Virus Knocks Out U.S. Visa Approval System

GillBates0 writes "According to this story and many others, the State Department's electronic system for checking every visa applicant for terrorist or criminal history failed worldwide late Tuesday because of a computer virus, leaving the U.S. government unable to issue visas. The virus crippled the department's Consular Lookout and Support System, known as CLASS, which contains, among others, names of at least 78,000 suspected terrorists. It was unclear which computer virus might have affected the system. But a separate message sent to embassies and consular offices late Tuesday warned that the Welchia virus had been detected in one facility. Welchia is an aggressive infection unleashed last month that exploits a software flaw in recent versions of Microsoft Windows."

Comments

Does the state dept. read /. ??? NO

[setzman]

If they did, they would know they following:

1.) Use a firewall to block unnecessary access from the external network
2.) Patch Windows often
3.) Use anti-virus software and update the definitions often

I would have thought that the State Department would at least do these minimums (to keep its systems "safe from evil-doers"), but I guess you can't even expect that much from government work.

Re:Does the state dept. read /. ??? NO

[duffbeer703]

Don't be silly. If the DoS read /., everything would be running on OpenBSD and MySQL.

Re:Does the state dept. read /. ??? NO

[stratjakt]

How do you know they didn't, you dope?

How do you know it just didnt fail because the janitor tripped over the power cord, or because of a design flaw, and this is just par-for-the-course beurocratic finger-pointing?

Re:Does the state dept. read /. ??? NO

[Leffe]

2.) Patch Windows often

Should be:

2.) Use Linux.

Re:Does the state dept. read /. ??? NO

[instanto]

3. Anti virus software is bullshit.

A good secure configuration with educated lusers does not need av software.

And even though the users may be morons, a good configuration should still be able to combat them, provided they also have 'measures in place' to punish users who disregard security practices.

Re:Does the state dept. read /. ??? NO

[Trigun]

That is not without its own problems. A certain secure shell comes to mind...

The answer, whether it's windows, linux, unix, bsd, plan 9, or even a commodore 64, is patch early, patch often, test, and pray.

Re:Does the state dept. read /. ??? NO

[Trigun]

I'd much rather avert the problem then spend my days rubber-hosing my staff for unleashing a virus on the network.

Do you have your disk drives removed, USB plugs covered, as well as your POP monitored? Are you a gambling man?

Re:Does the state dept. read /. ??? NO

[PaulK]

At what point will the government and public at large decide that "enough is enough?" Do people have to die before someone takes this seriously?

Day after day, example after example, the world is inundated with successful attacks.

We can say, "Well, people are stupid... They should know not to click on attachments," The reality is though, that "1 in 7" users have problems with the power button.

There is no future security in blaming the end user. It's high time that we look at the systems that allow this type of invasion, replace where necessary, and train the users accordingly.

The talk of cost becomes irrelevant when recovery costs are totalled. Just wait for the first wrongful death suit revolving around an insecure system failure.

If we insist that users are accountable, we must also demand that the corporate citizens are accountable.

Re:Does the state dept. read /. ??? NO

[Eric_Cartman_South_P]

You forgot...

4.) vi is better than e-macs

5.) In Soviet Russia, you attack Virus!

6.) People should patch their boxes bec.#J^@ATDT[NO CARRIER]

7.) Don't use FreeBSD because it's dead/dying.

8.) Apple is awesome. But I can't afford one.

9.) Imagine a Beowolf cluster of those!

10.) Patents, RIAA, Spooks, Windoze, Verisign, Politician, Spalling Checkirs; all bad.

11.) Ogg, Apple, *nix, RMS, EFF; all good.

12.) ???

13.) Profit!

PS. Mod's, go away. I'm just having fun. Don't put it up or down you fu%#d2DHATDT[NO CARRIER]

Re:Does the state dept. read /. ??? NO

[ccweigle]

If they did, they would know they following:

Not to click on goatse.cx links?
That "Profit" always follows "???"?
That Natalie Portman is damn hot?

Re:Does the state dept. read /. ??? NO

[Anonymous Coward]

You can do all that, but there is still the threat of an asshat with a dremmel.
Jesus on security:

"Do not lay up for yourselves treasures on earth, where moth and rust destroy and where thieves break in and steal; but lay up for yourselves treasures in heaven, where neither moth nor rust destroys and where thieves do not break in and steal. For where your treasure is, there your heart will be also" (Matthew 6:19-21, NKJV).

So, do all the reasonable, smart things, and never forget that you'll ultimately have to trust your people.

Re:Does the state dept. read /. ??? NO

[DickieRay]

>1.) Use a firewall to block unnecessary access from the external network

For this particular Windows exploit, this only delays the inevitable. This worm has been out for 5 weeks; networks of Windows machines are still going down now. Eventually someone brings the thing in on a laptop.

>2.) Patch Windows often

Amen.

>3.) Use anti-virus software and update the definitions often

Because detection works for many anti-virus programs but removal doesn't, these programs serve to alert lusers to the problem but don't solve it.

Re:Does the state dept. read /. ??? NO

[lanswitch]

As usual, the type of software is probably not the problem. It's the fact that the people running the system either don't know, or don't get the time for the necessary security measurements. Even if you run a completely sealed linux-box, you still will need the time and means to install firewalls, virusscanners, patches etc.

Re:Does the state dept. read /. ??? NO

[jaredcat]

>> 1.) Use a firewall to block unnecessary access from the external network

Really this doesn't work as well as you'd think. If you have laptop users on your network, which nearly everyone does, its analagous to wearing a plastic bubble suit but having unprotected sex with strangers every weekday morning.

My office has about 60 users in it and is protected by PIX firewalls and techdata's email virus scanner. We have about 20 Windows servers in our server room (this doesn't include the many dozens of servers running Linux or Solaris, or the machines at one of our 3 colo sites), and we patch them all about once a month. Office workstations are forced to patch themselves weekly through a distributed Windowsupdate. So yeah, this should be pretty safe, right?

Well about 3 times per week some user brings in a laptop, plugs it in to the LAN, and we get some new worm running around the office LAN.

Re:Does the state dept. read /. ??? NO

[Anonymous Coward]

And putting Wesley Clark in charge of the Federal Government is supposed to help things?

Re:Does the state dept. read /. ??? NO

[Xerithane]

1.) Use a firewall to block unnecessary access from the external network

They probably do. Then a user VPNs in with an infected machine against policy, or brings a laptop in and plugs it in. This happens at my work, too.

2.) Patch Windows often

Define "often", please. It could be once a month, once a quarter. I'm sure they have change control plans.

3.) Use anti-virus software and update the definitions often

See above.

I would have thought that the State Department would at least do these minimums (to keep its systems "safe from evil-doers"), but I guess you can't even expect that much from government work.

No, it's just that it's easier to assume that you are smarter than them and assume you know their network and systems.

Re:Does the state dept. read /. ??? NO

[spruce]

iIt's high time that we look at the systems that allow this type of invasion,

What systems don't allow this? Paid attention to the recent bugs in OSS apps? It is the "users" - read admin's responsibility to keep up with these things. No system is immune.

Re:Does the state dept. read /. ??? NO

[Zak3056]

The reality is though, that "1 in 7" users have problems with the power button.

I once worked for an engineer who was very fond of quoting that, by definition, 50% of the population has an IQ below 100.

Re:Does the state dept. read /. ??? NO

[pedersoj]

You have to step back and realize that this is a completely different "breed" of virus/worm. We just finished cleaning up 1750 stations in our environment. Firewalls were blocking just fine, Windows updates running like clockwork, Antivirus updating hourly.

Our problem: In a K12 environment, the machines lay largely dormant over the summer months. With 500 laptops, teachers tend to bring them home during the summer months to play. All it takes is one laptop to come in Day 1 of school, teachers to fire up their machine (which hasn't booted since June). Your entire network floods in minute the machines are turned on...before Windows can update, before McAfee kicks in.

Re:Does the state dept. read /. ??? NO

[Dwedit]

You forgot to mention SCO :)

Re:Does the state dept. read /. ??? NO

[Soul-Burn666]

You forgot:
14) Hot grits!
15) Smoking crack for 699$
16) It's thursday, who do we hate today?
17) Imagine the implications for the pr0n industry!
18) Don't forget insensitive clod, you insensitive clod!
19) You can mod me down if you want, but....
20) And for the math impared...... 1.6miles = 1km
21) Slashdotted? Here's the google mirror.
22) But does it run linux? .........

Re:Does the state dept. read /. ??? NO

[setzman]

Then a user VPNs in with an infected machine against policy, or brings a laptop in and plugs it in.

Don't allow VPN access. As for the infected laptop, read some of the other comments on this thread.

Define "often", please. It could be once a month, once a quarter.

Checking windowsupdate.microsoft.com every day sounds like the best option.

No, it's just that it's easier to assume that you are smarter than them and assume you know their network and systems.

Any admin that is worthy of keeping his/her job should know that there are minimum security standards that must be enforced when using Windows (or any other system). Then again, I forgot, this is the government we are talking about, right? They hire just about anybody, right?

Re:Does the state dept. read /. ??? NO

[edbarrett]

Forget Slashdot. They would get that message if they were reading the Microsoft Security Bulletins.

Re:Does the state dept. read /. ??? NO

[DGtlRift]

My brother works for the EPA and their IT department is contracted out.. I can't remember who it is now but it was Lockheed Martin before.. they lost the contract and now it's another company... I would imagine the DoS does the same trying to find the lowest bidder... I would imagine that the company that lost the contract may take advantage of the fact that they have knowledge of the system and try to make the new contractor look bad....

Although, according to my brother, usually the loosing contractor lays off the un-needed employees, and the new contractor hires them back... but I would imagine there are a few that might not make the cut with the new company and would be a little disgruntled.
-DG

Re:Does the state dept. read /. ??? NO

[Lawbeefaroni]

If we insist that users are accountable, we must also demand that the corporate citizens are accountable.

Corporate citizens? How about just hiring a few competent network administrators?

The "system" in question in the article was patchable and lockable. It wasn't done.

Remember, to collect theft compensation from that bike lock company, you have to actually lock your bike. If you don't, the fault is your own.

Re:Does the state dept. read /. ??? NO

[Nick_dm]

From what I've gathered the bugs in OpenSSH didn't even have known exploits when then were patched. No system is perfect but their minimalistic approach with attention to little details is an improvement over other systems where lots of 'minor' bugs are left lying around and sometimes are then found to be major bugs that no one had really understood.

Its true however that in most cases a good sysadmin would solve most of the problems. Most windows users wouldn't be better of switching to openBSD or such, so its the admins job to keep patching boxes and have a decent firewall.

There is still an argument though, that in critical goverment departments, everything possible should be done to avoid security problems and maybe changing the OS as well as hiring some new admins would be sensible.

Re:Does the state dept. read /. ??? NO

[Cylix]

Amendum...

Ogg/Vorbis

Gnu/*nix

Cowboy Neal

A late favorite, Naked and Petrofied

Re:Does the state dept. read /. ??? NO

[Anonymous Coward]

Ya dude.

Look, if they designed their computer systems to be unmanagable and vunerable to even the most basic attacks imaginable: automated and generic viruses and worms...

WTF are these guys thinking? They are incharge of Visa's? A major part of security for the nations and they are incompitant enough to make choices on OSes and network design so that a amature can take the system down?

This is unexcusable. It's a joke.

If people are this bad at computers they should ditch the hardware and go back to paper.

Re:Does the state dept. read /. ??? NO

[perly-king-69]

Checking windowsupdate.microsoft.com every day sounds like the best option.

What if the update breaks your PC. It has happened before.

Re:Does the state dept. read /. ??? NO

[Frater 219]

No system is immune.

But systems are not equally buggy. I discuss this here. No design and no development method is perfect. However, it is incontrovertible that some designs and some development methods yield software that fails less often; that fails less severely; and that fails more recoverably. We can inspect systems' behavior and say that for particular purposes, certain software is better than others. We can say this on the basis of technical facts, not merely marketing claims and promises of "support" and "warranty". We can also say it on the basis of historical evidence -- some systems have failed more often and more severely than others.

A Microsoft Exchange mail server stores users' mail in a binary database, in a proprietary format. A Postfix or Qmail mail server stores users' mail in text files in a simple directory structure. We can make a reasonable (and correct!) prediction that in case of failure, it is easier to recover the content of mail from a Postfix or Qmail system than from Exchange. And, indeed, this is borne out by the experience of administrators: a maildir can get into an inconsistent state, but it's much easier to recover it than to recover an Exchange mail database.

(Note that I'm not describing frequency of failure, but rather severity. We can also make predictions about the former, of course ....)

Security holes are, from an engineering standpoint, simply another kind of failure. We can look at design choices such as privilege separation and chrooting -- applications of the Principle of Least Privilege -- and say that some systems will fail worse than others. A program that can't access files outside of /home/myprog cannot scribble on the kernel in /boot/vmlinuz. A Web server that runs as Administrator on Windows 2000 has opportunities to fail worse than a Web server that runs as www-data on Solaris.

Simply put, there exist objective facts about security design, just as there exist objective facts about, say, civil engineering. Why doesn't the city construct water mains out of balsa wood and bridges out of papier-mache? It simply doesn't work very well. :)

Re:Does the state dept. read /. ??? NO

[R.Caley]

[use a firewall]>/i>

Really this doesn't work as well as you'd think. If you have laptop users on your network, [...]

Then you don't have a firewall in any real sense, and you deserve everything you get just as if you had no firewall on your internet connection.

Well about 3 times per week some user brings in a laptop, plugs it in to the LAN

take the amount of IT staff time to clean up themess, and the amount of lost time to everyone else. Cost it at full commercial rates. Divide the bill equally between the person who plugged the laptop in, their bosss, the IT person responisble for the socket and their boss. Repeat until the clue fairy pays a visit.

Re:Does the state dept. read /. ??? NO

[antiMStroll]

Congratulations, you win the MS/Godwin award for the first spurious comparison between an arcane, difficult OpenSSH exploit requiring manual application on a per-computer basis and detailed expertise, and a Windows plug-it-in-and-watch-it-die automatic worm vulnerability. I knew someone would rush to claim equivalency between such radically different apples and oranges but am surprised it's getting modded inside of a dozen first posts.

Re:Does the state dept. read /. ??? NO

[sporty]

And block attachments that are prone to viruses for the love of God. pdf, yeah, it can get a virus due to acrobat .. but that's usually less broken than say, word and it's macro viruses, or microsoft lookout and it's vulnerabilities. So you'd at least filter all the extensions for attachments that aren't safe..

Re:Does the state dept. read /. ??? NO

[antiMStroll]

If they only patch once per month or quarter, the original poster is indeed smarter than them. This isn't yer mom's chat machine, this is an infrastructure critical to the State Department's operation. A worm took them out so they weren't vigilant or 'smart enough' by definition.

Re:Does the state dept. read /. ??? NO

[simong_oz]

I once worked for an engineer who was very fond of quoting that, by definition, 50% of the population has an IQ below 100.

