security alert or reminder – that’s the question

Related stories

Early Warning System – taking 8 steps toward developing key performance indicators that make sense

B Early Warning System

Early Warning System EWS – better late than never NOT

Recently, Apple issued an other security update for Quicktime. As you probably know, Quicktime is part if iTunes. Moreover, many music, podcast and TV show afficionados manage their favorite tunes and shows with this software (e.g., iPod users)The Software Update preference pane with most software providers such as Mozilla (e.g., Firefox) or Apple is set-up to check for software updates automatically by default. Some packages may offer users to change the check interval from weekly to daily or monthly, or to turn off scheduled checks if desired.Apple released an update by about midnight Monday and the first alert was provided at o3:00 hours Tuesday by:

– Secuser alert in French – forgets to tell us about iTunes having Quicktime included

When we learned about this security update, we felt that it was not really helpful to call it an advisory. While it is an important security patch, many users may have already downloaded the patch by the time they would receive our mailing. Nonetheless, those that changed default settings or did not launch iTunes or Quicktime (i.e. the programs could not check for updates) increased their risk explosure by not having installed the latest version.

Hence, mid-morning Tuesday we decided to release a what we call reminder. In this we told people about the vulnerabilities and, most importantly, why they had to update and how they could make sure that the latest version was running on their equipment:

via WinCurity – CASEScontact.org – CyTRAP Labs reminder – update Quicktime (iTunes)

Early Wednesday, US-CERT released an alert to its subscribers about this update pointing out that it also affected iTunes users:

– USA-CERT – National Cyber Alert System Cyber Security Alert SA07-310A – Quicktime

Looking at the above it is obvious that by Wednesday, many iTunes users had already downloaded the latest version from Apple. Our test machines using Apple’s default set-up were beginning to download around noon and finished by 21:00 hours.

Hence, our WinCurity reminder reached most European users shortly before their automatic set-up did the job. With this we intended to get those people into action that may have:

– disabled the automatic update or else,

– changed it to a monthly check-up, or

– had not been running iTunes or Quicktime for a few days, thereby not enabling these programs to check for updates on Apple’s webpage, or finally

– to assist those who may not connect their PC via a broadband connection – deciding to refuse the download for now but getting it later (our reminder would explain why they should get it quick if possible).

CONCLUSION

We believe that an alert or an advisory issued by an early warning system (EWS) reaching users after the program default has already made a check and downloaded the security update does not warrant issueing an alert.

What we should worry about, however, are those users who change default settings or who might not want to download right now due to various reasons (e.g., slow online connection, paying per MB download, etc.) . A reminder can make sure that these people will do so at the earliest convenience.

Sending an alert when people’s machines have already been updated may raise questions in subscribers minds about the relevancy of such an alert even though the information is still important.

What rules we use before we issue an alert you can read about here:

what it takes before we send out an advisory

PS. 1

Our time reference point is GMT to compare the different services mentioned above.

SUBSCRIPTION

To make it more convenient for you to take advantage of CyTRAP Labs’ offerings, just provide us with your e-mail address below. You can personalize your subscription to make it suit your needs.