Homeland Security says 'Patch Windows Now'

gregger writes "Wow, so the Department of Homeland Security is really concerned with Microsoft patches now... enough to come out and tell us to patch our machines. This warning, chronicled in eWeek, was issued less than a day after the release of 23 patches from Redmond. So, if you don't apply the patches, then what?"

Two Reactions

In my country, the United States of America, I have never seen everyone so polarized. As a result, I personally highly value the ability to see actions and events from both sides. It's a becoming a rare trait.

On one hand, this announcement shows that the government is looking out for us. They are concerned about terrorists using our machines to commit acts of cyber terrorism. They are helping us protect ourselves by advising that we patch our machines with hyper critical updates from Microsoft. We should be glad that our government is so thoughtful and has decided to twist Microsoft's arm into fixing these problems and releasing updates. After all, as Americans, nothing is more important to me than my internet. It's my commerce, education, and ... uh ... love life. I wouldn't care if terrorists destroyed every TV & radio station in the United States, but I would riot if I was denied an internet connection for more than a few weeks. They're just protecting my interests much like a public service announcement or a tornado warning. I mean, the US-Cert team has been doing this for a while--even on my Mozilla [us-cert.gov] browser. This "Patch Windows Now or Else..." is just FUD from the Slashdot editors--if you read the government press release, it's merely a recommendation, not a demand, warning or threat to patch your machine.

On the other hand, should we be suspicious? I mean, there have been much more severe critical problems with prior editions of Windows that the government hasn't deemed necessary to recommend. How do we know that these patches aren't part of some sort of government initiative to harvest data? I mean, we've seen it with our phones and e-mail--why not another form of technology? Could it be that these patches will occasionally phone Microsoft who then relays our data and actions to the FBI and/or NSA? Shouldn't we be suspicious that the government has never openly declared critical Linux updates [us-cert.gov] an imperative? Why Windows? And how can we believe them if we never get to see the source code of the original program and the source code of the patches? Two points to note: Why now? And why isn't the government's warning message included with specific reasons and details of what the problems are and what the patch is going to do? These patches might be a wolf in sheep's clothing. I don't think the government is so worried about our interests but more so they're worried about the gathering of intelligence in their case against every single United States citizen.

Re:Two Reactions

It's my commerce, education, and ... uh ... love life.

This is Slashdot, that last bit was assumed.

Re:Two Reactions

So, if you don't apply the patches, then what?

The terrorists win.

Simple logic.

Re:Two Reactions

I'm sorry that you are so scared of the truth that you jump at such a weak opportunity to keep the rug from being pulled out from under you. Who are "they" that you speak about? You say this as if you actually prefer strong authority figures keeping the world in order for you because you are unable to do it yourself. There is no "they" that either care or don't care for this country and its people, becase the government is made up of thousands upon thousands of people with different ideas and goals, some of them good, and some of them very sinister. Stop laying your parental fantasies on top of the government, because others like myself prefer not to have these nannies looking over our shoulders, especially when some of them have already proven to be homicidal.

Re:Two Reactions

How do we know that these patches aren't part of some sort of government initiative to harvest data?

Because the government isn't that competent or clever. The effective 'intelligence' of any organization is inversely proportional to its size.

Or

>_>

That's what they WANT you to think

_ /tinfoilhat on

Re:Two Reactions

That's a completely nieve sentiment. I'm sorry, but government, at least in some form, is absolutely necessary. How do I know? I'm human. And by and large, humans are greedy, amoral, unethical creatures that left to their own devices lie, steal, cheat, murder and rape their way through life. Don't believe me? Look at any area of the modern world lacking a strong government, like Africa.

Now, since government is comprised of humans as well, it also must have checks and balances in place to ensure that those in power don't lie, steal, cheat, murder and rape their way through life, much to the misery of the people they rule. For examples of this, see any totalitarian regime. ie: North Korea

You say this as if you actually prefer strong authority figures keeping the world in order for you because you are unable to do it yourself.

Are you able to keep the whole world in order? You do realize at there's 6 billion people on the planet right? Most of them would kill you, your family, and everyone you know, if it made their lives even marginally better. So go ahead, try to "keep the world in order", I'm sure that'll work out great for you, by yourself. What's that? You'll get some friends to help? You do realize you just created a government then, right? Albiet, an informal government that probably would rule by force. Good job.

All that being said, I do value my privacy and freedoms greatly. I wish the government would stay out of my life. However, I also appriciate the fact that the crazies down the street know that their asses will end up on jail, should they try to hurt me or my family.

Re:Two Reactions

What a remarkable commentary on the sad state of affairs in the "Land of the Free" that our government makes a press release regarding patches to our computers and the first thing we think of is that the patch is associated with monitoring us somehow. For the record, I had the exact same thought as the OP and agree 100% with what he said.

This is unprecedented action. Why now?