But IQ is not necessarily a good indicator of common sense or decision making ability ;-)

Re:Does the state dept. read /. ??? NO

[Neil Watson]

1.) Use a firewall to block unnecessary access from the external network

Not to split hairs but, the language makes all the difference in how a firewall is deployed.

1.) Use a firewall to allow necessary access from the exteranal network as your firewall should already be blocking everything.

Re:Does the state dept. read /. ??? NO

[BrokenHalo]

No system is immune.

I won't argue that, as it's true.

There's a difference, however, when a software company sits on its hands and fails to fix known holes, as (ahem) "that" company has on more occasions than I am prepared to take the time to count.

At least the bugs in most (all?) critical OSS tend to get fixed, usually within hours of their being reported, and usually before the holes have time to get exploited. (Sure, admins have to keep up with the advisories, but that is not unique to any OS.) You can't find fault with that.

Re:Does the state dept. read /. ??? NO

[Trigun]

Where do I pick up my prize? Do I have to say a speech?

And, as long as this has no bearing on the judges decision, I am most definitely not claiming equivalancy, but rather responding to the ever-present troll which claims that linux is a drop-in security solve-all.

Re:Does the state dept. read /. ??? NO

[josh_freeman]

Although rubber-hosing the staff is a great way to relieve the stress caused by a long day of patching the latest critical vulnerability that just brought your system to it's knees :)

No lusers were killed in the production of this /. post.

Re:Does the state dept. read /. ??? NO

[__past__]

You test it before you roll it out, like most larger sites have a policy of doing. It's not as if the vulnerability, and the patch, are brand-new, after all, it's just that nobody can afford testing something for months any more (or rather, having too much to do for months before having time to properly patch it), not when various exploits are out in the wild, taking sites down left and right. You better be damn fast at it. If their change plan takes that long, it's broken, and most likely they will just have to pay more testers, so that it becomes faster.

Of course, the money required to pay those testers/admins is not something you'll read about in most TCO studies, nor do the costs of having your network hosed because you didn't pay it. Because, you know, being hit by a worm/virus is just bad luck, and has nothing to do with the rest of your IT strategy.

Re:Does the state dept. read /. ??? NO

[Robber Baron]

3.) Use anti-virus software and update the definitions often

Define "often", please. It could be once a month, once a quarter. I'm sure they have change control plans.

I've been using Norton Corporate Edition on my networks quite successfully for some time now. A server is config'd to be the update server and all the clients are managed from it. You can push updates to all the clients either manually or schedule them to update automatically. You can even force clients that come on the network to accept an AV client install package before they are allowed to participate.

I also would recommend putting the laptops on a separate node and firewalling them off from the rest.

No, it's just that it's easier to assume that you are smarter than them and assume you know their network and systems.

Not necessarily. Whenever you get into larger bureaucracies, there's always a level of friction with respect to implementing IT changes/updates. Any number of things could be causing it. It could be clueless, IT staff used to screwing the pooch in gov't service, it could be difficulties in getting anything approved, it could simply be toxic office politics. It could be little dictators building mini-kingdoms for themselves...refusing to implement any suggestions because THEY didn't come up with it (I've seen that one many times!). I don't think it's the nature of their networks and systems that's the issue here at all, after all it's a Windows virus/worm that took them out. How unusual is that?

Re:Does the state dept. read /. ??? NO

[magarity]

The reality is though, that "1 in 7" users have problems with the power button.

Speaking of which, it's obvious that capital "o" means off, but what the heck does the capital "i" stand for?

Re:Does the state dept. read /. ??? NO

[Fulcrum of Evil]

Well about 3 times per week some user brings in a laptop, plugs it in to the LAN, and we get some new worm running around the office LAN.

Can't you set up unknown computers on a VLAN and implement some connectivity rules? It seems that partitioning the mobile computers and blocking, or at least monitoring port 135 and listening for common exploits like nimda would work pretty well. That, and firewall the servers from the users.

Re:Does the state dept. read /. ??? NO

[dasmegabyte]

It has been 8 years since I have used a modem. I still laugh at NO CARRIER jokes and people who whistle 9600 baud connect tones.

This is why people don't take me seriously as a pundit.

Re:Does the state dept. read /. ??? NO

[hdparm]

As usual, the type of software is probably not the problem

Why is it then that ALL reecently infected systems were Windows based?

Re:Does the state dept. read /. ??? NO

[jaredcat]

This kind of solution wouldn't really work as there are many users who bring a laptop in every day and need to have access to Exchange, the File Server, our CRM software, etc. I'm not talking about visitors to the office (who we actually can keep on a DMZ), but about regular team members.

Re:Does the state dept. read /. ??? NO

[zelurxunil]

Ok, good point pulling linux out of the box does not fix security problems, but correct configuration of a linux system WOULD prevent a lot of the threats that viruses present. Not to mention the fact that it would save them millions in licensing. The time it would take knowledgable techies to set up a linux based security system can't be much more than that of a Windows based system, and in the long run saves money. The real question is how can a government organization using tax money pay millions for software licenses for crap software...

Re:Does the state dept. read /. ??? NO

[jaredcat]

well per your suggestion...

If every laptop user had to be subjected to virus scans and patches every day, everyone would have to come in 25 minutes earlier for work every day, plus we'd need to have a much larger IT staff. This would be far more costly than what it costs us to clean up a toxic virus spill 3 times per week.

Re:Does the state dept. read /. ??? NO

[magarity]

Well about 3 times per week some user brings in a laptop, plugs it in to the LAN, and we get some new worm running around the office LAN

This shouldn't be too hard to prevent... Have your DHCP only hand out addresses to known MACs, unknown MACs get a different logical subnet, all traffic between subnets gets run through a machine whose job is to filter aggressively on the assumption it's from a worm-infected laptop.

Re:Does the state dept. read /. ??? NO

[Xerithane]

Don't allow VPN access. As for the infected laptop, read some of the other comments on this thread.

Wow! What a great idea. I guess all the people who travel can just work offline.. Oh wait.

Checking windowsupdate.microsoft.com every day sounds like the best option.

Yes, leave it up to the actual systems users to patch. Right.

Any admin that is worthy of keeping his/her job should know that there are minimum security standards that must be enforced when using Windows (or any other system). Then again, I forgot, this is the government we are talking about, right? They hire just about anybody, right?

The problem is that you have no clue what their security and precautions are. If the government hires just about everybody, why don't you try to go work at NASA, the NSA, or the CIA. I'll send you a nice bottle of wine if you get hired.

Until then, why not just stop with the arrogance?

Re:Does the state dept. read /. ??? NO

[fsbilly]

a/v doesn't stop welchia.
a firewall is no defense against a dolt plugging their infected laptop into your network... kaboom!!

patches? we don't need no steenking patches!

Re:Does the state dept. read /. ??? NO

[BLAMM!]

"In use" :-P

Re:Does the state dept. read /. ??? NO

[Wakkow]

But IQ is not necessarily a good indicator of common sense or decision making ability ;-)

True, but remember that HALF of the population has below average common sense or decision making ability. =)

Re:Does the state dept. read /. ??? NO

[EzInKy]

Simply put, there exist objective facts about security design, just as there exist objective facts about, say, civil engineering. Why doesn't the city construct water mains out of balsa wood and bridges out of papier-mache? It simply doesn't work very well. :)

You bring up a good point here. Civil Engineers are licensed professionals who are held legally accountable to follow certain well known design standards. Software Engineers on the other hand are unlicensed and expected to ensure that their designs are not well known to anyone other than their employers.

Re:Does the state dept. read /. ??? NO

[Anonymous Coward]

VIRUS!!

Oh no, the fucken janitor had AIDS!

Re:Does the state dept. read /. ??? NO

[masouds]

About removing/not allowing worms on corporate intranet, why don't you put laptops (or wireless access-points that they connect to) into their own vlan with restricting access to your mission-critical servers? This would resolve propagation of worms, at least they won't get to the servers.

Re:Does the state dept. read /. ??? NO

[1u3hr]

Speaking of which, it's obvious that capital "o" means off

Is it? Why couldn't it mean "on"?

Re:Does the state dept. read /. ??? NO

[ZackSchil]

Be de de de duleee de de de... be dum, be dum, chchchchchchchchhchchcococococococococococoeeckeck eckeckecec!!! Man, I used to hear that at least 10-11 times every day for over 6 years. I guess I kind of miss it now, what, with DSL and all. I still hum it sometimes. That and the Epson printer startup procedure. Sometimes I even do into the double head cleaning extended version!

Re:Does the state dept. read /. ??? NO

[lanswitch]

Maybe because the avarage windows-sysadmin is less knowledgerable (phew) than the average *nix sysadmin?
Or because the M$-biased management doesn't understand anything about computers and security, and won't listen to their it-team?
Or because the favourite app of the management requires a hole in the firewall at (for Christ's sake) port 137?

It may be because Windows-based computers are easier to attack, so the majority of the attackers choose windows as their main target. What will happen in 5 years, when the majority of the computers will be running Linux? I think that they will eventually start attacking linux-boxes, because there will be no windows-boxes left ;-)

Re:Does the state dept. read /. ??? NO

[panda]

Yeah, but this is still the same State Dept. that had several "classified" laptops just walk out of the building never to turn up, again.

Just 'cause the administration changes, doesn't mean the bureaucrats do.

Re:Does the state dept. read /. ??? NO

[sketerpot]

Well, 50% of the population has a below average amount of common sense and decision making ability. Happy now? ^.^

Re:Does the state dept. read /. ??? NO

[Anonymous Coward]

I read /. and I run a Windows network. It so happens that I run several FreeBSD server also.

The problem isn't necessarily that the network administrators are negligent. In an organization as large as the state department, it can be quite difficult to patch all of the client machines and the Virus in question generates vast amounts of network traffic as it propagates. All it would take is a relatively few client machines to be for the whole network to become virtually unusable. It's probable that the servers in question were even patched.

Re:Does the state dept. read /. ??? NO

[smyle]

Sounds like someone needs a LART.

Re:Does the state dept. read /. ??? NO

[Gulthek]

What are we, a perfect bell curve?

Re:Does the state dept. read /. ??? NO

[MrBlint]

You certainly seem to have a below average understanding of statistics.

Example: Alice has a CSQ (Common Sense Quotient) of 10, Bob has a CSQ of 80, Carol has a CSQ of 90 and David has a CSQ of 100.

The average CSQ is 70; therefore 75% of the sample are above average.

Re:Does the state dept. read /. ??? NO

[mpe]

A Microsoft Exchange mail server stores users' mail in a binary database, in a proprietary format. A Postfix or Qmail mail server stores users' mail in text files in a simple directory structure. We can make a reasonable (and correct!) prediction that in case of failure, it is easier to recover the content of mail from a Postfix or Qmail system than from Exchange. And, indeed, this is borne out by the experience of administrators: a maildir can get into an inconsistent state, but it's much easier to recover it than to recover an Exchange mail database.

Or at an even more basic level the difference between the Windows Registry which has everything from the critical to the trivial in one big binary lump and the "unix method" of having text config files.

Re:Does the state dept. read /. ??? NO

[Alan Cox]

They probably do - its easy to slip up with any system

In this case it is scary because if that virus got in who knows what other stuff got in which may have added or removed terrorist database records.

Re:Does the state dept. read /. ??? NO

[mpe]

There's a difference, however, when a software company sits on its hands and fails to fix known holes, as (ahem) "that" company has on more occasions than I am prepared to take the time to count.

Or play "It's a feature, not a bug". Let alone consider unstructured "sphagetti" code a good thing (whilst describing the result as "integration".)

Re:Does the state dept. read /. ??? NO

[ColeNielsen]

It's just another reason why use of Microsoft Software when it comes to my finances and other personal information should be forbidden...

Re:Does the state dept. read /. ??? NO

[t]

Actually he doesn't. It is you that has assumed a particular definition of average, actually in this case a different definition. Thus the rest of your example is faulty since you have not started with a rigorous foundation.

Re:Does the state dept. read /. ??? NO

[mgv]

What are we, a perfect bell curve?

Well, 50% of the population has a below average amount of common sense and decision making ability. Happy now? ^.^

50% of any population will be below the median value, but the same can be said of the average only when the distribution has a symmetrical distribution around the mean. This occurs in a normal distribution (amongst many other distributions, but not all).

(Hopefully this isn't to oblique a point to avoid the -1, Offtopic moderation.)

Hope that this clarifies the discussion.

Michael

Re:Does the state dept. read /. ??? NO

[Anonymous Coward]

Well, the problem with pushing updates is that if the update server gets infected, it can push the virus to all of the machines under it. That happened at my dad's work. Their update server caught MS Blaster and spread it to every single computer on their network in a matter of seconds.

Re:Does the state dept. read /. ??? NO

[Minna Kirai]

Have your DHCP only hand out addresses to known MACs

The laptops in this example are known MACs. They're company property that gets infected during work-at-home periods.

Also, that approach can be hacked around. A MAC address can be easily falsified. Random pranksters (like the authors of every major worm so far) won't bother to do this, but a genuine targeted attacker (the legendary "cyber terrorist") would. Security professionals should assume the worst.

a machine whose job is to filter aggressively on the assumption it's from a worm-infected laptop.

If you've got filters like that, why not use them all the time? Or if you can identify insecure services that need to be filtered, why not replace them? Why accept that internal LAN protocols will be vulnerable?

A solution like that is a poor stopgap. It does nothing to prevent users with "trusted" hardware from bringing it to a professional hacker, compromising your servers from the inside, and then carrying critical documents home each night before selling them off. The damage of such an attack would be REAL, unlike the wishy-washy "lost revenue" claims from worm-bourne DoS.

Re:Does the state dept. read /. ??? NO

[Anonymous Coward]

You can even force clients that come on the network to accept an AV client install package before they are allowed to participate.
Do you have any references on how to implement this?

Re:Does the state dept. read /. ??? NO

[Minna Kirai]

You test it before you roll it out, like most larger sites have a policy of doing.

Every DAY? You can test and perform staggered deployments every 24 hours? (Notice the parent said "check windowsupdate every day")

Re:Does the state dept. read /. ??? NO

[Anonymous Coward]

Of course, that's statistically incorrect. But it's still a funny saying with a kernel of truth to it.

-TUAC

Re:Does the state dept. read /. ??? NO

[dasmegabyte]

IBM 4247 printer for me.

Duh duh duh duh zeah zeah zeah zeah duh duh duh duh. Da Da...eegle eegle eegle eegle snuuuuuuuuuuuuuuuuuuuuuuuuuh toffle toffle.

80+ db for a magnificent 6 ppm.

Re:Does the state dept. read /. ??? NO

[fizzboy]

it's not a capital "o". it's a "zero" and the "i" is a "one". just like binary, "zero" means off and "one" means on.

Re:Does the state dept. read /. ??? NO

[pmz]

The reality is though, that "1 in 7" users have problems with the power button.

