Homeland Security says 'Patch Windows Now' 381
gregger writes "Wow, so the Department of Homeland Security is really concerned with Microsoft patches now... enough to come out and tell us to patch our machines. This warning, chronicled in eWeek, was issued less than a day after the release of 23 patches from Redmond. So, if you don't apply the patches, then what?"
Two Reactions (Score:5, Insightful)
On one hand, this announcement shows that the government is looking out for us. They are concerned about terrorists using our machines to commit acts of cyber terrorism. They are helping us protect ourselves by advising that we patch our machines with hyper critical updates from Microsoft. We should be glad that our government is so thoughtful and has decided to twist Microsoft's arm into fixing these problems and releasing updates. After all, as Americans, nothing is more important to me than my internet. It's my commerce, education, and
On the other hand, should we be suspicious? I mean, there have been much more severe critical problems with prior editions of Windows that the government hasn't deemed necessary to recommend. How do we know that these patches aren't part of some sort of government initiative to harvest data? I mean, we've seen it with our phones and e-mail--why not another form of technology? Could it be that these patches will occasionally phone Microsoft who then relays our data and actions to the FBI and/or NSA? Shouldn't we be suspicious that the government has never openly declared critical Linux updates [us-cert.gov] an imperative? Why Windows? And how can we believe them if we never get to see the source code of the original program and the source code of the patches? Two points to note: Why now? And why isn't the government's warning message included with specific reasons and details of what the problems are and what the patch is going to do? These patches might be a wolf in sheep's clothing. I don't think the government is so worried about our interests but more so they're worried about the gathering of intelligence in their case against every single United States citizen.
Re:Two Reactions (Score:5, Funny)
This is Slashdot, that last bit was assumed.
Re:Two Reactions (Score:5, Funny)
The terrorists win.
Simple logic.
You unpatriotic communist raghead whiner! (Score:3, Funny)
Re:Two Reactions (Score:3, Funny)
Re:Two Reactions (Score:5, Insightful)
Re:Two Reactions (Score:5, Insightful)
Because the government isn't that competent or clever. The effective 'intelligence' of any organization is inversely proportional to its size.
Or (Score:4, Funny)
That's what they WANT you to think
_
Re:Two Reactions (Score:5, Insightful)
Now, since government is comprised of humans as well, it also must have checks and balances in place to ensure that those in power don't lie, steal, cheat, murder and rape their way through life, much to the misery of the people they rule. For examples of this, see any totalitarian regime. ie: North Korea
You say this as if you actually prefer strong authority figures keeping the world in order for you because you are unable to do it yourself.
Are you able to keep the whole world in order? You do realize at there's 6 billion people on the planet right? Most of them would kill you, your family, and everyone you know, if it made their lives even marginally better. So go ahead, try to "keep the world in order", I'm sure that'll work out great for you, by yourself. What's that? You'll get some friends to help? You do realize you just created a government then, right? Albiet, an informal government that probably would rule by force. Good job.
All that being said, I do value my privacy and freedoms greatly. I wish the government would stay out of my life. However, I also appriciate the fact that the crazies down the street know that their asses will end up on jail, should they try to hurt me or my family.
Re:Two Reactions (Score:3, Insightful)
Re:Two Reactions (Score:3, Interesting)
You claim that government keeps people in line. But th
Re:Two Reactions (Score:5, Interesting)
This is unprecedented action. Why now?
68% (Score:4, Funny)
Re:Two Reactions (Score:5, Insightful)
Well, the first time anyone does anything it's unprecedented by definition.
Re:Two Reactions (Score:5, Insightful)
Should we: A) rejoice because someone of authority has finally been sold on Windows security through patching by some qualified expert, B) assume that there's a greater conspiracy at work here which involves improving the government's ability to surveil their constituency, or C) imagine that there's a very legitimate, non-civil-liberties threatening need for the government to urge the users of the majority operating system in the United States, and very possibly the world, to maintain their systems at a sensible level of security? Maybe Al-Quaida (sp?) communicates via holes in certain unpatched systems (wild-guess speculation), or maybe terrorists are being funded by income brought in by spam-bots and zombie machines (plausible).