68%

I agree 67.314159% with everything the OP said!

Re:Two Reactions

This is unprecedented action. Why now?

Well, the first time anyone does anything it's unprecedented by definition. ;) As to why, because they felt it was necessary. The reason for the necessity is left as an exercise for the reader since I have no idea. Maybe the government wants to p0wn your PC more than they do already. Maybe they know of a specific threat from an enemy state or terrorist group and are taking precautions. Or maybe, just maybe, they are sick of 50,000 zombies spamming herbal Viagra ads to their personal e-mail accounts.

Re:Two Reactions

We (The slashdot conflux) have always advocated improved computer security, particularly in the case of the Windows operating system. Patches have proven to be an effective method for maintaining said system against such related problems, and from the position of the corporate sys-admin down to the family's IT technician, we've always made it a point to ensure the most updated patches were in place. Now it's finally a matter of the government's to help ensure all the citizens of this country take similar steps.

Should we: A) rejoice because someone of authority has finally been sold on Windows security through patching by some qualified expert, B) assume that there's a greater conspiracy at work here which involves improving the government's ability to surveil their constituency, or C) imagine that there's a very legitimate, non-civil-liberties threatening need for the government to urge the users of the majority operating system in the United States, and very possibly the world, to maintain their systems at a sensible level of security? Maybe Al-Quaida (sp?) communicates via holes in certain unpatched systems (wild-guess speculation), or maybe terrorists are being funded by income brought in by spam-bots and zombie machines (plausible).

The real problem is that our cynicism makes viewing realistic possibilities hard to imagine, and our tools go logical deduction sort of seem to fail. Occam's razor can't be used in a situation like this because time has proved over and again that the interests of people at the government level aren't always in the interest of people at the constituency level. This is one of those times that we (the slashdot conflux) would like to imagine that someone (like Lawrence Lessig or Brad Templeton) has finally said something to an official that he finally understood and as a result has taken this action, but since we often have a hard time getting our own management to listen to the good ideas we put forth, we're hesitant to believe such a thing has happened. In fact, given the recent history of our government, we're much more inclined to consider a sinister purpose. The DHS press release has many of the "hidden agenda" trappings, like specifically indicating which patch to apply, as well as the call of immediacy.

Just to put things in perspective; right now, Britons are unloading all liquids and gels into trash cans prior to boarding US-bound planes, while we're wondering if the US government is acting in our best interest by adamantly suggesting we patch our Windows computers.

Re:Two Reactions

I'll just note that DHS is a heavy windows user,
and they have a vested interest.

Sorry, slashdot is just tinfoil hat heavy

What a remarkable commentary on the sad state of affairs in the "Land of the Free" that our government makes a press release regarding patches to our computers and the first thing we think of is that the patch is associated with monitoring us somehow. For the record, I had the exact same thought as the OP and agree 100% with what he said.

Sorry, but these two post really comment on the sad state of affairs on slashdot. Slashdot is a bit heavy with tinfoil hat types. One of the primary rules of espionage is to just blend in, fade into the background, don't call attention to yourself. If the government were to do something like this, and I don't believe they would, it would be quietly slipped into a run of the mill security update. Nothing special, just a routine monthly security update like the ones we have come to expect.

Re:Sorry, slashdot is just tinfoil hat heavy

... a growing theocracy hell-bent (pun intended) on ensuring EVERYONE follows christian beliefs, no matter how whacky ...

Sorry, but you're going to have to go find some impressionable young mind that doesn't know any better to buy that. I'm old enough to remember how Reagon was demonized just like Bush Jr., how Reagan/Fallwell were going to turn the US into a theocracy, ... I'm old enough to remember how Gore was going to outlaw free speech in music and movies, ... I'm old enough to remember how Clinton was demonized, how Clinton was going to turn the US into a socialist state subserviant to the UN, ...

The truth is the people, the voters, are in control. Politicians of the left and right are only getting away with what the voters *allow* them to get away with. Stupid crap happens because the irritation level does not rise to a level that motivates enough voters. When politicians do cross that line they get whacked down by the voters.

Re:Sorry, slashdot is just tinfoil hat heavy

I'm old enough to remember how Reagon was demonized just like Bush Jr.

Firstly, I'm old enough, too. Reagan was a porn star compared to Bush Jr. and Crew. This goes beyond Bush. This enters the Senate, the House and now the Supreme Court. Zoning boards across the nation are zoning anything the chrisitians don't like out of town (porn shops, strip clubs, etc). Are you old enough to remember the hub-bub about Janet's boob? When was "intelligent design" even on the table at school boards, let alone a serious consideration?

The truth is the people, the voters, are in control. Politicians of the left and right are only getting away with what the voters *allow* them to get away with. Stupid crap happens because the irritation level does not rise to a level that motivates enough voters. When politicians do cross that line they get whacked down by the voters.