This is probably true, but I hope this doesn't drive people to call for regulation prematurely. There is a single fact about the entire computing industry: we are still in our childhood!

It is clear, even the best efforts we see today leave things to be desired. Things that are obvious (simple data entry will be a problem for a long time coming) and things that are less so (vendor incompetence chipping away at productivity and morale).

Accountability is clearly an issue, and, as far as we can tell, accountability is still intact--its just that no one has had the real driving need to call up the lawyers...yet. The main reason for this is: nearly all "change for the better" whether it is the government or the private sectore is written in either blood or other crushing loss. So, whether the free market dumps Microsoft like a dirty diaper or the government regulates everything into stagnation, we will see software vendors get whipped into shape harshly in due time.

Re:Does the state dept. read /. ??? NO

[pmz]

I once worked for an engineer who was very fond of quoting that, by definition, 50% of the population has an IQ below 100.

What an amazing prediction of the 2000 Presidential election!

Re:Does the state dept. read /. ??? NO

[matvei]

I for one welcome our SCO overl.. nevermind.

Re:Does the state dept. read /. ??? NO

[Anonymous Coward]

The first rule of Slashdot: Talk about SCO
The second rule of Slashdot: Talk about SCO

Re:Does the state dept. read /. ??? NO

[bheerssen]

Software Engineers on the other hand are unlicensed and expected to ensure that their designs are not well known to anyone other than their employers.

It's so true.

*sniff, wipes tear*

I love perl.

Re:Does the state dept. read /. ??? NO

[AyeRoxor!]

2.) Patch Windows often

Should be:

2.) Use Linux.

Then the problem would be software X won't run and the easy answer would be 2.) Switch builds.

Much better.

Re:Does the state dept. read /. ??? NO

[KrazzeeKooter]

Microsoft can have it's damn monopoly and my rights with it.

No not really. That's just apathy talking, do to the day in day out suffering do to the MS monopoly.

I write this in the hope that some aspect of this might shed light on the situation or help someone in the media write a clearer synopsis of the MS issue to spread the understanding.

Microsoft obviously can't handle the "god like" responsibility (and illegal monopoly) it has given itself, but still they proceed to try and exercise more and more control. If Microsoft wants the monopolistic control they'll have to take responsibility for the legal ramifications.

Microsoft seems to think it knows more than the individual about what is right for that individual. Point being, if mom and pop home user want to take place in the new economy and computing they invariable need Microsoft do to monopolistic dependancies of Microsoft products. Furthermore Microsoft mandates that they relinquish an ever increasing amount of their self control to Microsoft so that Microsoft can make those decisions for the individual which they deem necessary.

Point being Microsoft has completely F'd the whole concept of personal user boundaries. You know that old concept of "personal space" and "personal rights" (snicker)... well Microsoft has destroyed it, walked all over it, and betrayed it so far as Microsoft's monopoly reaches and has extended in the computing world. Interestingly enough outside of the Microsoft's influence people are getting more ruthless about their personal rights than ever.

To use a metaphor Microsoft holds a monopoly on the car, sell 90% of all cars, and even unfairly leverages it's monopoly out onto the roads, the gas stations, the speed limits, and the laws governing the roads. How can we determine proper user safety and user rights? Is it that Microsoft hasn't provided adequate seat belts, that people aren't using the seat belts, that the speed limit is to high, or we need better laws governing roadway usage.

When a single monopoly dominates the landscape of an industry what it says is the problem and what the problem is actually are very hard to distinguish, but you can bet they are not one in the same. Right now Microsoft says that problem is mom and pop home user. They're not using their seat belts. That is to say mom and pop aren't patching their systems to prevent viruses. No precedent can be established otherwise because Microsoft has to much control and to many conflicting interests. However it is in the computing industry in the auto industry people still die and responsibly has to be reasonably determined. In the computing world no one dies, we just lose time, money and data.

Microsoft needs to start paying back some of those billions it's made to mom and pop home user who will never be able to keep their computer up to date with virus updates. Microsoft made a general promise to them and Microsoft has exercised far to much control to negate all responsibility. Imagine the collective wasted time, frustration, and loss of personal materials due to reinstalling and recovering of files by home users. Home users burned by the recent onslaught of computer viruses in the last month. Microsoft sold them the car but without the seat-belts, perhaps they weren't necessary when the road outside your front door was dirt and cars only went 10 mph, but now the cars go 65 mph, there are infinitely more people on the road, and there are still no seat belts. It's highly unlikely anyone will die in the computing world, but people will lose their jobs do to lost time, data, and money, and the collective costs are tremendous. If you want to be monopolize computing Microsoft you have to take the responsibility.

Despite what Microsoft says the vast majority and most damaging of viruses are purely Windows problems.

As the previous post mentions nothing will happen unless someone does die, that is to say unless something increasingly catastrophic happens.

Instead of taking the resp

Re:Does the state dept. read /. ??? NO

[mt2mb4me]

my hp think jet in epson emulation mode... dooooooooooooooooo doo do do do do phht

Re:Does the state dept. read /. ??? NO

[fucksl4shd0t]

It has been 8 years since I have used a modem. I still laugh at NO CARRIER jokes and people who whistle 9600 baud connect tones.

I got a pretty good laugh when the Terminatrix used a cell phone and her voice to connect to SkyNet in T3. :) I thought "There's something wrong with this" but decided not to try to explain why it was fucked up 'cuase I'm pretty sick of technical explanations ruining otherwise known dumb action flicks.

Re:Does the state dept. read /. ??? NO

[Foolhardy]

I keep hearing about how horrible the Windows registry is because it is "one big binary lump" that contains everything. You mean like the databases that are in filesystems? A binary format doesn't mean that it is bad. If you have a corrupted binary file, yes it will be harder to recover when the original software can't, but there are many things to mitigate damage to binary databases, like journaling. The file tables in ext3 and NTFS are journaled to make them easy to recover. In Windows NT, all registry hives are journaled, too (notice the filename.log files?). So is an active directory database. I don't know about Exchange, but it may also be jorunaled. Another thing is that the winnt registry is NOT one big file. Each user has their own regisrty hive in their profile. The current config part of the registry (for the executive, and services) is under %system32%\config\system, the software tree is under .\software, the SAM has two hives, security and SAM. On top of that, there are .sav backup versions.

Re:Does the state dept. read /. ??? NO

[texaport]

Just so long as it did not wipe out the nation's MasterCard approval system.

--
Fulfill your economic, patriotic duty.
Spend ourselves out of this recession.

Re:Does the state dept. read /. ??? NO

[Anonymous Coward]

Another 'This piggy built a house of straw' story.

The Bible also has something to say about this.
It is astounding that they even built this mission critical system using MS - lets hope the so called design architect gets the boot or direcly 'pays'. The cost of flying teams around the world to 're-image' servers as this was clearly foreseeable. Negligence? The speed and cost of recovery will indicate design robustness or otherwise.

The latest Knoppix Release (or they could make their own) could provide a 2 minute disaster recovery strategy, damm cheap.
SSH, rsync, MySQL and PHP are all there.

Engineers do not use unproven building materials (O/S).
Engineers use precedent to avoid failures (History of product)
Engineers Think
Engineers over engineer (safety factor)
Engineers test their products.

Testing. suggesting a step: ' test virus infection' is NEVER DONE in practice - because the disaster recovery process is defective (>12 months out of date), and EVERY server is different (even on a standard image).

Like NASA, the state department needs to deeply question how safe their systems are, and do something about it.

Re:Does the state dept. read /. ??? NO

[Anonymous Coward]

Any of the recent WinWorm exploits are "arcane" and "difficult" as well. If you disagree, let me see you whip out debug and exploit them from the command prompt by typing in some machine code. No?

One of the whole points of having a program is to encapsulate "detailed expertise" so that the user (willing or no) doesn't have to have that same expertise. If someone wrote a program to perform that "manual application" on OpenSSH, it's be just as plug-it-in-and-watch-it-die as anything else.

Linux isn't secure; it's merely ignored. Not the same thing at all.

Insightful? Well, that's Slashdot-ese for "w00t! M$ suxors", I guess.

Re:Does the state dept. read /. ??? NO

[pdwalker]

Well, the solution to that is simple.

Implement MAC address filtering on your switches.

If anyone brings in a computer from outside the office, the computer cannot connect to the network until some IT guy allows it. While they are enabling the port to accept traffic from the laptop, the computer can be checked for viruses, etc.

Re:Does the state dept. read /. ??? NO

[jpop32]

We can say, "Well, people are stupid... They should know not to click on attachments," The reality is though, that "1 in 7" users have problems with the power button.

All the more reason to introduce a compulsory 'computer operator' licence.

There is no future security in blaming the end user. It's high time that we look at the systems that allow this type of invasion, replace where necessary, and train the users accordingly.

IMHO, blam^H^H^H^Heducating the end user is the only way to go. The problem will not got away, it will only get worse. As computers become more powerful and connected to ever fatter pipes, the capabilities of single computer to do serious damage (permanent or transient) increases with it. Sooner or later the only way to keep the internet from turning into chaos will be to hold the computer owners accountable.

I'd have no problem with huge fines for people that cause network problems due to negligence (in other words, not patching and securing their machines). If you can be held responsible for driving an unsafe car and thus endangering others, I see no reason not to demand the same from computer owners.

Re:Does the state dept. read /. ??? NO

[R.Caley]

If every laptop user had to be subjected to virus scans and patches every day, everyone would have to come in 25 minutes earlier for work

Er, that wasn't my suggestion.

The sane way to cope with laptop users is to only allow them to plug the laptops into a quarantined network. I.e. treat all laptops as if they are machines in the outside world -- logically they are (assuming they are ever connected to theinternet outside your firewall).

Re:Does the state dept. read /. ??? NO

[MrBlint]

You are of course right to point out that there is more than one type of average. However when people use the word "average" without specifying the type it is normal to assume that they are refering to the mean. This is backed up by this definition which contains the following paragraph:

"Average is a synonym for arithmetic mean -- which is the value obtained by dividing the sum of a set of quantities by the number of quantities in the set"

Besides, even using the median value it is not always true that half the population will fall below it because it is possible for any number of cases to fall on the median value.

Windows Means Work

[akedia]

As much the Slashdot community hates Windows and likes to dump on its flaws, I've realized one thing: Windows means jobs in the IT security sector. As a Network Security technician, my job is, among other things, to make sure the latest threat to Microsoft software doesn't bring down the entire infrastructure in the federal department where I work. At least twice a week, my office has a meeting where we discuss the latest Windows virus or exploit, organize a task force, and then do a system-wide deployment of the fix to some 2000+ clients. I like to think that as long as Microsoft keeps making, er, crappy software, and as long as we still have crackers writing virii and trojans, I don't have to worry about losing my job. If there was some magical "perfect" sofware that never needed fixing (note: there isn't) then we wouldn't need IT security professionals now, would we?

Re:Windows Means Work

[Sevn]

I see where you are coming from. The problem is, Windows also means WORK. And MONEY. and LOST PROFIT. and having a freaking stone tied around your neck. Actually, more like having a TICKING TIMEBOMB around your neck and you have no idea what the timer is set for. So from an employees standpoint, sure. Windows problems employ a hell of a lot of us. It's the companys that are getting royally screwed. And the ticking timebomb for us is when they suddenly wake up and realize that. At that point knowing another platform is going to come in mighty handy.

Re:Windows Means Work

[shirt-ripper!!]

Yeah, thank god for Windows. I spend more time patching and securing our Win boxes than I have ever had to with our *nix boxes/servers or Cisco equipment. Those bastards at Microsoft will keep me employed forever...gotta love them.

Re:Windows Means Work

[grub]

What you mean is "Windows Means Job Security".

Think of it from the other side of the fence; if you weren't running Windows on every desktop you wouldn't need your 2+/week meetings to discuss the latest viruses and trojans.

Of course that would mean your IT budgets would be cut and people laid off as your group became more productive with less.

We can't have that now, can we?

Re:Windows Means Work

[Johan Veenstra]

> and then do a system-wide deployment of the fix to some 2000+ clients. I like to think
> that as long as Microsoft keeps making, er, crappy software, and as long as we still
> have crackers writing virii and trojans, I don't have to worry about losing my job.

Shouldn't that be: "As long as windows keeps providing us with fixes to the exploits, I'll be ok. And as long as we can sweep the other problems under the rug, I don't have to worry about losing my job"

Re:Windows Means Work

[Morosoph]

Time again to post an article on The Broken Windows fallacy.

Re:Windows Means Work

[Anonymous Coward]

Heaven forbid. If you installed something that didn't have Virii, Exploits, Flaws & crashes, what would you do?

Maybe find ways to improve the infrastructure? Evaluate new software products? Streamline internal procedures? Make your infrastructure better, instead of constantly fighting fires?

Is it really such a great job to run around putting out fires and installing fixes, or would you rather sit around and come up with new ways to save the company money and improve efficiency?

God, it sounds like you're a Horse Manure shoveller around the time of Automobiles. "If the Automobile gets popular, we won't have any sh*t to shovel. We'll be out of a job!"

Re:Windows Means Work

[Afty0r]

I've realized one thing: Windows means jobs in the IT security sector.

This is analogous to saying that poor house building regulations and standards means more jobs for builders, plasterers, repairmen, plumbers etc.

It does mean more jobs, however more jobs != a good thing - you're using the wrong metrics.

Re:Windows Means Work

[lutzomania]

That's a great essay. Those with points, please mod up!

Re:Windows Means Work

[harks]

So you're saying it makes wasteful jobs while the people performing these jobs could be doing something more productive?

Re:Windows Means Work

[Morosoph]

This link is better.

Re:Windows Means Work

[smittyoneeach]

Concur with link essay.
In two words, the argument is "resource leveling".
Specifically, business is a pile of cash, and these viruses spread the money around in the form of security jobs.
Unfortunately, you've flattened you pile of cash, and productive things you could have done simply go wanting.
Widening the scale, M$ itself is a right colossal pile of cash, and the rest of the world is tired of heaping money thereon.
How many more episodes of "Virus of the Week" does Redmond think it can stand?

Re:Windows Means Work

[triptolemeus]

You call that job security. Let me think about that one.
Patching a windows system and keeping av-software up to date is work that really doesn't need a high educated kind of person. It doesn't even need to be someone who is on site. Windows is made for, er, 'stupid people' remember.
Since you probably live in some kind of western country and you very probably get more money every year, you will be (or even are) far too expensive.
For the company it would be cheaper to replace you with either a young untrained 'patchworker' or transfer the patch department to a low income country.

But you're right, the job is secure, after the transfer, the job is still there, the question is if you still get paid for it.

Re:Windows Means Work

[Hu's_on_first]

While I can't argue the fact that flawed software creates jobs in IT, I think it's short-sighted to consider this a "good thing". If your employer is spending x number of dollars to patch currently deployed software, that's x number of dollars not being spent on new development. Basically, it's a drain on the economy as a whole, and that can't be a "good thing".

