[ad]<\/p>\n
As far as I know this has been happening for some time, sometimes a patch comes out for a vulnerability that many people don’t know about (including the hackers) so they will see what problem the patch fixes (possibly through reverse engineering) then develop an exploit to leverage on the flaw.<\/p>\n
It seems things are a little more advanced now with some semi-automated tools to do the job.<\/p>\n
The length of time between the development of security patches and the development of exploits targeting the security holes they address has been dropping for some time.<\/p>\n
Hackers exploit this period of time – the so-called patch window – to launch attacks against unpatched machines. Typically, exploits are developed by skilled hackers versed in the arcane intricacies of reverse engineering.<\/p>\n
However, hackers have now begun using off-the-shelf tools to at least partially automate this process, a development that might lead to exploits coming out hours instead of days after the publication of patches.<\/p><\/blockquote>\n
It certainly does make the time between patch and exploit a lot faster, and this is fairly new. Thankfully someone has taken it upon themselves to research this subject further and educate us all about it.<\/p>\n
It’s a scary thought having a working exploit a few minutes after receiving a patch! As you know many people don’t keep patches up to date, and those that do might only apply it after a few days so it gives the bad guys a dangerous windows in which they can mass-exploit people.<\/p>\n
Security researchers at Berkeley, the University of Pittsburgh, and Carnegie Mellon have launched a research project investigating the approach<\/a> [PDF], which relies on comparing the configuration of patched and unpatched machines.<\/p>\n
In some cases hackers are able to develop an exploit just minutes after receiving a patch. Fortunately, for now, the technique is rather hit and miss. More often than not the semi-automated process creates tools that only crash vulnerable applications, rather than creating a means to inject hostile code onto vulnerable machines.<\/p>\n
Over time the technique is only likely to get more reliable.<\/p><\/blockquote>\n
I am certainly sure the technique will get refined and become more effecient over time as with everything, the fact that it exists shows the evolution of hacking and that the boundaries are always going to be pushed aside.<\/p>\n
Certainly something interesting to keep an eye on.<\/p>\n
<\/p>\n