The real problem is that our cynicism makes viewing realistic possibilities hard to imagine, and our tools go logical deduction sort of seem to fail. Occam's razor can't be used in a situation like this because time has proved over and again that the interests of people at the government level aren't always in the interest of people at the constituency level. This is one of those times that we (the slashdot conflux) would like to imagine that someone (like Lawrence Lessig or Brad Templeton) has finally said something to an official that he finally understood and as a result has taken this action, but since we often have a hard time getting our own management to listen to the good ideas we put forth, we're hesitant to believe such a thing has happened. In fact, given the recent history of our government, we're much more inclined to consider a sinister purpose. The DHS press release has many of the "hidden agenda" trappings, like specifically indicating which patch to apply, as well as the call of immediacy.
Just to put things in perspective; right now, Britons are unloading all liquids and gels into trash cans prior to boarding US-bound planes, while we're wondering if the US government is acting in our best interest by adamantly suggesting we patch our Windows computers.
Re:Two Reactions (Score:5, Insightful)
and they have a vested interest.
Sorry, slashdot is just tinfoil hat heavy (Score:5, Insightful)
Sorry, but these two post really comment on the sad state of affairs on slashdot. Slashdot is a bit heavy with tinfoil hat types. One of the primary rules of espionage is to just blend in, fade into the background, don't call attention to yourself. If the government were to do something like this, and I don't believe they would, it would be quietly slipped into a run of the mill security update. Nothing special, just a routine monthly security update like the ones we have come to expect.
Re:Sorry, slashdot is just tinfoil hat heavy (Score:3, Insightful)
Perhaps, but I would argue that the growing number of tinfoil hats is due to the growing amount of government misconduct going on right now: erosion or outright removal of basic rights, blatant collusion with corporations to screw as much money out of consumers as possible which includes rewriting emminent domain to allow corporations to take people's property, spying on the po
Re:Sorry, slashdot is just tinfoil hat heavy (Score:5, Insightful)
Sorry, but you're going to have to go find some impressionable young mind that doesn't know any better to buy that. I'm old enough to remember how Reagon was demonized just like Bush Jr., how Reagan/Fallwell were going to turn the US into a theocracy,
The truth is the people, the voters, are in control. Politicians of the left and right are only getting away with what the voters *allow* them to get away with. Stupid crap happens because the irritation level does not rise to a level that motivates enough voters. When politicians do cross that line they get whacked down by the voters.
Re:Sorry, slashdot is just tinfoil hat heavy (Score:5, Interesting)
Firstly, I'm old enough, too. Reagan was a porn star compared to Bush Jr. and Crew. This goes beyond Bush. This enters the Senate, the House and now the Supreme Court. Zoning boards across the nation are zoning anything the chrisitians don't like out of town (porn shops, strip clubs, etc). Are you old enough to remember the hub-bub about Janet's boob? When was "intelligent design" even on the table at school boards, let alone a serious consideration?
The truth is the people, the voters, are in control. Politicians of the left and right are only getting away with what the voters *allow* them to get away with. Stupid crap happens because the irritation level does not rise to a level that motivates enough voters. When politicians do cross that line they get whacked down by the voters.
So, what you're saying is you're old enough to remember the dream, but haven't awakened to the reality yet? 'pubs are fixing elections across the country, ADMITTING to fixing elections, and no one raises an outcry. Of course, give people even the whiff that their american idol election is fixed and then you'll get a letter-writing campaign.
Re:Sorry, slashdot is just tinfoil hat heavy (Score:3, Interesting)
Re:Sorry, slashdot is just tinfoil hat heavy (Score:3, Insightful)
The updates are automatic. You have to manually disable that feature. Do you really think the type of person who would manually disable automatic updates is going to run out and do whatever Homeland Security says to do?