Re:Windows Means Work

[Xaoswolf]

No, because if everyone switched over to Linux, we'd have all the virus writers writing viruses just for different systems, there would still be inept admins running systems, and users that don't follow any kind of safe work habits.

Re:Windows Means Work

[scorilo]

The same argument was not long ago used by US car makers. They built crappy cars, that required many visits to the mechanic, buying parts, getting to know your car "intimately", etc. (Didn't they invent the term "planned obsolescence"?). Then the Japanese came with cheaper and much better quality cars, bringing the US auto industry to near collapse. They survived only through protectionism and government bailouts.

Re:Windows Means Work

[andy1307]

Microsoft is getting into the anti-virus business. Which means it will bundle its own anti-virus software with windows. Which means it will hurt symantec et al. Which means less jobs for IT workers...

Re:Windows Means Work

[vrt3]

... Broken Windows fallacy

So you're trying to tell us, on /. no less, that Windows is not broken after all??

Or should I have followed the link? This is /., you know.

Re:Windows Means Work

[cabazorro]

Sure we can hire someone from the street to sit behind a desk with a web browser and start reading every single Windows security report. Then that person would be assigned to patch every Windows machine in the office by clicking on the icon that says "download patch". And then that person will have to click on the icon that says "install security upgrade" and so on. We will call that person IT Security Officer and pay them 12 dlls and hour. He/She will carry a beeper and look very professional! And cyberspace will be better safer...NOT!

Re:Windows Means Work

[Anonymous Coward]

It depends whose jobs you're talking about. If its my job that is protected by Microsoft, then Microsoft is good. Who cares about the business as a whole, my stock options aren;t worth shit now anyways.

Re:Windows Means Work

[antiMStroll]

Crime and disease mean work too, but with all deference to the skill and dedication of the professions involved the world would be better off without them.

Re:Windows Means Work

[Morosoph]

LOL this link is better, anyway :-)

Re:Windows Means Work

[NaugaHunter]

I have never seen a more explicit example of why IT support insists on removing Macintosh computers. Do you really find life rewarding, cleaning up after others mistakes? If you are a skilled, intelligent person, wouldn't you rather create new software/hardware that would advance society, rather than simply keep it at a level of dependance?

I could go off on a number of tangental analogies, but I'm not actually trying to be a troll. This is a classical problem in many industries/environments, it just comes to the front with Windows due to the number of installs/exploits. In my first computer job we supported a health care system we hadn't written. As we did, we would fix the problems and not just the data, and wondered why the original company didn't. The answer was simple: if the software didn't have problems, there wouldn't have been support calls, and that's where the real money was.

Re:Windows Means Work

[Spectre]

A better analogy might be:

Poor household wiring means better job security for firefighters.

Re:Windows Means Work

[bs_02_06_02]

Ultimately, the consumer decides. Windows might just be a passing fad as Linux (or open-source) is on the upswing. Does that reflect a change in consumer values? Other products in the past were similar to this. People didn't understand the technology. So they based their decision on ease of use and service. Eventually, the consumer became educated, and they chose the best product.

So far, the market has seen Windows for what it is... the first commercially successful, easy-to-use OS that has great office applications. Therefore, "everyone" uses it.
Windows has evolved to fit, at least on the surface, consumer demands. Until someone comes up with a great alternative that beats MS on price, convenience, and acceptability, MS is still going to be king of the hill. MS isn't stupid either. They've seen the writing on the wall. Software development is easier. More people can write software. The consumer is wiser. The competition is tougher. It was not hard to come up with an Office knock-off that reasonably interoperated with the rest of the world.

Microsoft uses guerilla-warfare tactics to defend their revenue stream:

Lawyers defending copyrights more briskly than before. MS has a much bigger budget for lawyers.
Developing new "standards" that aren't really standard... MS owns them. (.NET)
Disinformation. Paying Gartner group to "study" windows vs. Linux.
Coercion, by way of hardware partnerships w/ Intel, Dell, and others... and urging foreign countries not to go their own way with software and hardware.
Subsidy. Giving large donations to schools and foreign countries to keep them hooked on windows.

Windows is not a tough sell. It's like crack cocaine. People look at the up-front cost... and it seems so inexpensive. Then, the time-consuming part comes in. The viruses, the attacks, the spyware, crashes, hardware and software conflicts, script kiddies.

MS's marketing is superb. It's not hard to sell crack cocaine. Everyone wants it. Software companies, Value-Added-Resellers don't want the system to change. They want to keep reaping profits.

Outside of MS, there is plenty of incentive, but fractured organization prevents a concerted effort to drive MS out of homes and businesses.

Sadly, there might always be a market for Microsoft. From a business-owner perspective, at this point in time, it's easy for me to choose a MS product. If something goes wrong, I get to scream bloody murder until they fix the problem. I can even get a lawyer and sue. If I was using free software, I probably won't get to scream. I would have to buckle down and deal with it, or find someone to fix it for me.

As a consumer, it's easier to put Linux on a desktop and be productive in several hours. It's a matter of convincing the general public, which means a media war. We'll have to fight the Gartner group's messages of doom and gloom.
It's easy for MS to point at Linux and say, "Look at all of the bickering. Imagine supporting that!" In reality, it's diverse and specialized for a reason. Compare it to the automobile, or the bicycle. There's not ONE design that will make everyone happy. It's clear Windows will not make everyone happy, or we'd not make so much fun of Bill Gates. There are dozens of needs. Thankfully, open source software is increasingly user-friendly. There are many more options in Linux, too.
Ultimately, it comes down to a war of words. Fighting disinformation will go a long way to allow the consumer to make their choice.

Re:Windows Means Work

[randallman]

Great idea. I think I'll put a sledge hammer to our copier so that we can hire somebody to fix it.

Re:Windows Means Work

[Anonymous Coward]

Like getting fired to save money?

Re:Windows Means Work

[Anonymous Coward]

i'd rather put a sledge hammer to your ugly face, fucker

Re:Windows Means Work

[Anonymous Coward]

The article isn't very good, but the fallacy is very popular. See today's claims from the telemarketing "industry" about the people it employs for another example.

Re:Windows Means Work

[pmz]

I like to think that as long as Microsoft keeps making, er, crappy software, and as long as we still have crackers writing virii and trojans, I don't have to worry about losing my job.

So, you are an auto mechanic...in disguise. I hate to say it, but Microsoft became number one by being the Chevy of computing. It'll get you there--most of the time.

Re:Windows Means Work

[pmz]

We can't have that now, can we?

It is interesting how history is always repeating itself with respect to improving technology. But, we cannot preserve the status quo, because the future holds unimaginable promise for humanity!

For example, I think lawnmower technology will evolve until we end up with a automatic mower with four legs and a chopper-jaw assembly near the front, chemical processing unit near the middle, and a processed-grass dispensor at the rear. Using sophisticated AI algorithms, it will roam the lawn in search of higher grass that needs trimming. All by itself!

Re:Windows Means Work

[kdsolutions]

Ahh... So Billy Gates wasn't lying when he said XP was more secure!

Re:Windows Means Work

[Anonymous Coward]

You must be new here. In order to whore karma you need to not try to make sense, and concentrate on coming up with sensational crap that backs up the parent poster. Good post though. Too bad that is not oft rewarded here.

Re:Windows Means Work

[WasterDave]

No man, it means your job is crap.

It means that you and your task force have to run around hosing down fires twice a week instead of using that same talent to find ways that the company can make more money using Information Technology.

Like, wouldn't that be more fun? Wouldn't it be better for the company? Would it be better for *everyone*?

Dave

Re:Windows Means Work

[693746]

At least twice a week, my office has a meeting where we discuss the latest Windows virus or exploit, organize a task force, and then do a system-wide deployment of the fix to some 2000+ clients.

Wow, you have the funnest job ever.

Erik

Why why why?

[grub]

Why is such an important system run on Windows? This isn't an "MS sux0r5, install Linux" rant, they should use the proper systems for the job. If that tool is some open source stuff or closed source then so be it but you can't tell me that this database can only be run on Windows.

Of course "When your only tool is a hammer, every problem starts to look like a nail." ..

Re:Why why why?

[Second Vampyre]

I think your post needs more cliches to be successfully moderated up.

Won't someone think of the children?

Re:Why why why?

[Anonymous Coward]

Why is WINDOWS a bad solution for this?
LINUX needs just a frequent patching.
I haven't had a virus hit my windows machine in
4 years.
I use only cheap antivirus, no firewall, and only monthly patching.

More recently than my infaction we lost our
college's LINUX server to a script kiddie.
Is that better than a virus?

Re:Why why why?

[Anonymous Coward]

I never suggested using Linux for this, did I? I suggested using the right tool for the job. Using your Linux box example: if you're concerned about security and there are no Linux-specific tasks on that machine consider OpenBSD.

Re:Why why why?

[Anonymous Coward]

I agree. He should have said. "We need to insert a beowulf cluster of windows bug overlords, you insensitive clod!" That might have done the trick.

Re:Why why why?

[iamweezman]

Why is such an important system run on Windows? Yeah, I mean Duh! They should be using Linux and OpenSSH. That is sooo secure.

Re:Why why why?

[bazik]

"...but you can't tell me that this database can only be run on Windows"

Remember, there is no "Microsoft Access" for Linux yet ;-)

Re:Why why why?

[Anonymous Coward]

It is a HELL of a lot more secure then windows. FUCKTARD. God damn man. A remote login or a remote root exploite every fucken week. ..

Re:Why why why?

[Anonymous Coward]

why did this job require Access? There are loads of other database packages out there.

Re:Why why why?

[TiggsPanther]

Has their ever been an attempt to make an Access/compatible OS database?

Or does everyone who writes OS databases just think Access sucks?

Re:Why why why?

[Creep73]

Your comment assumes you know the setup the hows and the whys of what they are using. I would like to know how you know all of this.

I know you don't know the setup so how can you say Microsoft isn't the best tool for the job unless you are simply an anti-Microsoft person then of course your rant is nothing more than the same old Rhetoric. I have read allot of the speculation thrown out as if it was fact or had some basis in reality (Which it doesn't) and find it humorous. It's like watching a group people have a conversation on something they do not know anything about. Hey, that's exactly what it is :)

Thats all I can say at the moment.
:)

Here we go

[suso]

Go ahead, make fun.

Maybe this was so Microsoft could import more foreign programs to fix their bugs.

Re:Here we go

[suso]

Um, I meant to say programmers.

You know, in the time the slashdot system calculates how long it's been since I submitted my last comment, it could have submitted this comment instead of complaining about me being too quick.

Re:Here we go

[garcia]

maybe the US government could have better IT departments...

Instead of wasting time being completely down, take the time to patch these system (either with distributed patching or even individuals taking the time to patch EACH machine -- oh the horror).

It's much better than not being able to issue Visas or do any other work while you have to keep your PC powered down until it is certified clean by IT.

Re:Here we go

[FosterKanig]

Picking on MS for security is as easy as shooting fish in a barrel.

No wait, it's as easy as looking at fish in a barrel.

No wait, it's as easy as being somehwere near a barrel.

Re:Here we go

[cehbab]

lets lobby to require a license to plug into a network ;)

Re:Here we go

[Anonymous Coward]

Yes, because foreign programmers are SO much better. They hold secrets that people from the United States can never know. Please...I program with people from other nations and we are all on the same level. It's ignorant to think that the imaginary lines between nations mean anything at all.

Re:Here we go

[shepd]

>lets lobby to require a license to plug into a network ;) ...licensing. Because nothing beats making $100 to plug a cable into a computer!

Re:DOH!

[ikkonoishi]

Visa as in Pass into the United States.

Not as in Credit Card.

Re:DOH!

[winstarman]

credit card? read closer.

Damn terrorists!

[MagerValp]

So now even terrorists using a fake name won't be able to get into the US!

Re:Damn terrorists!

[Dr Caleb]

Only 78,000 suspected Terrorists?

I thought the U.S.A. P.A.T.R.I.O.T act made everyone in the US a suspected terrorist. That should read "300,000,000+ suspected terrorists".

Did you read that article on politechbot.com that they wouldn't let some guy wearing a little button that read "Suspected terrorist" fly on an airplane?

Re:Damn terrorists!

[rmohr02]

Don't worry. The Census still has their database of "suspected terrorists".

Re:Damn terrorists!

[powerlord]

Its exactly that additude that has kept me from wearing a T-shirt I picked it up. The front is blank, the back read in big white letters (on a black T-shirt): Bomb disposal technician. If you see me running, try to keep up!

I just get the feeling too few people have a sense of humor now-a-days :(

Re:Damn terrorists!

[fermion]

No, you have it backwards. Everyone in the U.S. is a suspected traitor.

Everyone outside the U.S. is a suspected terrorist. That would make the number 6,000,0000,000.

Re:Damn terrorists!

[Anonymous Coward]

"Everyone in the U.S. is a suspected traitor.

Everyone outside the U.S. is a suspected terrorist."

Of course, it depends who is doing the suspecting.

In my book, every employee of the INS is a suspected asshole.

Re:Damn terrorists!

[blibbleblobble]

"Did you read that article on politechbot.com that they wouldn't let some guy wearing a little button that read "Suspected terrorist" fly on an airplane?"

Some guy being John Gilmore:

http://freetotravel.org/terrorist.html

You're right: there are 300 million suspected terrorists. But their names don't need to be stored - they took a hint from verisign, and just used a wildcard.

Select * from americans where police_badge = NULL;

Re:Damn terrorists!

[Saeger]

Oh come on, grow a backbone and wear the damn shirt. Your silence only helps to sustain the climate of fear, when instead you could be helping to 'disarm' it (pun intended) with laughter.

--

Re:Damn terrorists!

[pmz]

That should read "300,000,000+ suspected terrorists".

Well, have you heard of terrorism being committed by dead people or people who haven't been born, yet? Obviously, all humans are potential terrorists, and the PATRIOT Act simply allows them the freedom to live their life in a maximum security prison. Thus, by imprisoning everyone, we are free from terrorism. You do support freedom, right?

Priceless!

[ncmusic]

Seems like there's a Mastercard joke in here somewhere.

Re:Priceless!

[fruey]

• Setting up a server with low (i.e. no wage at all actually) salaried temporary work placement dude: $3000 (hardware 2000, 1000 for OS)
• Training staff to use Outlook for all their email: $3000
• Watching productivity drop as everyone clamours for old UNIX based sendmail system "at least it worked" while viruses make network quarantine inevitable : Priceless !!!

Re:Priceless!

[Anonymous Coward]

You think you'll get less vulnerabilities with sendmail !?!

Guess you're not a mail admin...

Re:Priceless!

[Anonymous Coward]

it's visa you dumbass

Re:Priceless!

[rmohr02]

Well, Visa and Mastercard are really the same collection of about 5,000 banks--you never see a Visa ad deprecating Mastercard or vice-versa.

Re:Priceless!

[ncmusic]

Yes...that's why it was funny cock neck.

Re:Priceless!

