Hackers hoarding code to exploit server flaw

While a program to exploit the flaw has yet to be made public, at least one hacker group has already developed such a tool, said Marc Maiffret, chief hacking officer for network-protection company eEye Digital Security.

"Because the hole is so huge, they want to keep the exploit (program) to themselves," he said. "There is a small circle of people that do these types of things who like to be able to say they have it so they can break into servers if they want to."

As first reported by CNET News.com, Microsoft announced Monday that a flaw in the indexing component of its flagship Web-server software--the Internet Information Service, or IIS--could undermine the security of up to 6 million Internet sites.

At the same time, Microsoft released a patch for the flaw with a strongly worded advisory for Web server administrators to apply it immediately.

The flaw, which affects all versions of IIS running under Windows NT, Windows 2000 and a limited-release beta version of Windows XP, could allow hackers to gain complete control of a server.

Typically, within 48 hours of such an announcement, a program to take advantage of the hole will be published to major security mailing lists, forcing system administrators to patch their systems or be left without any meaningful defense. This time, however, no such program has been released to the public.

The lack of a publicized program to exploit the flaw could lull administrators into thinking they are safe, said Chris Wysopal, director of research and development for security firm @Stake.

"People don't patch their systems as quickly if they don't think an exploit is out there," he said. "There are a lot of hacking groups that don't like full disclosure because of the heightened awareness that it brings to security."

"Full disclosure" refers to one side of a battle in security on how much information should be released about software holes. Full-disclosure advocates believe that all information pertaining to a security flaw should be made public. Others believe only the information needed to patch the hole should be released and only when a software company has written a patch.

For the most part, Microsoft takes the latter stance. Scott Culp, security program manager for Microsoft's security response center, said that by releasing the patch and information about the security hole at the same time, Microsoft gives customers a head start on the hackers.

"There is a window of opportunity that is afforded by a good response process that ensures users find out about a vulnerability at the same time as the bad guys," he said. "It gives users a chance to apply the patch before hackers exploit the flaw. That window's going to close. It always does."

For vulnerable Web servers, it already has.