Slashdot Log In
Homeland Security says 'Patch Windows Now'
Posted by
timothy
on Thu Aug 10, 2006 08:02 AM
from the well-that's-paraphrased dept.
from the well-that's-paraphrased dept.
gregger writes "Wow, so the Department of Homeland Security is really concerned with Microsoft patches now... enough to come out and tell us to patch our machines. This warning, chronicled in eWeek, was issued less than a day after the release of 23 patches from Redmond. So, if you don't apply the patches, then what?"
Related Stories
[+]
Backslash: Terror Plot, NASA, DHS Patch Alert 341 comments
Read on for some of the most interesting comments from yesterday's stories on NASA's lost moon-walk tapes, the reported foiling of a large-scale terror attack planned against the U.S. to have been staged from the U.K., and the Department of Homeland Security's sudden warning to patch Windows with the latest security updates, in today's Backslash summary of those conversations.
[+]
Your Rights Online: The Self-Modifying EULA? 279 comments
An anonymous reader asks: "Years ago, when I first installed Windows 2000, I accepted its EULA. Despite serious defects in the product, I resisted installing Service Packs because they modify the original EULA. Now even Homeland Security is on my back to upgrade and install a fix. I would be happy to install SP4 and all the security patches BUT ONLY IF IT IS DONE UNDER THE ORIGINAL EULA. Otherwise, Microsoft has made me an unwilling zombie. The clear fact is that Microsoft delivered a defective product- should not allow them to redefine our agreement. I cannot think of any other market that successfully browbeats its customers in this manner. Can this be legal? Has it been tested in court?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Two Reactions (Score:5, Insightful)
On one hand, this announcement shows that the government is looking out for us. They are concerned about terrorists using our machines to commit acts of cyber terrorism. They are helping us protect ourselves by advising that we patch our machines with hyper critical updates from Microsoft. We should be glad that our government is so thoughtful and has decided to twist Microsoft's arm into fixing these problems and releasing updates. After all, as Americans, nothing is more important to me than my internet. It's my commerce, education, and
On the other hand, should we be suspicious? I mean, there have been much more severe critical problems with prior editions of Windows that the government hasn't deemed necessary to recommend. How do we know that these patches aren't part of some sort of government initiative to harvest data? I mean, we've seen it with our phones and e-mail--why not another form of technology? Could it be that these patches will occasionally phone Microsoft who then relays our data and actions to the FBI and/or NSA? Shouldn't we be suspicious that the government has never openly declared critical Linux updates [us-cert.gov] an imperative? Why Windows? And how can we believe them if we never get to see the source code of the original program and the source code of the patches? Two points to note: Why now? And why isn't the government's warning message included with specific reasons and details of what the problems are and what the patch is going to do? These patches might be a wolf in sheep's clothing. I don't think the government is so worried about our interests but more so they're worried about the gathering of intelligence in their case against every single United States citizen.
Re:Two Reactions (Score:5, Funny)
This is Slashdot, that last bit was assumed.
Parent
Re:Two Reactions (Score:5, Funny)
The terrorists win.
Simple logic.
Parent
Re:Two Reactions (Score:3, Funny)
Re:Two Reactions (Score:5, Insightful)
Parent
Re:Two Reactions (Score:5, Insightful)
Because the government isn't that competent or clever. The effective 'intelligence' of any organization is inversely proportional to its size.
Parent
Or (Score:4, Funny)
That's what they WANT you to think
_
Parent
Re:Two Reactions (Score:5, Insightful)
Now, since government is comprised of humans as well, it also must have checks and balances in place to ensure that those in power don't lie, steal, cheat, murder and rape their way through life, much to the misery of the people they rule. For examples of this, see any totalitarian regime. ie: North Korea
You say this as if you actually prefer strong authority figures keeping the world in order for you because you are unable to do it yourself.
Are you able to keep the whole world in order? You do realize at there's 6 billion people on the planet right? Most of them would kill you, your family, and everyone you know, if it made their lives even marginally better. So go ahead, try to "keep the world in order", I'm sure that'll work out great for you, by yourself. What's that? You'll get some friends to help? You do realize you just created a government then, right? Albiet, an informal government that probably would rule by force. Good job.
All that being said, I do value my privacy and freedoms greatly. I wish the government would stay out of my life. However, I also appriciate the fact that the crazies down the street know that their asses will end up on jail, should they try to hurt me or my family.
Parent
Re:Two Reactions (Score:5, Interesting)
This is unprecedented action. Why now?