[fruey]

I am a mail admin. I'm just not a pedant.

MS Exchange is still hopeless compared to sendmail. Sendmail may have vulnerabilities, but Exchange just has performance issues and licensing costs that tip the scales. Exchange, in fact, suffers from too many features. It has also confused a reasonable proportion of the marketplace, who when asked to name a mail server, say "Exchange" first. I see too much corporate mail coming from Outlook/Exchange combos :'(

Whatever you say. I use Postfix myself...

Oh, *that* VISA....

[KFK - Wildcat]

And here I was thinking about all the new "Already approved VISA platinum card!" in my inbox...

Re:Oh, *that* VISA....

[CXI]

No kidding. I thought I might actually have to go to the bank and get cash out. *shudder*

Damn!

[mschoolbus]

I almost thought there was no online shopping at work for me today!

DOH! DOH!

[192939495969798999]

I think I speak for every /. skimmer when I say, DOH!
Again, this is why I am switching to art... all those similar words (like VISA, visa) are confusing to me :)

Re:DOH! DOH!

[Kadagan AU]

Exactly... I was thinking "I'm glad I withdrew some cash from my account, apparently my VISA card won't work anymore!"

78.000 suspected terrorists?

[Raindeer]

Dang, just imagine how many people that is. Have they actually researched all those people? I am just baffled by the sheer number and really wonder how they came up with that list.

Re:78.000 suspected terrorists?

[Anonymous Coward]

Racial Prejudice, I'm sure of it.

Re:78.000 suspected terrorists?

[stratjakt]

The combined intelligence from the INS, CIA, FBI, NSA and intelligence agencies from other countries like Britain, Russis, Israel, France, etc, etc.. (Yeah they might protest the war in Iraq but they share intelligence and have for years).

Re:78.000 suspected terrorists?

[eddy]

We'll, if Steven owns ten guns and threaten a government official, that's equivalent to two terrorists (5 guns / threat == 1 terrorist).

Please call the MPAA if you want to learn more about this new branch of mathematics.

Re:78.000 suspected terrorists?

[stratjakt]

Actually, after looking at the state depts website, I found this.

Seems that when someone applies for a visa, gets checked out and denied, they get added to CLASS.

Re:78.000 suspected terrorists?

[Hes Nikke]

make that 78,001 suspected terrorists! questioning how the government decides who is a terrorist makes you an obvious potential terrorist!

<soup="nazi"> NO VISA FOR YOU!!! </soup>

Re:78.000 suspected terrorists?

[Lane.exe]

I am just baffled by the sheer number and really wonder how they came up with that list.

Behold.

A dark room somewhere in the bowels of a Washington, DC, office.

Alright sir, just a few questions... Are you white? No. Are you Christian? Nope. Did you vote for Bush? Nope. Well, three strikes and you're out. Put Mr. Zamir on the list.

Re:78.000 suspected terrorists?

[ikkonoishi]

You read it wrong.

Its only 78.

The computer added the precision on so if the terrorists blow themselves up they can count the pieces.

Re:78.000 suspected terrorists?

[Anonymous Coward]

Probably all called Muhammed or something.

Re:78.000 suspected terrorists?

[Anonymous Coward]

Well imagine that I have heard of people who cannot go to the US any more because someone with the same name is on that list. Imagine how carefully this list has been written. And imagine how carefully those people have been researched. Not to mention that this person, after speaking with the authorities, has been told that well, they cannot do anything against it...

Re:78.000 suspected terrorists?

[Orne]

78,000 out of an estimated 6 billion people on this planet, comes out to about 0.0013 % of the world's population. The government's 2001 statistics show that there was 1,063,732 new permanent immigrants entering the united states. Another report on visas issued (Table F) shows that in 2002, there were 13,230,001 temporary visas issued to foreigners to enter the united states. And thats just visas granted, not counts of applications. The raw data also shows the USA had a total of 27,907,139 visitors crossing our borders with visas in 2002.

So, from the numbers above, they have 78,000 applicants as suspect, which is roughly 0.28 % of all visitors. Not exactly a huge amount relative to the sheer number of people trying to get in.

Yes, I can believe a number that large. They could be ex-soldiers from suspect countries, foreign "students" registering in obscure american colleges for odd majors, maybe someone trying to get in with an H1-B who doesn't seem to match his job description, or anything that appears out of the ordinary when cross referenced with other security lists. Did our visa applicant recently travel from Iraq to North Korea, next to the USA? Flag him. Did our visa applicant happen to be in a particular Afghanistan town 2 years ago, when we know that other known terrorists were there at the same time frame? Flag him too.

There are thousands upon thousands of people trying to enter the united states every day, and our government has a monumental task to validate their reasons for entering. Obviously they are trying to research the histories of everyone to the best of their ability, which is why getting the different law enforcement agencies talking to each other was such an issue for the Bush administration. Some people say we're scrutinizing too much, but even more believe it's not enough. Thinking that we have secure borders is a fallacy the US public needs to wake up to and recognize how easy it is for individuals to slip in under false pretenses. We can't be isolationists, but we can certainly do a better job than we've done in the past.

Re:78.000 suspected terrorists?

[arth1]

Dang, just imagine how many people that is. Have they actually researched all those people? I am just baffled by the sheer number and really wonder how they came up with that list.

if (($middlename =~ /(Al|Ben)/)
|| ($countryoforigin =~ /stan$/)
|| ($flagcolors =~ /green/)) {
$person->suspect++;
}

Regards,
--
*Art

Re:78.000 suspected terrorists?

[Anonymous Coward]

I made it on that list back in 2000 for involvement with anti-WTO organizing. We found out when Robert Muller gave some speach about what they were doing about terrorism and named the group I was affiliated with as a group they were watching. When a few of my fellow organizers and I heard of this, we thought it was funny (we're a bunch of college kids and labor orgainzers who have no involevment with anything more millitant then getting people together to yell at anti-democratic and thus un-american business interests. The list also included a group that didn't actually exist, a newspaper, and a group name that was coined as an inside joke amongst activists), but after 9/11 and PATRIOT went down, we were proper terrified and researched it a bit. so far as anyone understands it, these lists are based on little or nothing. basically, the FBI is so swamped with data that as soon as they hear a name, they add it to the list, because this is regarded by high-ups at the DOJ as a positive step. I belive the theory is that if a name comes up time and again, they can investigate further. I would hope that they also have a list for people who might genuinely hurt someone and that this "watch list" is sheer PR or scare tactics, but I really have no idea. other then being "randomly" searched every time I get on an airplane, it hasn't really impacted me at all.

Re:78.000 suspected terrorists?

[Zebbers]

78000 out of the billions on earth
seems small to me

Message sent to all stores:

[Anonymous Coward]

Please keep an eye out for mid-eastern looking people, they are most probably terrorists.

Do not, under any circumstances, sell them nuclear weapons or plastic spoons.

New ad campaign

[Anonymous Coward]

Not being able to check every visa applicant for terrorist or criminal history...

...priceless

good job timothy

[Ian 0x57]

i like this article, you managed to point out that it was Microsoft Windows without directly pointing it out. I was looking for the manditory finger shacking but i was happy to see it not there !

Well..

[instanto]

So they'll blame this virus attack on terrorists then maybe?

Well, it would have been interesting if the terrorists created a virus that got inside these systems and then started having some fun with the data...

Good to see that security is taken seriously in the government and that systems such as these are protected. :-)

Even if a perfectly secure OS existed

[garrulous]

security professionals would still exist to protect users from their own stupidity.

Re:Even if a perfectly secure OS existed

[Anonymous Coward]

security professionals would still exist to protect users from their own stupidity

but isn't that what just happend? an idiot forgot to patch.

48 hours without a working system

[straybullets]

expect terorism outbreak soon.

Re:48 hours without a working system

[Anonymous Coward]

No no, its O.K. 78,000 terrorists are currently trying to clean an email born virus off of their computers that they got from the U.S State Department this morning.

Shut down on purpose, not failed....

[jdreed1024]

According to a CNN article, the State Department shut down the network to prevent the spread of the virus. It was down from noon until 9PM on Tuesday. Shutting down a network on purpose is different from having it "fail" due to a virus.

Re:Shut down on purpose, not failed....

[Anonymous Coward]

cnn lies.

Re:Shut down on purpose, not failed....

[phillymjs]

Shutting down a network on purpose is different from having it "fail" due to a virus.

Not by much, since both have the effect of putting a stake through the heart of user productivity for however long it takes to exorcise the virus from all the systems.

~Philly

Re:Shut down on purpose, not failed....

[Anonymous Coward]

You sir have just totally shaken my world view! Everything is just so clear now.

Re:Shut down on purpose, not failed....

[Anonymous Coward]

Does it matter? The effect is the same. The network was down because of the virus, and no visas could be issued in the meantime.
Btw, I thought this virus was already one of the past, having had it's best time? Ah well, governements are known to be slow, and US is always a bit slower than the rest of the world. (hey, even the day they have like 12 hours later!)

Wouter.

Re:Shut down on purpose, not failed....

[jdreed1024]

Not by much, since both have the effect of putting a stake through the heart of user productivity for however long it takes to exorcise the virus from all the systems.

Uh..... If the network is shut down to prevent infection, then you have fewer PCs on which to do a full re-format and re-install of the OS. Even with a drive image, this takes a long time. This means more work for the IT folks. So even if you left the network up to let the visa-processing folks do their work, you'd be making more work for the IT people. It's about minimizing the effects.

And yes, you should always be doing a full re-format and re-install on any machine that gets hit with a worm. Especially one that allows arbitrary commands to be run on your machine. Even after running the "cleanup" tool from Symantec, NAI, or whoever, you have no guarantee that your system is free from backdoors or that your data has not been altered in some way.

Re:Shut down on purpose, not failed....

[Anonymous Coward]

Shutting down a network on purpose is different from having it "fail" due to a virus.

That's weak. Non-operational status is failure, QED.

Re:Shut down on purpose, not failed....

[LostCluster]

The analogy here is a military escort with orders to prevent somebody from falling into enemy hands having to shoot the person they were supposed to be protecting to foil a kidnapping. Yeah, the protected person didn't fall into enemy hands, but it isn't exactly successful protection and it's just as bad as if the enemy did the shooting...

Re:Shut down on purpose, not failed....

[tomhudson]

you wrote:

Shutting down a network on purpose is different from having it "fail" due to a virus.

Not really.

1. The network was shut down
2. The reason was to stop the propagation of a virus on a virus-prone OS
3. The network was unable to provide the services it was designed for because of this

Works out to the same thing. Your position is like someone saying the operation was a success but the patient died.

Perhaps another analogy - your car's computer detects that the brake pads on your car are worn to the point where they might score the rotors - so it disconnects the brakes. Having to shut down the whole network to contain a virus is equally bad design.

Re:Shut down on purpose, not failed....

[47PHA60]

The result is what matters: Network down bad.

Re:Shut down on purpose, not failed....

[asr_man]

Oh, and the power to NYC didn't fail either -- it was shut down on purpose too (really). So do you really think the millions of people affected didn't consider that a failure? Puhleeze...

No service = failure.

Re:Shut down on purpose, not failed....

[Malc]

Let's not forget which department this is. Immigration are the slowest department on the face of the planet (ever had to use them?) Those goverment leeches probably work less than 4 hours a day anyway. Besides, 4 hours of lost productivity is nothing when somebody has to wait 2 months for a visa, or 2 years for a green card.

Re:Shut down on purpose, not failed....

[Anonymous Coward]

CNN?
I rest my case.

Re:Shut down on purpose, not failed....

[DickBreath]

Shutting down a network on purpose is different from having it "fail" due to a virus.

I should further add that shutting down a network on purpose should not be counted as "downtime".

And the costs of shutting down should not reflect negatively on TCO. (Maybe it could even positively affect TCO?)

These things just happen. We expect them. We should learn to live with the limitations of our systems.

(unless we're talking about open source, then forget the above statements.)

Spoken like a true Microsoft fanatic and zealot.

Re:Shut down on purpose, not failed....

[Anonymous Coward]

Shutting down a network on purpose is different from having it "fail" due to a virus.

Not by much, since both have the effect of putting a stake through the heart of user productivity for however long it takes to exorcise the virus from all the systems.

Very true. Just a week or so ago my net connection died for a day. After calling my ISP, it turned out some filter of theirs detected 'an attack' on my IP - I wouldn't be surprised if it was a worm side-effect, I seem to recall a piece on slashdot about it - so they simply cut my connection. The microsoft way for safety - no net!

When is the Gov't gonna learn

[Anonymous Coward]

Some day soon there will be a class action lawsuit against M$ regarless of their 'Hold Harmless Agreement' in the EULA.

And BTW, firwall WON'T in and of themselves stop this kind of attack. Sure firewalls are your first line of defense, but all it takes is someone that has a notebook that is infected from home, a business trip or somewhere ELSE to bring it as a 'trusted' device on your clean network and BOINK, you are infected internally.

Firewalls??

[Kushy]

What is a gov agency doing having open ports on their firewalls anyway?

Honestly issuing visa's is just way to importiant to trust to a closed OS with known security flaws, with at least one major one a month.

MS is so entrenched in the gov now that its kind of scary, that one day a order might come down to homeland security that some town is nothing but terrioriests and should be arrested, then taken to cuba. Meanwhile some hacker in the assend of the planet wiring a virus to gain entry to the gov systems is laughing his ass of at Ma and Pa being taken to a Marine base in another country.

Re:Firewalls??

[cehbab]

It was cheaper to do without ? We all know how the budgets of gov departments are continually being slashed :)

Re:Firewalls??

[stratjakt]

You're a dope.

CLASS isn't an access database running on a windows server. It's running on big iron, probably Oracle, or perhaps not even a RDBMS at all, but a custom data store solution.

Anyhow, the virus didnt take the system down. They took the system down to inspect the network.

If one box on the network got r00t3d, then a r337 h4x0r could use it to query the system.

This is just a bit of better-safe-than-sorry administration. It really has nothing to do with Windows, except a line about a completely unrelated memo that refers to a totally seperate facility.

Perhaps they all run linux and are worried about the flurry of flaws found in "secure" open source. The result would be exactly the same.

And firewalls dont prevent someone from brining a virus in with their laptop or the floppy with the hilarious flash based game that one clerk wants to show her friends.

Re:Firewalls??

[NightSpots]

Since it was Welchia, my guess is that they *DID* have firewalls, and that the infection came in through a non-standard method.

In so called mission-critical networks, you dont always push windows updates to all the systems: sometimes you just can't trust the patch. In these cases many network admins will toss up a strong firewall to protect the internal machines.

But what happens when someone brings in their home laptop with a virus on it? Well... you bypass the firewall and expose the internal, unpatched network. With Welchia, this is a guarantee of network problems, because it's a brutal, traffic intensive bastard that has taken out more than one core router with it's bursts.

