After IE attacks, Microsoft eyes security betas

With hackers actively exploiting an unpatched bug in Internet Explorer (IE), and some users unhappy that a fix for the problem may still be two weeks away, Microsoft says it is looking at ways of providing more rapid security updates.

Hackers began circulating code that exploited this newest IE vulnerability late last week, and to date it has been used on several hundred maliciously encoded Web sites, according to security vendor Websense.

With Microsoft on track to patch the problem on April 11, some in the security community are saying that the software giant is too slow to respond to serious threats.

Microsoft's practice of holding security fixes until the second Tuesday of each month, called "Patch Tuesday" by administrators, can sometimes hurt home users because they may not have the benefit of the "layers and layers" of protection that are typical in corporate environments, said Todd Towles, [cq] a security consultant based in Austin, Texas.

"In the past, I wouldn't have a problem with the Microsoft delay, but this is happening too much," he said. "Microsoft waits for Patch Tuesday to make corporate patch management teams happy, but this is only hurting the millions of home users that live at a higher security risk."

Microsoft is looking at ways to provide a speedier update, although at present it has no plan to release beta versions of its security updates, said Stephen Toulouse, [cq] a security program manager with Microsoft's security response center. "There are some huge challenges to that," he said.

First and foremost is the issue of quality control. Microsoft must ensure that its updates work on a wide range of platforms, many of which have been changed for use in different parts of the world. "We can't leave anybody behind," Toulouse said. "And unfortunately you might be introducing new problems. So whenever we look at even a quick hack ... it's got to be of quality. That's what customers have told us time and again."

"That's not to say that we're not examining some ways that we could ... have an accelerated or maybe a less tested update, but we haven't made any determinations on that," he added.

The idea of releasing unsupported software is not exactly new to Microsoft. The company has been releasing beta versions of its products to early testers for years now, and in recent months it has moved to be more transparent and more agile in the way it releases code that will be in upcoming products.

Still, a beta process that works for commercial software may not be well suited for security updates.

If Microsoft were to release an early patch of an unknown security vulnerability, for example, it could be tipping off hackers to a new type of attack.

"There might be privately reported issues that end up being in that update that haven't been disclosed yet," Toulouse said. "When we put out the bulletin, we talk about the information in the vulnerabilities ... with a beta, how does that work exactly? Do you put out a kind-of-a-bulletin?"

Whatever changes Microsoft may be considering, its slow response to critical bugs is creating a void that others have been filling over the past few months.

On Monday, security vendors eEye Digital Security and Determina posted patches that fixed the latest IE bug. And two months ago software developer Ilfak Guilfanov [cq] released a widely adopted patch that fixed a similarly critical IE bug.

Users who want to be sure to avoid this latest vulnerability can either turn off the browser's Active Scripting capability or install one of the unsupported patches. The latter option is not recommended by Microsoft, which says it cannot recommend third-party patches that "modify the way the product itself operates" because they might not be compatible with other applications.

Towles believes Microsoft should go ahead and release early security updates. "Microsoft stays on the side and lets vendors push out test patches, letting them take the blame for anything that might break," he said. "They let us use SQL [Server] beta, why not provide a beta IE patch?"

The eEye patch can be found here:

The Determina patch is here:

Microsoft's comments on these patches are here:

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments


James Cook University - Master of Data Science Online Course

Learn more >


Sansai 6-Outlet Power Board + 4-Port USB Charging Station

Learn more >



Back To Business Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?