Parent
68% (Score:4, Funny)
Parent
Re:Two Reactions (Score:5, Insightful)
Well, the first time anyone does anything it's unprecedented by definition.
Parent
Re:Two Reactions (Score:5, Insightful)
Should we: A) rejoice because someone of authority has finally been sold on Windows security through patching by some qualified expert, B) assume that there's a greater conspiracy at work here which involves improving the government's ability to surveil their constituency, or C) imagine that there's a very legitimate, non-civil-liberties threatening need for the government to urge the users of the majority operating system in the United States, and very possibly the world, to maintain their systems at a sensible level of security? Maybe Al-Quaida (sp?) communicates via holes in certain unpatched systems (wild-guess speculation), or maybe terrorists are being funded by income brought in by spam-bots and zombie machines (plausible).
The real problem is that our cynicism makes viewing realistic possibilities hard to imagine, and our tools go logical deduction sort of seem to fail. Occam's razor can't be used in a situation like this because time has proved over and again that the interests of people at the government level aren't always in the interest of people at the constituency level. This is one of those times that we (the slashdot conflux) would like to imagine that someone (like Lawrence Lessig or Brad Templeton) has finally said something to an official that he finally understood and as a result has taken this action, but since we often have a hard time getting our own management to listen to the good ideas we put forth, we're hesitant to believe such a thing has happened. In fact, given the recent history of our government, we're much more inclined to consider a sinister purpose. The DHS press release has many of the "hidden agenda" trappings, like specifically indicating which patch to apply, as well as the call of immediacy.
Just to put things in perspective; right now, Britons are unloading all liquids and gels into trash cans prior to boarding US-bound planes, while we're wondering if the US government is acting in our best interest by adamantly suggesting we patch our Windows computers.
Parent
Re:Two Reactions (Score:5, Insightful)
and they have a vested interest.
Parent
Sorry, slashdot is just tinfoil hat heavy (Score:5, Insightful)
Sorry, but these two post really comment on the sad state of affairs on slashdot. Slashdot is a bit heavy with tinfoil hat types. One of the primary rules of espionage is to just blend in, fade into the background, don't call attention to yourself. If the government were to do something like this, and I don't believe they would, it would be quietly slipped into a run of the mill security update. Nothing special, just a routine monthly security update like the ones we have come to expect.
Parent
Re:Sorry, slashdot is just tinfoil hat heavy (Score:5, Insightful)
Sorry, but you're going to have to go find some impressionable young mind that doesn't know any better to buy that. I'm old enough to remember how Reagon was demonized just like Bush Jr., how Reagan/Fallwell were going to turn the US into a theocracy,
The truth is the people, the voters, are in control. Politicians of the left and right are only getting away with what the voters *allow* them to get away with. Stupid crap happens because the irritation level does not rise to a level that motivates enough voters. When politicians do cross that line they get whacked down by the voters.
Parent
Re:Sorry, slashdot is just tinfoil hat heavy (Score:5, Interesting)
Firstly, I'm old enough, too. Reagan was a porn star compared to Bush Jr. and Crew. This goes beyond Bush. This enters the Senate, the House and now the Supreme Court. Zoning boards across the nation are zoning anything the chrisitians don't like out of town (porn shops, strip clubs, etc). Are you old enough to remember the hub-bub about Janet's boob? When was "intelligent design" even on the table at school boards, let alone a serious consideration?
The truth is the people, the voters, are in control. Politicians of the left and right are only getting away with what the voters *allow* them to get away with. Stupid crap happens because the irritation level does not rise to a level that motivates enough voters. When politicians do cross that line they get whacked down by the voters.
So, what you're saying is you're old enough to remember the dream, but haven't awakened to the reality yet? 'pubs are fixing elections across the country, ADMITTING to fixing elections, and no one raises an outcry. Of course, give people even the whiff that their american idol election is fixed and then you'll get a letter-writing campaign.
Parent
Re:Two Reactions (Score:4, Insightful)
It seems to me that if the terorists wanted to cause chaos and confusion, they've been doing a good job. Look at how we have to analyze this to see just what the DHS is up to, rather than simply thinking "Hey, patching my copy of Windows is probably a good idea." It's funny that when Microsoft says apply the patch, we dutifully go about it and grumble about all the bugs in their software, but when DHS says to do it, it's part of some sinister plot... or is it? We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job. THe thing that maes this problematic is that DHS is being pretty cryptic, and they have no track record of doing this. It'll be interesting to see if this happens again when the next MS patch cycle occurs.