Your complaints that this is the fault of windows is silly: the machines infected probably aren't the ones running the databases, but the employees desktop systems who use the database. Forcing those people to switch to Linux is silly: it requires them to rewrite all of their software and retrain all of their employees, that's not a trivial task. We've also seen 5 remote root exploits in very common Unix software in the last two weeks (openssh, openssh, sendmail, proftpd, openssh), and at this point, I would suggest that anyone running a mission critical operation on Linux without a properly configured firewall is absolutely stupid as well.

Re:Firewalls??

[retro128]

Well the problem may not be that there is no firewall. I've got a firewall in my network but Welchia managed to sneak in on a user's laptop when he hooked it up to the local network. Fortunately, my second line of defense is Norton Coporate edition...And believe me all the systems lit up like Christmas trees. UNfortunately, a couple systems in my network had buggy installs of Norton and they weren't taking auto updates correctly. There were only two, and I quickly isolated and disinfected them.

This underscored the importance of patching systems even though they may be behind a firewall, which I regrettably had been pretty lax in doing. You don't know when one of these things will piggyback on a mobile system. I'm just glad it was a relatively benign virus like Welchia, in that it doesn't cook your files...In the future I'm betting these kinds of bugs will carry way more payload.

Re:Firewalls??

[cmacb]

I'm 99.9 percent certain that CLASS is a mainframe based system. So whoever at the State Department put this announcement together without having all the salient facts in front of them isn't doing their job very well.

The core data process organization at State has always been IBM mainframe based. However they have been under fire for years by people who wanted a more distributed system. Guess who is winning?

The number of people it takes to maintain the tens of thousands of PCs there has skyrocketed, along with all associated costs. The fact that the number of records in the database is in the millions is stated as though it is a phenomenal effort, and of course it is when you try and do it with the wrong tools. The number of transactions to connect every embassy or visa issuing post in the world back to DC would be trivial compared with what goes on to replicate a mainframe database to more than 200 locations around the world and then to replicate back any updates made at those locations (and attempt to try and do this in something resembling real-time).

I'm quite sure that the CLASS database was never in any serious jeopardy. But I'm just as certain that the surrounding infrastructure is constantly exposed to attacks and it is quite possible that some of the attacks are not only successful, but never get detected.

The people administering the network there have a tiger by the tail. They are pressured to allow thousands of bureaucrats to browse the web and tend to personal business on the internet while at the same time trying to protect an integrated network that has no business connected to the internet at all.

Having done some consulting at a number of government agencies my fear is that the people at the top get much of their technical education from sales reps (from Microsoft mostly these days) and have very little communications with the technical people who have to implement these mandates.

As was shown to be the case at NASA recently, the low level technical type who raises his hand and tries to point out a technical problem is quickly taken off the invite list for future meetings. As can be seen from the initial reports on this and the "corrections" that followed, a lot more time is spent trying to put a happy face on these screw-ups than getting down to the root (no pun intended) of the problem.

It's visUM, not visA.

[Anonymous Coward]

Singular: visum, plural visa.

NOT singular: visa, plural visas.

Re:It's visUM, not visA.

[Havokmon]

Singular: visum, plural visa.

NOT singular: visa, plural visas.

Wel, keeping with the 'virii' standard, I believe the plural of visa should be visii.

Re:It's visUM, not visA.

[Anonymous Coward]

Good lord. Who modded you informative? Last I checked, we were speaking English here on slashdot (or at least trying to). Visum is not an English word.

Re:It's visUM, not visA.

[Jeremy Erwin]

The English visa is a an import of the 19th century French word le vise, which derives from the Latin plural past participle of videre to see. In Latin, visa roughly translates to "things seen".

Crudely, a visa indicates that the bearer's documents have been seen by the issuing country. As the issuance of a visa requires the examination of several papers and databases, visa is always plural. Moreover, as the French treat it as a singular form, and English imported it from the French, the Latin is of little consequence here.

Sources: TF Hoad, ed, Concise Oxford Dictionary of English Etymology (Oxford:Oxford University Press,1986)

Clearly the Kofi Annan of Slashdot commenters

[Futurepower(R)]

From the parent comment: "... Microsoft keeps making, er, crappy software ..."

I just want to say that I appreciate the tactfulness, sensitivity, restraint, and diplomacy of that remark.

Re:Clearly the Kofi Annan of Slashdot commenters

[skyhawker]

tactfulness, sensitivity, restraint, and diplomacy

You missed "accuracy." :)

Windows

[cybercuzco]

Because remember, if you use Windows, the terrorists have already won. (its a feature, not a bug)

When you don't patch up, the terrorists win...

[*weasel]

... yesterday's cliche joke, today's sad reality.

Why not have a PSA for this spammed out to the nation for a couple months?

Though I suppose it could be disqualified as the advertised danger apparently actually exists.

Re:When you don't patch up, the terrorists win...

[PainKilleR-CE]

Though I suppose it could be disqualified as the advertised danger apparently actually exists.

Only if the advertised danger comes in the form of "terrorists can't get into the country if they were going to bother getting their visa through the US government rather than using the Canadian or Mexican border".

Oh no, the government can't issue visas, so now terrorists on the list can't get a visa, and terrorists not on the list can't get a visa.

Re:Does the state dept. read /. ??? MAYBE

[Leffe]

Not allowing remote logins to something this important might be a good idea ^_^

Click Click Click!

[GillBates0]

The worm targets the DCOM RPC vulnerability and the WebDav vulnerability found in some of Microsoft Corp's products. It is expected to impact Microsoft Corp's IIS server, Windows 2000, Windows NT, and Windows XP.

78 THOUSAND suspected terrorists?

[braddock]

How on earth does the government come up with a list of _78,000_ suspected terrorists? This is the type of indiscriminant prejudice that a seige mentality creates. This is a list of everyone who ever talked to anyone who ever talked to someone who might be a terrorist. In many ways these people's rights are now forfeit.

If the US government actually cared about human lives, it would be spending this type of attention on automobile safety (50k dead a year in US) or malaria (>1 million dead a year worldwide) or cancer (half a million dead in US per year). Compare this to "terrorism" which has claimed maybe 5000 lives in the past 30 years.

Instead we spend more on a "war on terror" in a year than has been spent in the entire history of cancer research.

-braddock

Re:78 THOUSAND suspected terrorists?

[suso]

How? They just do a grep for names without vowels.

Re:78 THOUSAND suspected terrorists?

[bigjnsa500]

Paragraph 1: Answer is yes. Its people who talked to whoever. That's cool with me.

Paragraph 2: Car Safety. Answer is people keep getting bigger and bigger vehicles. Plus that number is mostly people who shouldn't have been in the gene pool anyway. Malaria. Don't live in a jungle. Cancer. Too bad we all get it. Stop smoking, stop fucking, stop eating bad foods. Easy.

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

So they really DO consider all those DDoS mirc warriors from poland terrorists!

Re:78 THOUSAND suspected terrorists?

[YeeHaW_Jelte]

If the US government actually cared about human lives, it would be spending this type of attention on automobile safety (50k dead a year in US) or malaria (>1 million dead a year worldwide) or cancer (half a million dead in US per year). Funny you mentioned malaria, cause I read the other day that Bill Gates just donated 168 million or so for malaria research. So we have a government spending money on getting microsoft to store their list of 78,000 terrorists, money which was better spent on malaria research, but which is actually donated by Bill Gates, chairman of the above mentioned software company that money was spent on uselessly.

Re:78 THOUSAND suspected terrorists?

[VEGx]

I think it includes all /. readers... after all they are always talking about viruses and such... :-P

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

And thats just the Palestine list....

Re:78 THOUSAND suspected terrorists?

[merlin_jim]

In many ways these people's rights are now forfeit.

Bullshit. These people are foreign citizens; what rights exactly do they have in the sovereignity of the United States that are now forfeit? All the rights guaranteed to them by national and international law are still in place; the only thing being denied them is entry into the United States, and if you're not a citizen of the US, you have no RIGHT to come here...

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

Yep, proof positive our government is clueless. When in doubt, label people terrorists. I bet they get a hefty budget increase when they have to track 78,000 people. Yep.

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

Answer is people keep getting bigger and bigger vehicles. Plus that number is mostly people who shouldn't have been in the gene pool anyway.

The moron in the SUV is more likely to take out the exvironmentalist in the electric vehical than to kill himself.

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

And thus the stupid people will breed and take over the world.

Reverse the trend- kill a luser today!

Re:78 THOUSAND suspected terrorists?

[schatten]

just make sure you use someone else's library card when checking out catcher in the rye.

Re:78 THOUSAND suspected terrorists?

[ryanvm]

How on earth does the government come up with a list of _78,000_ suspected terrorists? This is the type of indiscriminant prejudice that a seige mentality creates.

Ohp - now it's 78,001.

Re:78 THOUSAND suspected terrorists?

[Sevn]

Probably the same way they come up with a list of disqualified florida voters. It's not that hard to make a list.

Re:78 THOUSAND suspected terrorists?

[Zathrus]

How on earth does the government come up with a list of _78,000_ suspected terrorists?

Oh please. It's not bloody hard. That's such a small fraction of the world population it's absurd. I'm honestly rather surprised that the list isn't larger -- certainly if the list was formed as you suggest (everyone who ever talked to anyone who ever talked to someone who might be a terrorist) it would be a hell of a lot bigger. You could probably just toss in everyone from Ireland, the Middle East, and the various ex-Soviet states in there with that kind of criteria. Get real.

A list that small would have been culled from sources almost exclusively -- both domestic and foreign intelligence services sharing information on known or highly suspected terrorists. Are there people on the list who shouldn't be? Almost certainly. Am I pleased with the various new powers granted to law enforcement agencies in the terrorist witch hunt? Not particularly. But I'm also not going to put my head in the sand and claim that it's a non-issue.

If the US government actually cared about human lives, it would be spending this type of attention on automobile safety (50k dead a year in US) or malaria (>1 million dead a year worldwide) or cancer (half a million dead in US per year).

Yes, because the US government isn't spending billions on those already. Riiiight. What crap.

How much have you donated to those causes in the last five years by the way?

Compare this to "terrorism" which has claimed maybe 5000 lives in the past 30 years.

I presume you're attempting to restrict that number to number of dead Americans, which utterly ignores the larger issue. We're in a global economy that must deal with global issues. No, I don't think the way the US is currently trying to deal with terrorism is the right way, but the death toll is certainly higher than 5000. If you include non-American lives (which I certainly would), then the death toll is probably something on the order of 5000 in the last 6 weeks, or less. And the damage to economies is considerably higher when you consider the chilling effects that come from it (both from people being afraid and from government overreaction and clamping down on people and free trade in the process -- NPR had a decent story on how Palestinian companies are going out of business in the West Bank due to Israeli restrictions). Terrorism is hardly limited to the Middle East either. Virtually every country has its extremist groups (White power in the US; IRA in Ireland; Basque separatists in Spain; etc) and it's getting worse, not better.

Instead we spend more on a "war on terror" in a year than has been spent in the entire history of cancer research.

I think you're vastly underestimating how much has been spent on cancer research, particularly in the past. Not that I wouldn't mind seeing more spent on it -- my father died of cancer and my mother had breast cancer -- but that statement is just wrong. Is the US spending too much on the "war on terror"? I'd agree. But making BS statements like you've done repeatedly does nothing but weaken your argument.

Re:78 THOUSAND suspected terrorists?

[ZoneGray]

>> Instead we spend more on a "war on terror" in a year than has been spent in the entire history of cancer research.

Not even remotely true, unless you only count the money spent by the federal government. There are billions spent every day on cancer research by companies big and small, dwarfing what is spent chasing terrorists.

It's like that year at the Oscars when all those wealthy actors stood up and complained that the US doesn't spend enough on the arts.

Anyway, read the Preamble.... "in Order to form a more perfect Union, establish Justice, insure domestic Tranquility, provide for the common defence, promote the general Welfare, and secure the Blessings of Liberty to ourselves and our Posterity"

No mention of curing cancer, or PBS documentaries, or midnight basketball, or time off from work to take your dog to the vet. Those things are all reasonable, but they're not the primary responsibility of government.

Note, too, the difference in wording: "PROVIDE for the common defense, PROMOTE the general welfare."

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

serb more likely as in "srpsko-hrvtski" opposed to "hervato-serbski" ;-)

Re:78 THOUSAND suspected terrorists?

[merlin_jim]

In many ways these people's rights are now forfeit.

Bullshit. These people are foreign citizens; what rights exactly do they have in the sovereignity of the United States that are now forfeit? All the rights guaranteed to them by national and international law are still in place; the only thing being denied them is entry into the United States, and if you're not a citizen of the US, you have no RIGHT to come here...

This got modded as a troll last time. I'm not trolling. Read the mod guidelines. I am seriously asking, what rights do these people have that are forfeit? I can't think of a single right that they had that being on this list denies them...

Modding down a post that you disagree with as a troll is an abuse of mod power. If you don't agree, then respond.

Re:78 THOUSAND suspected terrorists?

[thryllkill]

If they can't patch windows, you expect them to grep things?

Re:78 THOUSAND suspected terrorists?

[Sarin]

hey wait a minute isn't 78000 exactly the number of u.s. people with an active slashdot account?

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

All the rights guaranteed to them by national and international law are still in place

In particular if they get transferred down to Guantanamo Bay.

the only thing being denied them is entry into the United States, and if you're not a citizen of the US, you have no RIGHT to come here...

Yes, except for the fact that 99.9% of the US population immigrated into the US. I always thought the US had another approach on the subject. It's just sad, because if you would only recognize the fact that the US are a great country mainly because of immigration. Restricting is not a great idea. But that's what they are doing.

Re:78 THOUSAND suspected terrorists?

[Quixote]

There are billions spent every day on cancer research by companies big and small, dwarfing what is spent chasing terrorists.

Lets see. "Billions" implies at least 2 billion. Multiply that by 365 ("everyday"), and you get $730 billion per year.
Slight exaggeration? I thought so.

Using your logic, billions are spent every day in fighting "terrorism" by private companies too, not to mention the states' use of National Guard and extra cops.

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

If the US government actually cared about human lives, it would be
spending this type of attention on automobile safety (50k dead a year in
US)

Actually, the US government spends much more expense and effort on automobile safety than it does on the entire state department (every freeway constructed and maintained in the US has dozens of safety features engineered into them - freeways cost $300M per lane mile (source ARTBA) to build at least $1M of which can be directly attributed to additional cost associated with safety systems). On surface streets every traffic signal and the vast majority of signage installed are safety systems.

This does not count the money that is spent on testing and developing vehicle standards, and the cost of monitoring the automobile industry. Also, the cost of testing drivers and issuing licenses is also safety related.

In short the US spends hundreds of billions of dollars annually on automobile safety. Should more be spent ? Perhaps, but can automobile safety be categorized as being ignored by the government ? No.

Re:78 THOUSAND suspected terrorists?

[/dev/trash]

They just GUESSED!

How do you think they got the list, they used intelligence.