Re:Two Reactions (Score:4, Insightful)
It seems to me that if the terorists wanted to cause chaos and confusion, they've been doing a good job. Look at how we have to analyze this to see just what the DHS is up to, rather than simply thinking "Hey, patching my copy of Windows is probably a good idea." It's funny that when Microsoft says apply the patch, we dutifully go about it and grumble about all the bugs in their software, but when DHS says to do it, it's part of some sinister plot... or is it? We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job. THe thing that maes this problematic is that DHS is being pretty cryptic, and they have no track record of doing this. It'll be interesting to see if this happens again when the next MS patch cycle occurs.
Re:Two Reactions (Score:5, Insightful)
Re:Two Reactions (Score:5, Insightful)
Announcing that it is a good idea to apply security patches to computer systems is a fairly safe way to appear busy.
The security level bullshit is another great example -- if they think something is neccesary during a 'red', then it is probably a good idea to do it during a 'yellow', as their intelligence is bound to not be perfect. Announcing the 'red' and then doing stuff related to it makes them look busy.
Re:Two Reactions (Score:3, Funny)
Re:Two Reactions (Score:4, Informative)
Except that's not what they want to do. They (and by "they" I mean Islamist terrorists) want everyone in Dar al-Harb to either become Muslim and join the Dar al-Islam, or die. Sowing confusion isn't really a part of either of those.
Re:Two Reactions (Score:5, Interesting)
Wikipedia (Unless you think I've conspired to make up the entry here):
"The department was created from 22 existing federal agencies in response to the terrorist attacks of September 11, 2001."
Making a single department from 22 agencies is called consolidation.
Next, distractions: An alert system which never goes off alert is not an alert system at all. It's a continuous message to be vigilant, which is not information, it's a fear tactic. What's more, there would have been a massive uproar if the government had no internal response to the hijackings, so they took existing groups and rebranded them as a single simple solution to the communication problem. Then muddied up the water with reorgs and ill-managed funding.
http://www.usmayors.org/72ndWinterMeeting/homelan
http://hsgac.senate.gov/index.cfm?FuseAction=Pres
these go on and on. It's the '80's Pentagon spending all over again.
Stop worrying about how I say something and actually take a look around.
Re:Two Reactions (Score:2)
Funny, but I just posted the exact same suspicion before I read your post. I hate to break out the tinfoil hat, but these days I wonder if we're being paranoid ENOUGH.
-Eric
Re:Two Reactions (Score:2)
You got to think that sooner or later the government is going to have an overload of data that they won't be able to manipulate. I mean, they got our phone records, they got AOL search records, and now they got all your Windows desktop activity.
Re:Two Reactions (Score:2)
Re:Two Reactions (Score:3, Insightful)
Re:Two Reactions (Score:3, Insightful)
Two reasons for this: market share and business interests.
Windows simply has a bigger market share, which makes critical flaws a far bigger threat. It is just easier to gather up a botnet of 50000 Windows machines before somebody notices than to get that many *nix machines.
And the government is interested in what businesses need. Microsoft has been campaigning for years against Linux, whic
Re:Two Reactions (Score:2, Informative)
If this were actually serious (Score:2)
As to why this doesn't happen for Linux, well it's because the US government doesn't take Linux seriously. To them, it's a toy or at best, a minor applica
Re:Two Reactions (Score:2)
It would seem their lawyers were asleep at the wheel for that one (they should have specifically excluded any liability, just as microsoft specifically excludes any liability for any faults or even the presence of viruses). It
Re:Two Reactions (Score:2)
Paranoid poster doesn't search enough (Score:3, Informative)
Actually, they did that. You just didn't bother looking. http://www.kb.cert.org/vuls/id/650769 [cert.org]
http://www.us-cert.gov/cas/techalerts/TA06-220A.ht ml [us-cert.gov]
The cynical side of me also says that some department in the United States got hacked into. They do say that the exploits were being used but dont go futher.