Parent
Re:Two Reactions (Score:5, Insightful)
Parent
Re:Two Reactions (Score:5, Insightful)
Announcing that it is a good idea to apply security patches to computer systems is a fairly safe way to appear busy.
The security level bullshit is another great example -- if they think something is neccesary during a 'red', then it is probably a good idea to do it during a 'yellow', as their intelligence is bound to not be perfect. Announcing the 'red' and then doing stuff related to it makes them look busy.
Parent
Re:Two Reactions (Score:4, Informative)
Except that's not what they want to do. They (and by "they" I mean Islamist terrorists) want everyone in Dar al-Harb to either become Muslim and join the Dar al-Islam, or die. Sowing confusion isn't really a part of either of those.
Parent
Re:Two Reactions (Score:5, Interesting)
Wikipedia (Unless you think I've conspired to make up the entry here):
"The department was created from 22 existing federal agencies in response to the terrorist attacks of September 11, 2001."
Making a single department from 22 agencies is called consolidation.
Next, distractions: An alert system which never goes off alert is not an alert system at all. It's a continuous message to be vigilant, which is not information, it's a fear tactic. What's more, there would have been a massive uproar if the government had no internal response to the hijackings, so they took existing groups and rebranded them as a single simple solution to the communication problem. Then muddied up the water with reorgs and ill-managed funding.
http://www.usmayors.org/72ndWinterMeeting/homelan
http://hsgac.senate.gov/index.cfm?FuseAction=Pres
these go on and on. It's the '80's Pentagon spending all over again.
Stop worrying about how I say something and actually take a look around.
Parent
Re:Two Reactions (Score:3, Insightful)
Re:Two Reactions (Score:3, Insightful)
Two reasons for this: market share and business interests.
Windows simply has a bigger market share, which makes critical flaws a far bigger threat. It is just easier to gather up a botnet of 50000 Windows machines before somebody notices than to get that many *nix machines.
And the government is interested in what businesses need. Microsoft has been campaigning for years against Linux, whic
Paranoid poster doesn't search enough (Score:3, Informative)
Actually, they did that. You just didn't bother looking. http://www.kb.cert.org/vuls/id/650769 [cert.org]
http://www.us-cert.gov/cas/techalerts/TA06-220A.ht ml [us-cert.gov]
The cynical side of me also says that some department in the United States got hacked into. They do say that the exploits were being used but dont go futher.
Re:Two Reactions (Score:5, Insightful)
From the article: "This vulnerability could impact government systems, private industry and critical infrastructure, as well as individual and home users"
I think that statement is pretty much an ordered list of government priorities when urging these security measures. Why is the government getting involved? They're looking out for their own interests. The average government worker is likely sitting on a windows workstation right now, surfing the internet with IE, creating a presentation in Powerpoint, running some calculations in Excel, or typing a document in Word... and they probably don't even have the administrative rights to run their own updates, so they sit around waiting for some IT grunt to get off his lazy ass and do it for them.
Even as we speak, I'm sitting at a Windows work station without version management and without admin rights. I have to use the company standards of IE and Office because I can't install Mozilla and OpenOffice. I don't even know if our IT department is aware that they need to run any patches. I haven't seen them do it since I've started working here. And what's worse, I'm working for a government contractor which is always making a lot of fuss about security!
Which brings me to my next point. The government is also looking out for industry and commerce. I'm sure you've noticed the U.S. economy isn't what it used to be. The last thing this country needs is a cyber attack wreaking havoc among businesses and putting even less trust in online commerce than there already is.
Shouldn't we be suspicious that the government has never openly declared critical Linux updates [us-cert.gov] an imperative?
Actually, the DHS has funded open source security auditing [itworld.com]. Its true, they have never made it an imperative critical update, but you have to take into account the users and usages of open-source products. If you've installed and/or administrated Linux, its very likely you have enough know-how that you don't need a government warning to get you to stay on top of security patches.
Windows, however, is the most widely used operating system, especially for people who don't have the first clue about security or administration. How many Windows users out there use Administrator as their standard account? People like that need to be warned about the importance of updates.
While I'm not going to deny the possibility that they do have more up their sleeves, I think the past couple years have made me less likely to don the tin foil. With the terrorist attacks, resulting WMD wars, Gee Dubya elections, and blatant fear-tactics, I've really begun to realize that "government intelligence" truly is an oxymoron.