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

There are terrorists in Ireland? No no, you must be wrong. My mothers uncles brothers second cousins friend was from Ireland and he was such a nice man. How can there possibly be any terrorists in Ireland? Haha, what would they fight over; potatoes and Guiness? You're so silly.

I won't have you say anything bad about those poor Jews in Israel, either. Just you leave those poor people alone!

Re:78 THOUSAND suspected terrorists?

[Richthofen80]

Hold on there, bucco.

Why is 78,000 too many? there are 275 million americans. that's not a large percentage at all. And they're suspected, not accused, or charged. Their rights are not forfiet, American citizens have a right to know what non-Americans are entering the country and whether they are here legitmately and what their purpose is.

How they got the number? People who announce their country of origin as a nation that supports or sponsors terrorism. Syria, Lebanon, Palestine, The Sudan, Iran, etc etc etc... there are probably about 500,000 people from those nations in the US. Those who keep in regular contact with organizations which fund terrorism, a lot of whom are registered as 'charities.' I bet if you took everyone who registers to these 'charities' as donors, you'd have about 78,000. How many are willing accoplices.

Terrorist ! always = suicide/bomber/pilot. Those who give money / aid to terrorists are themselves terrorists.

By the way, about your 'human lives' crap, Here's the deal: we founded a government to protect our rights to life, liberty and pursuit of happiness. Our life is threatened by terrorists. Its the same reason the government has an army, to protect citizens from physical harm. Cancer isn't a foreign national, and not something that the government is required to protect its citizens from. Medicine is a private endevour.

As far as automobile safety, in 1948 there were 25 million licensed drivers and 40,000 traffic deaths. in 2000 there are over 100 million licensed drivers and in 2000 there were 42,000 traffic deaths. I'd say the fact that we barely increased in deaths while quadrupling our drivers is a good thing.

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

hehe, you think the government might care about anything but its own power and welfare...
my 3 year old is more considerate of others

Re:78 THOUSAND suspected terrorists?

[jeffkjo1]

I better call up Lynyrd Skynyrd and tell them to get outa Dodge.

Re:78 THOUSAND suspected terrorists?

[droptop]

I would cry. It would be beautiful. To hear a President ask our Congress for 87 Billion Dollars to "Wipe out cancer in our lifetime". Imagine.

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

Terrorists in Ireland !??!?

We better hurry up and liberate their Guiness... umm... them.

Re:78 THOUSAND suspected terrorists?

[DickBreath]

Maybe you're using the wrongthink definition of terrorist? Using the newthink definition of terrorist, I would say that 78,000 is quite low. Proving that our war on terror is working and a justified use of resources.

Re:78 THOUSAND suspected terrorists?

[strider]

"Note, too, the difference in wording: "PROVIDE for the common defense, PROMOTE the general welfare.""

And I would ask that you note the wording of "ESTABLISH justice." The authors argument is not that cancer deaths are more important than terror deaths. It is that the government spends far too much time funding a process that he views as a) unjust and b) unlikely to bring about much reduction in the number of deaths resulting from terror. Please respong to this argument, not a straw man you have invented.

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

if you're not a citizen of the US, you have no RIGHT to come here...
Yes, except for the fact that 99.9% of the US population immigrated into the US. I always thought the US had another approach on the subject.

Exactly so. With few exceptions, the people who immigrated to the US asked permission first, obtained visas, and (if they wanted citizenship) fulfilled an array of additional requirements. USians have to go through the same procedures if they emmigrate.

Not having the RIGHT or entitlement to something is very different than being denied that thing. Want another example: you don't have the RIGHT to drive a car-you are granted that privilege for fulfilling certain expectations. OTOH, you do have the RIGHT to breathe and to talk to strangers.

Re:78 THOUSAND suspected terrorists?

[braddock]

Thinking in percentages when it comes to human rights is _bad_. What percentage of the US population consisted of interned japanese americans during WWII?

If I could be assured that a _WELL_RESEARCHED_, _THOROUGHLY_INVESTIGATED_ list of PROBABLE terrorists existed, I would not be upset. However, when shrouded in secrecy with only vague claims of threat VERY much akin to those used to justify the Japanese Internment we should all be mortified.

My only indication of the quality of this list is that there are 78,000 people on it, and I only know of a single reasonably defined terrorist on trial in US courts. If these are legitimate "suspects" I would expect a lot more convictions; otherwise I can only assume that the "suspicion" is only a 1-in-78,000 chance of being correct.

braddock gaskill

Re:78 THOUSAND suspected terrorists?

[Richthofen80]

Yeah, except the Japanese were INTERENED, having committed no crimes. Potential Terrorists are being MONITORED, which is quite different. Governments are allowed to investigate individuals even if they have not committed a crime. Without investigation, we could not determine if they had or had not committed a crime.

I'm not mortified if investigation is taking place. I'm relieved. If those investigated are innocent, charges aren't brought against. No harm done.

as opposed to worrying about hurting the feelings of some people by investigation, which hampers efforts.

Re:78 THOUSAND suspected terrorists?

[ZoneGray]

>> 730 billion per year. Slight exaggeration? I thought so.

More likely an understatement. Again, we're talking about the combined *budgets* of all the biotech and pharmaceutical companies. not their profits, which may be 10% or so of revenues, but the budgets themselves. Payroll, equipment, etc. I'll admit I haven't given much thought to the exact numbers.... but any way you slice it, it far exceeds what is spent on defense.

Just a hot button issue for me, when somebody says that America doesn't spend enough on x, y, or z. Usually it's propaganda from the beaureaucracy.

By such reasoning, one could argue that America hardly spends any money on cars.

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

actually that is PRECISELY HOW the name matching is done. vowels are not useful in spelling derivations. So though you intended it to be funny that is exactly how it's done. Go ask a linguist. so being I'm an AC, my entry would be "nnmscwrd."

Re:78 THOUSAND suspected terrorists?

[Anonymous Coward]

"They just do a grep for names without vowels"

Oh bugger, I'm in trouble now...

Rhys

other mistakes

[myom]

if they had read slashdot, they would have done all of these mistakes: - They didn't find out if they can run Linux, not BSD, since it is dying. Or maybe they ran Linux, but the SCO license fees were too steep? Or maybe they didnt add the debian sources and do an apt-get to get updated packages to get good protection against worms and viruses? Imagine a beowulf cluster of these non-patched government servers! ...which is kind of an utopia since the monopolistic evil Microsoft would stop that from happening anyway. Perhaps their plan is simply to: 1. Run unpatched Windows servers for the visa approval system 2. Capture the visa thirsting masses 3. ????? 4. Profit! Ah well, in soviet russia people get their visas on the black market - eliminating the problem with broken computer systems... and who needs computers anyway when a TiVO is much better?? Not that we care, we live outside USA, you insensitive clods! This post is a dupe anyway... Karma: Funny status; Witty reason

How about: When are YOU gonna learn?

[Phax]

You don't put users and the servers inside the same firewall... do you?

Re:How about: When are YOU gonna learn?

[shepd]

Better yet, do what I did.

Keep "trusted" internal machines on one leaf, and have untrusted, unknown, machines on another. Don't let traffic pass, and the only machines that get infected are users laptops/personal machines!

Problem solved if you keep up with patches on the servers (and you damn well should).

Re:How about: When are YOU gonna learn?

[swb]

How practical is firewalling the RPC ports from users and servers, if RPC traffic is essentially required for a lot of functionality?

Re:How about: When are YOU gonna learn?

[Phax]

Absolutely, shepd! Good idea.

The good news is...

[Anonymous Coward]

Well, I guess the good news is that we can be reasonably confident that at least they aren't running OpenSSH...

microsoft

[dcordeiro]

Not trying to bash Microsoft but....

I assumed that ppl who run critical services were not from that class of "Internet guys who just want to check their email and browse the web, and don't even know what a patch is".

So, my question is: Why in hell does anybody uses a system that has a track record of so many bugs, virus, crashes, etc ?

I see this more and more: A "breakthrough" is made by some stupid CEO in a companny and in a matter of weeks everything is run under windows. Why ? because it integrates better... "we now have single sign on... for virus too: they just get in one computer and can spread around easily"!!!!

Damn stupid morons...

Re:microsoft

[stratjakt]

They dont.

Most government facilities I've been to use Windows on desktops, and big iron unix servers in the back rooms. Big mainframes that have been there since the early 80s.

There's no way this system with close to 30 million names runs on SQL Server, MySQL, PostgreSQL or any other mid-classed database system.

They shut off the network to make sure it was clean, because one infected terminal could potentially leak a whole lot of information to the wrong people.

Re:microsoft

[OverlordQ]

So, my question is: Why in hell does anybody uses a system that has a track record of so many bugs, virus, crashes, etc ?

well let's see, I assume you're referring to Linux? For bugs, OpenSSH has had what? 3 releases in a week to fix bugs? How bout that linux kernel that fscked your partitions on umounting, I'm sure the list goes on, but my point is, there ISN'T a system which doesn't have a track record of bugs.

Re:microsoft

[dcordeiro]

well, I didn't mention any OS because I didn't want to see the linux/win war.

And BTW, I was not thinking specifically on Linux.

What I think is that if you separate (or better NOT INTEGRATE) the desktop OS/Software (that makes everything for you including opening emails, etc) with the server OS you have a better chance of not getting compromised from those desktops.

My sister works there.

[Anonymous Coward]

Evidently, the virus was patched/cleaned pretty quickly, and there was no real security risk, as in national security, because when the system is down, they simply do not issue visas. Most places they probably just told people to come back tomorrow.

Re:My sister works there.

[BanjoBob]

That may be fine but in some parts of this planet, people must travel to another country to get their visa to the USA. My wife is an immigrant and had to do this. Come back tomorrow is easier said than done. She had to go to Poland and stay at a hotel. Stay another night at the hotel? What about her airline tickets to return home? There is a lot of expense if the attitude is simply "Come back tomorrow" and what if the problem still exists tomorrow?

Doesn't the state department realize some people, other than themselves, have lives and expenses too? Why not take a system that important and apply both patches and anti-virus programs to it. Wouldn't that be a better solution for everybody?

Re:My sister works there.

[0123456]

"Doesn't the state department realize some people, other than themselves, have lives and expenses too?"

They're government bureaucrats. Worse, they're government bureaucrats who spend most of their time dealing with foreigners, not even Americans. Why should they care? It's not as though any of them will lose their job over this, they'll probably be given _more_ money to hire computer security staff.

Government bureaucrats don't give a damn about anything because if they do a bad job they won't get sacked and they will get more money to "fix" their problems. If you don't realise that, you won't understand much about how the modern world works.

Re:My sister works there.

[bogado]

i simply don't get this atitude. "not even americans", is by any chance american any better than any other nationality? I am sorry, but I consider this offensive.

Re:My sister works there.

[DGtlRift]

Airline ticket? Where is she flying from that she simply could not take a train? That would have been much cheaper... unless you meant she bought the to the states before having her visa ready. Then I would say that's very silly since trans-atlantic airline tickets are expensive and you don't want to waste your money if you can't even get through passport control.
-DG

Re:My sister works there.

[0123456]

In case you haven't noticed, most non-Americans can't vote in America (unless, for example, they're Mexicans with their new California Driving Licence). So why should American bureaucrats care in the slightest about what non-Americans think?

US government bureaucrats are capricious enough with Americans, as it is... so it's no surprise that they would treat non-Americans with disdain. I'm sure the bureaucrats in your country regard foreigners in exactly the same way.

Re:My sister works there.

[Anonymous Coward]

You might not be aware of this, but current visa regulations require any applicant who currently works in the US to travel to his home country to have his visa extended. This means you have to shell out the money for airline tickets, spend vacation time on this activity and are exposed to the risk that things might not go as quickly as planned (unpredictable delays are the norm, not the exception) - and you have to do this every 2 years. If the delays are much larger than anticipated, this means you either have shell out the ~2000 dollars for an airline ticket with variable return date, or you'll have to forfeit your return flight and buy new (one-way) tickets on short notice (>>2000US$). There's also the minor inconvenience of calling up your employer and telling them that you'll have to take unpaid extra leave, because now you're forced to stay longer than your 2 weeks vacation.

Hah.. Another Windows Virus

[UV_Haze]

Hopefully this means people will start thinking twice about their M$ monoculture. Or any monoculture for that matter.

You gotta wonder about how long it is before a windows virus kills someone though. There have been a few close calls, but maybe after the public starts loosing their lives cause of M$ bugs people will start to go "uh.. maybe we should install some *nix machines"

I swear the world would be a much better place if M$ had it's market share on the desk top knocked down to 70% or less. Then maybe the market forces would take over and force them to improve their wares in ways that benefit their customers and not just themselves.

Trusted Computing

[webzombie]

First high level government agencies and departments suffer "apparent" virus attacks while running MS Windows...

Eventually MS will start pushing their Trusted Computing bullshit as the ultimate solution for blocking attacks on their own flawed products.

Oh and it will keep those nasty terrorist guys out too! Did we (MS) mention terrorists. Oh we did ok...

Heads should roll...

[ubiquitin]

So who's responsible for IT security there? If they've outsourced IT security to Microsoft or Symantec, then it is well past time to fire them and put some linux or unix-based (low-cost high-availability) servers up. Ask any Linux sysadmin how they survived the last two months worth of email virus bombardments. Then ask a Microscrap Exchange administrator. Do some simple math on the time and therefore money involved with maintenance of these systems. Why is no-one outraged about the tax dollars being wasted on cleanup of Microsoft-platform based email viruses?

Re:Heads should roll...

[Chibi Merrow]

Now I'm a big Linux supporter and all... but you're way off base here comparing Exchange to a Linux MTA... they're very different beasts.

Just to let you know, we use Exchange, and I think all we did about the virus e-mails was scratch our head and shrug. Never had a single e-mail borne infection...

Though that didn't stop a certain unnamed director from making us send a memo out explaining why people were getting weird e-mails and why the return address was wrong etc...

In THIS case, the article mentions Welchia... Which is NOT an e-mail virus, it's the RPC DCOM worm that tries to patch the Blaster hole. Is it still able to infect due to bad software? Absolutely! But it has NOTHING to do with e-mail or Exchange.

How would a bunch of Linux servers have helped them in this instance? If they're lax on patching Windows boxes, they'll be lax on patching Linux boxes too. Then they're just one OpenSSH exploit away from being out of commission anyway.

The only reason I can think of you being modded up is blind hatred for Microsoft. Hating MS is fine, but don't mark a post as 'Informative' that doesn't even know what they're talking about...

Re:Heads should roll...

[cabazorro]

Welchia has nothing to do with Exchange or Outlook Express or MS Outlook. You are right about that. Welchia has to do with Microsoft out-of-the-box security holes. During the 80's Microsoft tormented the IT world with the shoddy 386 high memory mapping making companies like Norton flourish with solutions for memory fragmentation etc. Now Microsoft is tormenting the IT world with shoddy Servers(IIS) with security holes galore. Now anti-virus product flourish with all kind of products (virus detection/firewalls) that eat up your memory and cpu cycles but protect the week-meek-and-ever-so-vulnerable Windows OS. And round and round and round we go, when we will wise-up? No one Knows!

