To patch or not to patch, that is the question

Interesting article from Ryan Naraine about hackers and Microsoft's practice of silently fixing vulnerabilities it finds in code. Microsoft claim that by not drawing attention to new flaws this makes it harder for malware writers to exploit any holes that may be present.

However it seems the baddies are some steps ahead. Every time a patch is released it is studied in depth by being expanded and then compared against an unpatched binary. Hackers can then spot potential vulnerabilities, including ones that may not have been announced and launch suitable attacks.

In the meantime, IT managers may have read the public information and decided the patch isn't that vital - and before you know it - your machine is compromised by a flaw you didn't know was there. Eek. Run Windows update recently?

Read the full story here.