So, what you're saying is you're old enough to remember the dream, but haven't awakened to the reality yet? 'pubs are fixing elections across the country, ADMITTING to fixing elections, and no one raises an outcry. Of course, give people even the whiff that their american idol election is fixed and then you'll get a letter-writing campaign.

Re:Two Reactions

But mostly I blame the "government" for allowing the situation with Microsoft to exist.

By "government" I of course refer to the current administration.

Uh... M$ was making buggy software long before the "current administration" came to power. Just like the plotting for 9-11, wars between Arabs and Israelis, wars in general, global warming, hurricanes and so on all predate the current administation. I'm not saying the current admin is perfect or that previous admins are 100% to blame, but I think you need to spread that blame around.

It's bad enough people think that history began when they were born, but there is no excuse for thinking all problems began less than seven years ago, provided you can read.

Re:Two Reactions

It seems to me that if the terorists wanted to cause chaos and confusion, they've been doing a good job. Look at how we have to analyze this to see just what the DHS is up to, rather than simply thinking "Hey, patching my copy of Windows is probably a good idea." It's funny that when Microsoft says apply the patch, we dutifully go about it and grumble about all the bugs in their software, but when DHS says to do it, it's part of some sinister plot... or is it? We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job. THe thing that maes this problematic is that DHS is being pretty cryptic, and they have no track record of doing this. It'll be interesting to see if this happens again when the next MS patch cycle occurs.

Re:Two Reactions

We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job.

It's not so much that people have failed to notice the government doing their job for once, several people have shown appreciation of it. It's that the government has been doing corrupt things and not protecting us for so long that people question whether they're really trying to protect us this time. It's kind of like that scene in a lot of movie revolving around highschool, where the popular kids constantly pick on and beat up the dorky kids. Then one day they invite said dork to a party, the dork thinks "wow, they've changed their minds and like me", only to show up and get their ass kicked and/or be the butt of some school wide joke.

Re:Two Reactions

DHS is a big, stupid bureaucracy. Get used to the fact that they are far more concerned with appearing to be doing something than they are with actual security.

Announcing that it is a good idea to apply security patches to computer systems is a fairly safe way to appear busy.

The security level bullshit is another great example -- if they think something is neccesary during a 'red', then it is probably a good idea to do it during a 'yellow', as their intelligence is bound to not be perfect. Announcing the 'red' and then doing stuff related to it makes them look busy.

Re:Two Reactions

Well, let's take a cursory glance then.

Wikipedia (Unless you think I've conspired to make up the entry here):
"The department was created from 22 existing federal agencies in response to the terrorist attacks of September 11, 2001."
Making a single department from 22 agencies is called consolidation.

Next, distractions: An alert system which never goes off alert is not an alert system at all. It's a continuous message to be vigilant, which is not information, it's a fear tactic. What's more, there would have been a massive uproar if the government had no internal response to the hijackings, so they took existing groups and rebranded them as a single simple solution to the communication problem. Then muddied up the water with reorgs and ill-managed funding.

http://www.usmayors.org/72ndWinterMeeting/homeland report_012204.pdf [usmayors.org]

http://hsgac.senate.gov/index.cfm?FuseAction=Press Releases.Detail&Affiliation=C&PressRelease_id=960& Month=4&Year=2005 [senate.gov]

these go on and on. It's the '80's Pentagon spending all over again.

Stop worrying about how I say something and actually take a look around.

Re:Two Reactions

It seems to me that if the terorists wanted to cause chaos and confusion, they've been doing a good job.

Except that's not what they want to do. They (and by "they" I mean Islamist terrorists) want everyone in Dar al-Harb to either become Muslim and join the Dar al-Islam, or die. Sowing confusion isn't really a part of either of those.

Re:Two Reactions

Wow, look at the replies... I love how aroused everyone gets over the prospect of a possible government conspiracy. I think the government really does have its priorities, but monitoring 10 million computers to find out what porn sites people like to visit isn't one of them.

From the article: "This vulnerability could impact government systems, private industry and critical infrastructure, as well as individual and home users"

I think that statement is pretty much an ordered list of government priorities when urging these security measures. Why is the government getting involved? They're looking out for their own interests. The average government worker is likely sitting on a windows workstation right now, surfing the internet with IE, creating a presentation in Powerpoint, running some calculations in Excel, or typing a document in Word... and they probably don't even have the administrative rights to run their own updates, so they sit around waiting for some IT grunt to get off his lazy ass and do it for them.

Even as we speak, I'm sitting at a Windows work station without version management and without admin rights. I have to use the company standards of IE and Office because I can't install Mozilla and OpenOffice. I don't even know if our IT department is aware that they need to run any patches. I haven't seen them do it since I've started working here. And what's worse, I'm working for a government contractor which is always making a lot of fuss about security!