--
Take off every sig. Move sig for great justice.
Parent
Re:Two Reactions (Score:4, Interesting)
How about monitoring 10 million phone calls [washingtonpost.com]?
And with a handy backdoor installed monitoring computers would be even easier to automate.
I'm not saying they have, merely that your pooh-poohing of the whole idea is a bit baseless when they've already been caught doing essentially the same thing in a different medium.
Sorry, just to clarify:
The constant exposes of systematic corruption throughout all levels of the US government, from pre-warnings of 9/11 through to financial scandals to the gutting of judicial oversight and introduction of almost limitless executive power for the Whitehouse... two blatantly corrupt elections, at least one illegal war and enough lying, bullshit and willful misrepresentation to indict and incarcerate any normal group of people ten times over... and all this means you're less likely to don your tinfoil hat?
The only way this makes sense to me is if you're saying conspiracy theories shouldn't attract tinfoil hat accusations any more... because everyone knows they're watching you, lying to you and breaking the law all the damn time?
Parent
Re:Two Reactions (Score:3, Insightful)
I think the "government" has a lot better things they should be worrying about.
I don't see where this is anything close to hand-holding. You aren't being forced to do anything, the government isn't doing it for you, and if you don't do it, they aren't going to come after you. There's nothing wrong with a PSA that encourages people to secure their computers.
And if you really need a reason for it all, it costs tax dollars to deal with things like identi
Re:Two Reactions (Score:5, Insightful)
By "government" I of course refer to the current administration.
Uh... M$ was making buggy software long before the "current administration" came to power. Just like the plotting for 9-11, wars between Arabs and Israelis, wars in general, global warming, hurricanes and so on all predate the current administation. I'm not saying the current admin is perfect or that previous admins are 100% to blame, but I think you need to spread that blame around.
It's bad enough people think that history began when they were born, but there is no excuse for thinking all problems began less than seven years ago, provided you can read.
Parent
Then What? (Score:5, Funny)
Re:Then What? (Score:5, Funny)
Parent
so.... (Score:5, Insightful)
Re:so.... (Score:5, Insightful)
Parent
OMG (Score:3, Funny)
Typical over-reaction from the Slashdot staff (Score:3, Insightful)
Hmm.. (Score:3, Funny)
They buy you a brand new Intel Mac! Courtesy of U.S. taxpayers.
Meh (Score:5, Interesting)
Anyway, this isn't that big a deal.
Ahh I can see it now... (Score:4, Funny)
Download link for patches (Score:5, Funny)
I now practice secure computer usage. (Score:3, Funny)
Hey! (Score:4, Funny)
So, if you don't apply the patches, then what?" (Score:3, Funny)
then... (Score:3, Funny)
GET HIM!!!!!
Cracking down on piracy (Score:4, Funny)
US Threat Level (Score:5, Funny)
The government also raised the security alert level for Windows users from Purple to Pink after Microsoft announced it had foiled a plot to make Windows more secure.
The real issue (Score:5, Informative)
Affected programs and services:
- MS Server Services (TCP 139 and 445).
- DNS servers
- Internet Explorer
- Outlook Express
- Microsoft Management Console
- HTML Help
- Visual Basic
- Microsoft Office
- Windows kernel
I'm not too surprised that they're trying to push awareness of this patch. It was the lack of patching several weeks beforehand that allowed Code Red to do as much damage as it did.
Re:A plot? (Score:5, Insightful)
Also, to be cynical as ever, we DO have elections coming up in a few months.
As far as I'm concerned, the boy has cried wolf far too many times for me to react to any warning DHS or any other governmment agency says about threats.
Parent
Re:A plot? (Score:3, Informative)
Re:Since you are a system administrator... (Score:4, Informative)
One should probably never have 139 and 445 exposed directly to the internet, one should probably only have them exposed beyond an individual workstation if that workstation is part of a realish network (eg, three pcs that never talk to each other plugged into the same linksys router wouldn't count). When in doubt, block it and see what happens.
Parent
Re:Otherwise the NSA won't be able to "help" you (Score:3, Informative)
The opensource firewall only protects you from them initiating contact to your machine from outside. It doesn't prevent hidden reports being sent out. That takes a lot of human monitoring, and some packets, you just don't know the real content/conte
Re:NSA patch (Score:4, Funny)
hmm, what's with the black helicoptor outside. Woah, look at the scope on that guys rif
Another strike from the Grammar and Spelling Department (Apostrophe Patrol).
Parent