Re:Two Reactions (Score:5, Insightful)
From the article: "This vulnerability could impact government systems, private industry and critical infrastructure, as well as individual and home users"
I think that statement is pretty much an ordered list of government priorities when urging these security measures. Why is the government getting involved? They're looking out for their own interests. The average government worker is likely sitting on a windows workstation right now, surfing the internet with IE, creating a presentation in Powerpoint, running some calculations in Excel, or typing a document in Word... and they probably don't even have the administrative rights to run their own updates, so they sit around waiting for some IT grunt to get off his lazy ass and do it for them.
Even as we speak, I'm sitting at a Windows work station without version management and without admin rights. I have to use the company standards of IE and Office because I can't install Mozilla and OpenOffice. I don't even know if our IT department is aware that they need to run any patches. I haven't seen them do it since I've started working here. And what's worse, I'm working for a government contractor which is always making a lot of fuss about security!
Which brings me to my next point. The government is also looking out for industry and commerce. I'm sure you've noticed the U.S. economy isn't what it used to be. The last thing this country needs is a cyber attack wreaking havoc among businesses and putting even less trust in online commerce than there already is.
Shouldn't we be suspicious that the government has never openly declared critical Linux updates [us-cert.gov] an imperative?
Actually, the DHS has funded open source security auditing [itworld.com]. Its true, they have never made it an imperative critical update, but you have to take into account the users and usages of open-source products. If you've installed and/or administrated Linux, its very likely you have enough know-how that you don't need a government warning to get you to stay on top of security patches.
Windows, however, is the most widely used operating system, especially for people who don't have the first clue about security or administration. How many Windows users out there use Administrator as their standard account? People like that need to be warned about the importance of updates.
While I'm not going to deny the possibility that they do have more up their sleeves, I think the past couple years have made me less likely to don the tin foil. With the terrorist attacks, resulting WMD wars, Gee Dubya elections, and blatant fear-tactics, I've really begun to realize that "government intelligence" truly is an oxymoron.
--
Take off every sig. Move sig for great justice.
Re:Two Reactions (Score:4, Interesting)
How about monitoring 10 million phone calls [washingtonpost.com]?
And with a handy backdoor installed monitoring computers would be even easier to automate.
I'm not saying they have, merely that your pooh-poohing of the whole idea is a bit baseless when they've already been caught doing essentially the same thing in a different medium.
Sorry, just to clarify:
The constant exposes of systematic corruption throughout all levels of the US government, from pre-warnings of 9/11 through to financial scandals to the gutting of judicial oversight and introduction of almost limitless executive power for the Whitehouse... two blatantly corrupt elections, at least one illegal war and enough lying, bullshit and willful misrepresentation to indict and incarcerate any normal group of people ten times over... and all this means you're less likely to don your tinfoil hat?
The only way this makes sense to me is if you're saying conspiracy theories shouldn't attract tinfoil hat accusations any more... because everyone knows they're watching you, lying to you and breaking the law all the damn time?
Re:Two Reactions (Score:2)
Personally I think the vunerability and number of exploits on machines on the net has gone way beyond what I would have laughed at in SF a few years ago. Buffer overflows and race conditions were known about and dealt with in computers before Gates wrote his first program - let alone all of the other stupidities that fill the net with spam zombies. Getting
Re:Two Reactions (Score:3, Insightful)
I think the "government" has a lot better things they should be worrying about.
I don't see where this is anything close to hand-holding. You aren't being forced to do anything, the government isn't doing it for you, and if you don't do it, they aren't going to come after you. There's nothing wrong with a PSA that encourages people to secure their computers.
And if you really need a reason for it all, it costs tax dollars to deal with things like identi
Re:Two Reactions (Score:5, Insightful)
By "government" I of course refer to the current administration.