Which brings me to my next point. The government is also looking out for industry and commerce. I'm sure you've noticed the U.S. economy isn't what it used to be. The last thing this country needs is a cyber attack wreaking havoc among businesses and putting even less trust in online commerce than there already is.

Shouldn't we be suspicious that the government has never openly declared critical Linux updates [us-cert.gov] an imperative?

Actually, the DHS has funded open source security auditing [itworld.com]. Its true, they have never made it an imperative critical update, but you have to take into account the users and usages of open-source products. If you've installed and/or administrated Linux, its very likely you have enough know-how that you don't need a government warning to get you to stay on top of security patches.

Windows, however, is the most widely used operating system, especially for people who don't have the first clue about security or administration. How many Windows users out there use Administrator as their standard account? People like that need to be warned about the importance of updates.

While I'm not going to deny the possibility that they do have more up their sleeves, I think the past couple years have made me less likely to don the tin foil. With the terrorist attacks, resulting WMD wars, Gee Dubya elections, and blatant fear-tactics, I've really begun to realize that "government intelligence" truly is an oxymoron.

--
Take off every sig. Move sig for great justice.

Re:Two Reactions

I think the government really does have its priorities, but monitoring 10 million computers to find out what porn sites people like to visit isn't one of them.

How about monitoring 10 million phone calls [washingtonpost.com]?

And with a handy backdoor installed monitoring computers would be even easier to automate.

I'm not saying they have, merely that your pooh-poohing of the whole idea is a bit baseless when they've already been caught doing essentially the same thing in a different medium.

While I'm not going to deny the possibility that they do have more up their sleeves, I think the past couple years have made me less likely to don the tin foil. With the terrorist attacks, resulting WMD wars, Gee Dubya elections, and blatant fear-tactics, I've really begun to realize that "government intelligence" truly is an oxymoron.

Sorry, just to clarify:

The constant exposes of systematic corruption throughout all levels of the US government, from pre-warnings of 9/11 through to financial scandals to the gutting of judicial oversight and introduction of almost limitless executive power for the Whitehouse... two blatantly corrupt elections, at least one illegal war and enough lying, bullshit and willful misrepresentation to indict and incarcerate any normal group of people ten times over... and all this means you're less likely to don your tinfoil hat?

The only way this makes sense to me is if you're saying conspiracy theories shouldn't attract tinfoil hat accusations any more... because everyone knows they're watching you, lying to you and breaking the law all the damn time?

Then What?

"If you don't patch Windows, the terrorists win!"

Re:Then What?

Pf, just wait until we respawn in the second round.

so....

this means the gov't mandated backdoor has been placed in the update queue?

Re:so....

Seriously, people are laughing at the parent post but they would have laughed at a sacastic post about the NSA getting warrentless taps to listen to our phone calls in the recent past as well.

OMG

Then your computer will blow up and we'll all die

Re:A plot?

Or it could be DHS making a publicity move. They've got to justify their budget to the public somehow, and a lot of what they do is behind-the-scenes stuff.

Also, to be cynical as ever, we DO have elections coming up in a few months.

As far as I'm concerned, the boy has cried wolf far too many times for me to react to any warning DHS or any other governmment agency says about threats.

Re:Since you are a system administrator...

These ports have to do with things like name resolution, network file sharing, remote execution, and stuff. I don't really know all the details. While linux can talk samba with windows, it is more a windows to windows kind of thing. Read this for some more info. What port 445 does [petri.co.il]

One should probably never have 139 and 445 exposed directly to the internet, one should probably only have them exposed beyond an individual workstation if that workstation is part of a realish network (eg, three pcs that never talk to each other plugged into the same linksys router wouldn't count). When in doubt, block it and see what happens.

Typical over-reaction from the Slashdot staff

It's just a recommendation, and they've been doing this for a while now. Perhaps this is to save a little face for the massive Rails exploit posted just a few stories below?

Hmm..

"So, if you don't apply the patches, then what?"

They buy you a brand new Intel Mac! Courtesy of U.S. taxpayers.

Meh

So great, DHS is recommending that people keep their machine patched. Anyone who says this is a bad thing has their tinfoil hat on a little too tightly. The only thing that concerns me is that DHS's responsibility in the US government seems to get more and more broad; anything that can be deemed in the protection of "Homeland Security" they can control, from intelligence to customs and border patrol to cyber security.

Anyway, this isn't that big a deal.

Ahh I can see it now...

You wake to a pounding on your door. At your door are two men dressed in suits. you "Umm can I help you." Suits " You're under arrest." you "On what charge?" Suits "For not patching your windows computer." You "patch my what?? I use Linux!" Suits with a baffled look "Lin-what? Are you threatening us?" Suddenly more suits surround you and begin beating you while you hear "King Bill" laughing in the background.

Download link for patches

http://www.ubuntu.com/download [ubuntu.com] :)