Apple is trailing way behind Microsoft in security patch responsiveness, according to a study by security researchers.

Stefan Frei and Bernard Tellenback of the Computer Engineering and Networks Laboratory (TIK) at the Swiss Federal Institute of Technology, analysed several years of vulnerability disclosures and patching processes from various vendors.

They found that Apple is getting worse at dealing with security problems while Microsoft is improving. Apple is experiencing more vulnerabilities, longer patching times, and more attacks on unpatched vulnerabilities, according to the duo.

Frei and Tellenback presented their findings at a presentation entitled 0-day Patch – Exposing Vendors (In)Security Performance at last week's Black Hat conference in Amsterdam. A copy of the presentation can be found here.

Colleagues of the duo reckon Apple's antagonistic attitude with security researchers is one of the reasons for its poor response.

"While I think that there are quite a few reasons why this is probably so, I’d be inclined to say that Apple’s biggest problem appears to be that they treat every new vulnerability as a potential PR disaster rather than an opportunity to visibly reinforce their work in securing their customers," writes Gunter Ollman of IBM's X-Force.

"In recent times this has most critically been reflected in the way Apple works with security researchers." ®

Related stories

• Rare Mac Trojan exploits Apple vuln (23 June 2008)
• Get 'em while they're hot: critical security fixes from Microsoft, Apple (10 June 2008)
• Apple mega update strikes out calendar bug (29 May 2008)
• Researchers out Apple over unpatched iCal bugs (22 May 2008)
• MS patch system poses 'significant risk', say researchers (25 April 2008)
• RSA Old people can sabotage software too (10 April 2008)
• CanSecWest Mac is the first to fall in Pwn2Own hack contest (28 March 2008)
• Mozilla CEO blasts Apple for putting security of the internet at risk (24 March 2008)
• Apple unleashes monster patch batch on Mac faithful (19 March 2008)
• Mac security site littered with malware (12 March 2008)
• Malware authors target Mac emerging markets (25 January 2008)
• Bill kills Bill, UK gov goes nuclear and IT contractors shed tears (11 January 2008)
• Apple keeps critical security fixes to itself (15 December 2007)