Uh... M$ was making buggy software long before the "current administration" came to power. Just like the plotting for 9-11, wars between Arabs and Israelis, wars in general, global warming, hurricanes and so on all predate the current administation. I'm not saying the current admin is perfect or that previous admins are 100% to blame, but I think you need to spread that blame around.
It's bad enough people think that history began when they were born, but there is no excuse for thinking all problems began less than seven years ago, provided you can read.
Re:Two Reactions (Score:3, Interesting)
Re:Two Reactions (Score:3, Interesting)
OK, I'll bite, but keep in mind I'm half-joking here. (And I do agree that global warming is a collective "we" fault).
Ok, so, the Federal Government has massive yearly deficits, and a total nation debt in the trillions, not even counting future promised expenditures such as Medicaid/care and Social Security payments. Refusing to raise taxes to cover these costs because it is politically untenable
Re:Two Reactions (Score:2)
In Soviet Russia, patches apply YOU!
Then What? (Score:5, Funny)
Re:Then What? (Score:5, Funny)
Re:Then What? (Score:2)
Wait, I'm not running Windows! The terrorists win! Onoes!!1!!1!!111cos(0)
so.... (Score:5, Insightful)
Re:so.... (Score:5, Insightful)
Re:so.... (Score:2)
OMG (Score:3, Funny)
Re:OMG (Score:2, Funny)
A plot? (Score:2)
Do they know something we don't know? Coming on the heels of this news about
Re:A plot? (Score:5, Insightful)
Also, to be cynical as ever, we DO have elections coming up in a few months.
As far as I'm concerned, the boy has cried wolf far too many times for me to react to any warning DHS or any other governmment agency says about threats.
Re:A plot? (Score:3, Informative)
Re:Since you are a system administrator... (Score:4, Informative)
One should probably never have 139 and 445 exposed directly to the internet, one should probably only have them exposed beyond an individual workstation if that workstation is part of a realish network (eg, three pcs that never talk to each other plugged into the same linksys router wouldn't count). When in doubt, block it and see what happens.
Typical over-reaction from the Slashdot staff (Score:3, Insightful)
Re:Typical over-reaction from the Slashdot staff (Score:2)
Hmm.. (Score:3, Funny)
They buy you a brand new Intel Mac! Courtesy of U.S. taxpayers.
Otherwise the NSA won't be able to "help" you (Score:2, Redundant)
Man, I really HOPE I'm just being paranoid today.
-Eric
Re:Otherwise the NSA won't be able to "help" you (Score:3, Informative)
The opensource firewall only protects you from them initiating contact to your machine from outside. It doesn't prevent hidden reports being sent out. That takes a lot of human monitoring, and some packets, you just don't know the real content/conte
What then? (Score:2)
Meh (Score:5, Interesting)
Anyway, this isn't that big a deal.
Re:Meh (Score:2, Interesting)
Re:Meh (Score:2, Interesting)
You know ... that's a pretty big concern. If that's truly the only thing that concerns you, you should still be scared stiff. We have a U.S. Department which is 100% staffed by the current administration, and it continues to broaden it's rol
Ahh I can see it now... (Score:4, Funny)
Download link for patches (Score:5, Funny)
I now practice secure computer usage. (Score:3, Funny)
Hey! (Score:4, Funny)
then what? (Score:2)
And you know what happens to things that endanger de US economy... they will be eliminated.. ermmm... I mean.. democracy and freedom will be brought to them, or they will thought of as totally unimportant (environmental issues).
malware (Score:2, Insightful)
Re:malware (Score:2)
Why, yes! http://www.asiamedia.ucla.edu/article.asp?parenti
Dig out the Duct Tape (Score:2, Funny)
In reality... (Score:2)
with many of the agents, you'd never know it wasn't "just water" until it was too late.
To be sure, the "can't be bringing a bottle of water on board" is a bit overboard (But then, many
of the things they've instituted have been at least a little bit that way from the beginning...)
