulnerabilities than we might be used to getting from cybersecurity mavens:
Thanks to a great deal of effort being made by mainstream software publishers, aided by a massive, distributed, and growing community of security researchers, and even with some inadvertent help from the bad guys, today’s devices, even though we absolutely positively know they still contain known and unknown vulnerabilities, are more than secure enough for nearly everyone to use without worry. Only those very few who are likely to be targeted by nation-state actors have any real reason for concern.
So, yeah. We’ll talk about zero-day vulnerabilities. We’ll point them out. We do need to keep them under control. But by no means should anybody inconvenience themselves, for example, updating their iPhone from 14 point whatever the last one was, or the very first 15 to 15.0.2 today, because there was a problem that was known being found exploited in the wild. It has to have been the case that that was being used by somebody in very tightly targeted attacks. And that’s just not going to affect most of us.
[emphasis added]
If we follow the news relating to cyber-attacks, a pattern quickly becomes evident–these attacks appear to focus largely on two categories of target from two distinct types of perpetrator. On the one hand, large organizations (government agencies, institutions, businesses) tend to be preyed upon by ransomware campaigns from private criminal gangs; and on the other hand, high-profile individuals (high-ranking government officials, political figures, dissidents) are more prone to drawing attention from state actors for espionage/surveillance purposes.
Apparently not included in either of these threat categories are run-of-the-mill private individuals. And if you think about it, there is sense to this madness: organizations with a lot of money and people with a lot of power offer the prospect of much bigger “returns” for the effort expended in handling these, uh, “customers.” It’s worth it in such cases to create those “specially crafted websites” that Microsoft patch descriptions so often speak of, and the sophisticated APT campaigns that go into luring this kind of clientele.
This does not mean that we can just proceed in happy-go-lucky fashion with no security or precautions whatever, but it does make me wonder if we, as individual end users, haven’t been led to worry excessively that we might not be running the latest version of Windows with every single available patch installed and multiple layers of security wrapped around our home PCs for good measure.
So the question I’d like to ask is: does anybody have good data to share on the level of risk that ordinary private users face from the vulnerabilities that are typically addressed on Patch Tuesday? To borrow a term that has come into general use in the last 22 months or so, is there a good handle on the “infection rate” from these vulnerabilities?
Note that I’m not talking about the cheap, lazy phishing attempts that we can spot in our inbox a mile away, but about the sophisticated kinds of vulnerabilities that Windows patches are meant to address.