Re:Dig out the Duct Tape (Score:2)
So, if you don't apply the patches, then what?" (Score:3, Funny)
Too many alerts in one go (Score:2)
Yeah, boy, did I get bored reading about them as they came out on the mailing list I'm on. Can't they just sum them all up?
Internet Explorer: Bad
Powerpoint: Bad, etc.
Updates and Patches (Score:2)
With the latest "Critical, this affects everything" remote exploit patch, I had to run around patching our many computers in our medium sized academic department. We're supposed to have a software update service which pushes out the patches to critical issues such as this. Of course the SUS didn't update about 60% of the PCs, requiring me to manually run windows upd
Cert (Score:2)
Doesn't the United States CERT [us-cert.gov] fall under DHS?
It makes sense that they would issue an advisory to tell people to protect their machines. While the R in CERT traditionally stood for Response (it is not Readiness), I still don't think its a huge deal for them to be proactive in telling people to get their act together
Re:Cert (Score:2)
Rather, that should be, it is now Readiness
I'd like to but WGA won't let me. (Score:2)
That said, it sounds like a new Microsoft slogan:
"Unpatched Windows systems are hurting the war on terror; buy your legitimate license today."
Then again there is always http://windizupdate.com/ [windizupdate.com]
Patch the windows, get the WGA (Score:2)
then... (Score:3, Funny)
GET HIM!!!!!
Creepy (Score:2)
Cracking down on piracy (Score:4, Funny)
I would..... (Score:2, Funny)
Wow, no comments about OS X yet? (Score:2)
US Threat Level (Score:5, Funny)
The government also raised the security alert level for Windows users from Purple to Pink after Microsoft announced it had foiled a plot to make Windows more secure.
Get the Subversive! (Score:2)
Well, I'm not sure what happens if you don't apply the patches, but we do have an idea of what happens [time.com] if you ask questions like that on a blog.
(that's mostly a joke... at least for now)
But Can Microsoft Be Trusted? (Score:3, Interesting)
* No * Thank * You *
I have a better solution: I run Windows 2000 SP4 (XP is bloatware in my opinion) inside a Virtual Machine on Linux. The virtual machine has no connection to the internet (its IP address is blocked by the router), and does not run email or a web browser. When the copy of Windows is shut down, *it reverts to a snapshot*. All data is stored external to the VM's "C drive", where it's protected by Linux. Voila, no updates needed!
We've all heard how Microsoft's latest efforts to fight piracy hurt innocent people running legitimate copies of their software. We have all seen how Microsoft installs "beta" software without asking permission. Distrust, like trust, is earned. The folks in Redmond have *earned* my distrust.
What if people CAN'T comply? (Score:2)
You know, what if they're using Macs or Linux?!
Is homeland security going to fine them, throw them in prison?!
<pananoid>Homeland Security is working with Microsoft to further their monopoly!</pananoid> ;-)
My dual boot lappy (Score:3, Interesting)
Is there no end to the microsoft perfidity?
Oh, wait, this is
--
No Cheers this time, Gene
The real issue (Score:5, Informative)
Affected programs and services:
- MS Server Services (TCP 139 and 445).
- DNS servers
- Internet Explorer
- Outlook Express
- Microsoft Management Console
- HTML Help
- Visual Basic
- Microsoft Office
- Windows kernel
I'm not too surprised that they're trying to push awareness of this patch. It was the lack of patching several weeks beforehand that allowed Code Red to do as much damage as it did.
Re:What then? (Score:2)
I haven't remembered the USA getting Bin Laden out of Iraq, Saddam isn't a terrorist! ha!
(The US is breeding terrorists of the future in Iraq right this instant though)
Re:What then? (Score:2)
Re:NSA patch (Score:4, Funny)
hmm, what's with the black helicoptor outside. Woah, look at the scope on that guys rif
Another strike from the Grammar and Spelling Department (Apostrophe Patrol).
Re:NSA patch (Score:2)
Re:solution (Score:2)