Re:Does the state dept. read /. ??? MAYBE

[Trigun]

Not allowing remote logins to a national database used to approve visas all over the U.S. which is located in one spot? Do you see the problem?
Ultimate control hinders flexibility. If you want to fill out your application for a visa, send it by mail which will be handled by hundreds of people, to receive your visa which will be mailed to you, again handled by hundreds of people, rather than create a network which will allow someone to remotely access the information that they need in an environment more trusted than the U.S. mail system?
This is not your mom-n-pop accounting database, this is used all over the world. Eliminating remote access is not really an option.

Easy...

[scsirob]

.. As long as any half-*ss kid can write 'applications' for the OS by point-and-click on Visual Basic, Windows will be the OS of choise. Too many companies are making money of cutting and pasting together apps.

It isn't the OS that counts, it's the applications that run on it. If it gets the job done, nobody will give a rats ass what OS is beneath.

Re:Easy...

[Prior Restraint]

If it gets the job done, nobody will give a rats ass what OS is beneath.

Isn't the whole point of the article that it isn't getting the job done?

Least of the problems...

[tehanu]

Personally I'm not so much worried about them being knocked offline for a few hours as I am about what this incident says about security at the place. If security is bad enough for this to occur, it is probably bad enough for an intruder to *alter* some of the files.

And people wonder....

[brain1]

...why governments like Germany, etc, etc, are switching to either Linux or Unix. Windows is just one big gaping security hole. Windows is insecure. It has evolved from a single-user simple desktop on top of DOS to what we have today without much thought to security except for an easily circumvented login.

Unix (whatever your favorite flavor - Linux, Solaris, HPUX, even OSX etc, was designed from the ground up to work in a networked environment. That at least gives you a fighting chance of maintaining some level of security provided you or your MIS department set the system up right (like... dont use a default root password).

If Microsoft wants to save their market share, they should start looking into a Unix-type OS. Either port BSD (they have anyway in their TCPIP stacks) or buy someone out (um, SCO maybe - or maybe I'm psychic?).

Stop trying to push a derivitive of WinNT which came from MS OS/2 launched back in the late 80's.

Sorry to rant on so much and restate the obvious, but geez. How many times before people wise up. Every time some script kiddie throws together some crap and unleashes it, corporations and governments get clobbered.

Jail time for virus authors isnt going to solve the problem, it's time to attack it at the source: Windows.

Re:And people wonder....

[MadEyeMoody]

If Microsoft wants to save their market share, they should start looking into a Unix-type OS...buy someone out (um, SCO maybe - or maybe I'm psychic?).

Hey, great idea! I guess the time might be right to introduce Zenix XP!

Welchia...an aggressive system patcher

[YetAnotherName]

I don't run Windows, but reading Symantec's description of the Welchia virus sounds like it's at least trying to be helpful:

• Attempts to download the DCOM RPC patch from Microsoft's Windows Update Web site, install it, and then reboot the computer.
• Checks for active machines to infect by sending an ICMP echo request, or PING, which will result in increased ICMP traffic.
• Attempts to remove W32.Blaster.Worm.

I guess all that aggressive system patching is what brought down the visa system. At least now the department's sysadmins can go back to reading /. or something.

Re:Welchia...an aggressive system patcher

[Anonymous Coward]

Checks for active machines to infect by sending an ICMP echo request, or PING, which will result in increased ICMP traffic.


Thisisi the step that causes problems- it was/is too agressive in searching out other machines. It causes too much traffic.

So, remember, the next you make an anti-worm worm, make sure it doesn't try to spread too fast.

Re:Welchia...an aggressive system patcher

[Creepy Crawler]

We've had a bit of people affected by Nachi/welchia. The patching is not a problem at all.. but it's what nachi brings.

1: Usual reboot to brig in patch.

2: Locks itself in /winnt/system32/wins as svchost.exe and dllhost.exe . These processes are unkillable and undeletable without nasty anti-nachi patches

3: When 1 computer is infected on network, it floods the network adaptor at full output to pingscan the entire network, then internet.

4: When you have 3 or more on a network, the gateway becomes flooded and traffic slows to a crawl. If more than half are infected on a segment, no traffic gets through.

Much nastier than blaster, in my opinion.

Re:Welchia...an aggressive system patcher

[ikkonoishi]

Heh.

I have wanted to make one that did that for a long time.

Glad someone finally did it.

A worm which patches its own exploit.

Re:Welchia...an aggressive system patcher

[Drathos]

That's what they say, but when half the machines in my office were affected by the Welchia virus, all it did was spread itself. It did nothing to patch the machines. I had to do that myself after removing the virus. (*grumble* stupid execs *grumble)

monocultures suck

[evenprime]

I know that a lot of /. readers are going to use this to say that they should have used linux. Some of the more security-astute will say that they should have used openbsd. The truth, however, is that picking operating system X or Y would not guarantee that something similar could not happen again. The way to avoid this in the future is to change the purchasing decision process for government contracts so they don't promote monocultures. In situations where you use a single type of platform, you are vulnerable to having a single type of bug shut down your enterprise. That's basically true of any OS.

It would be a lot harder for stuff like this to happen if they would:

• develop cross-platform applications
• use a variety of platforms

That doesn't replace having an adequate system in place for testing and installing the latest patches. It does, however, guarantee that slipping up and missing one patch won't stop you cold. It may slow your enterprise down, but stuff will still get done.

Re:monocultures suck

[stratjakt]

The server itself is irrelevant, probably some big iron machine running custom code.

If any client with access to it was compromised, then that client could be used to access all of the data. So they shut the network off to audit it for viruses and trojans.

With all the press they've gotten, it makes absolute sense. /. and some left leaning papers spin this into some sort of "windows is helping terrorists!" article. The only mention of windows is in the form of a memo from a completely different facility.

If they all ran linux or OpenBSD, they'd have done the same thing to ensure the latest round of ssh and other "security products" have been patched.

The news here? "This just in, network admins at state department do their job!"

78,000 suspected terrorists ?

[Anonymous Coward]

What? They cracked the slashdot users file?

Re:78,000 suspected terrorists ?

[WindBourne]

That would be more much closer to 780000

78 THOUSAND out of 6.3 BILLION

[MyNameIsFred]

is only 0.001 percent of the world population. If you consider that "suspected terrorist" includes groups besides al Qaeda, such as some of the separatist movements in various parts of the world, 78,000 is not very many people. To put it another way, there are 191 nations in the UN, so this gives 408 people per country on average. I could believe there are 408 people who could be "suspected terrorists" in the US without putting on my tinfoil hat -- just think of groups like ELF, various right-wing militias, etc.

Want to sue over buggy code?

[phillymjs]

Some day soon there will be a class action lawsuit against M$ regarless of their 'Hold Harmless Agreement' in the EULA.

Actually, Business Week had an article about that a couple days ago, which I submitted last night (it was rejected). The author closed with (paraphrasing) "Maybe it's time some big customers refused to buy software without some sort of guarantee."

These last few worms and e-mail viruses seem to have become the collective last straw. The unwashed masses are finally beginning to grouse about buggy software-- the tide is slowly beginning to turn against onerous "no liability" EULAs coupled to expensive software that is critical to business.

A few years ago, Microsoft was very quick to whine that any delay in the release of Windows 98 forced on them by the government would hurt the U.S. economy and/or bring about the end of the world as we know it. Well, what about all these businesses who have to eat the costs of cleanup and lost productivity every time there's another Windows worm? Nooooo, that doesn't hurt the economy at all, does it?

~Philly

And it's not just the crappy software

[delcielo]

The software is bad enough; but the patch process is ridiculous.

If you could patch non-kernel portions of the OS without rebooting, it would be a lot easier on the average Windows admin who has to argue for downtime with the internal customers.

And while you're at it, let's not install every application in the OS every time.

If you're gonna use Windows...

[Anonymous Coward]

Ok, in places where you HAVE to use Windows... PATCH. PATCH OFTEN. PATCH. PATCH. PATCH. Most of the viruses attack known vulnerabilities. If you get torked by a worm or virus because you didn't patch, you deserved it. Their IT team should be slapped.

no real information in article

[I8TheWorm]

Before anyone mods me as a troll, let me say I prefer Linux to Windows these days. That being said, only one time in the article is Windows mentioned.

It was unclear which computer virus might have affected the system. But a separate message sent to embassies and consular offices late Tuesday warned that the ``Welchia'' virus had been detected in one facility. Welchia is an aggressive infection unleashed last month that exploits a software flaw in recent versions of Microsoft Corp.'s Windows software.

That says they're not sure what virus, and the mention of the other memo really doesn't tie these two together.

So really, nowhere in the article does it say that this was a Windows virus, not even what virus it was.

One could easily assume, of course, that it was a Windows virus on a Windows network, but the text just isn't there.

BubbleBoy

[burgburgburg]

If you have laptop users on your network, which nearly everyone does, its analagous to wearing a plastic bubble suit but having unprotected sex with strangers every weekday morning.

That explains why he's always smiling.

On a serious note, how about either not allowing in laptops or mandatory auto-update on them before allowing them onto the network? Or perhaps keep them on their own node with anti-virus scanners between it and the main network?

Re:BubbleBoy

[jaredcat]

not allowing laptops isnt an option. some users need mobile connectivity as part of their work.

As for putting these users in a DMZ or requiring updates every morning... That would require all users to come in 25 minutes early and also a much larger IT staff just to do the updates. That would be too expensive really.

As for anti-virus scanners... We use TechData and Norton Corporate, but you know some of those worms and viruses just seem to find their way around them. For instance, I've got Norton doing an update once daily on my home machine, and I still got the Blaster virus thanks to my not patching soon enough.

Re:BubbleBoy

[corbettw]

"Or perhaps keep them on their own node with anti-virus scanners between it and the main network?"

Now *that* is a genius idea. It may be common in some areas, but in all honesty, it's never occurred to me. I'll have to institute this on the networks I'm responsible for.

Re:BubbleBoy

[Minna Kirai]

not allowing laptops isnt an option. some users need mobile connectivity as part of their work.

That's why firewalls are an overrated security device.

Any decently-large organization should assume that evil systems will make it onto the local network. Maybe a laptop is trojaned while it's at home. Maybe the janitor is bribed to leave a PDA in an unused jack behind a shelf. Or most likely, a regular employee wants to escalate her priviledges to make mischief (most "hacks" are insider jobs)

However the attack comes, you should be ready for it, by not giving locally-created network packets any special level of trust.

I've got Norton doing an update once daily on my home machine, and I still got the Blaster virus thanks to my not patching soon enough.

That's why virus-scanners are overrated as a security mechanism.

It's like protecting banks by checking a list of known criminals before letting someone in. Everyone gets to rob a bank at least once! Any determined attacker (as opposed to a random prankster) can have a custom, unrecognizable virus made before assaulting you.

Better than virus-scanning would be to change the unsafe behavior that exposes you to running untrusted code. Of course, that wouldn't help against Blaster much, because it's not a virus!.

Worms are different, and virus-scanners are even less well-suited to handle them.

Re:When are SysAdmins gonna learn

[Anonymous Coward]

Er... firewalls are not just perimeter devices.

I am responsible for 4 SQL server clusters, the yare firewalled off from my users, who in turn are firewalled off from the outside world. Critical departments are segregated from the rest of the company.

I know what I'm doing in my job - that's what I get paid for. I know Windows Servers and SQL inside out. I also have a good knowledge of networking theory in general. That knowledge isn't MS supplied, it comes with experience and obeying basic ground rules, and it's usually drivem by common sense and by not taking risks.

The government clearly employs people who either take too many risks or don't know what they're doing. It is possible to weather a Welchia/MSblast storm and not have it affect your network, thus it isn't MS's fault. Holes in MS software are part of the problem, but the real problem are crap system administrators and the people who write exploits in the first place.

And if you think that by not running an MS OS, you are somehow secure, you're living in cloud cuckoo land. You are less likely to be on the ball...

Every time I read

[zzztkf]

Every time I read analyst reports insisting that Windows is cheaper than Linux, I wonder whether they take possible economic damage caused by security risk into account.

Apparently they didn't. Does this incident change their view?

So does this include...

[Esion Modnar]

H1-B visas? If it does, then, well allright! Here's hoping it stays down a longggg time.

Erm...

[nyquility]

have any of you actually bothered reading Symandicks Virus Advisory on this?

Welchias (if it actually was Welchia) one and only purpose in life is to propagate from machine to machine, killing MSBlast and updating the RPC service to the newest "vulnerability-safe" version.

This is basically windozeupdate taken to the extreme, including the function that has the virus deleting itself if the date is 2004.

I cant shake the feeling that the author of this beauty is sitting somewhere in his starspangled-banner-wallpapered room screaming righteous indignation for getting slandered while actually saving the US from the big, bad foreign terrorist threat.

US State Dept has no CLASS?

[paul_pick1]

There's probably a joke here. Anyone know where?

Re:US State Dept has no CLASS?

[sharkey]

There's probably a joke here. Anyone know where?

The Oval Office?

The ONLY way

[IANAAC]

There's only one way for the mentioned virus to propopate off from big iron or Unix servers to other desktops or Windows servers: CIFS. So unless people were mounting Windows shares from the server it would have to be some sort of Windows box, probably running MS SQL Server.

Re:The ONLY way

[stratjakt]

You didnt read what I said, or perhaps I wasn't clear enough.

There's no mention of the virus being on the CLASS system itself.

If you have your corporate payroll running on some uber unix megasystem, I don't have to get a virus on it, just one of the Win2000 laptops that your beancounters use.

Re:The ONLY way

[IANAAC]

There's no mention of the virus being on the CLASS system itself.

Then why shut the system down? Perhaps I wasn't clear: There's absolutely no reason to connect to your 'corporate payroll running on some uber unix megasystem' via anything other than one designated TCP port (in other words, there should be no way to directly access the underlying OS for the user).

Incomptent.

[mindstrm]

That's their fault, regardless of MS or anyone else. IF they can't be bothered to keep their stuff up to date this late in the game, what good are they?

Hell, at least welchia will patch their systems for them...

Open Source Theory

[Carrion Creeper]

Immediate term bashing aside

The reason open source is supposed to be better is that when lots more people (like 15% market share worth) run linux, then there will be more resources being used to update and error check open source software - theoretically. Comparing Linux with a small market share to windows with a large market share in terms of bugs is not appropriate, and considering the paid resources available (but maybe not used?) to Microsoft, it is amazing that open source even compares.

Not to knock Volunteers at all, but if every company who used open source in a major way paid for 1-2 full time programmers, which is a relatively small expense, maybe Linux would have an even better security track record. Microsoft can't get much bigger, and their software maintenance model has still proven itself unworthy.

So does *NIX

[rf0]

With 3 OpenSSH patches + sendmail in that last week I'm sure UNIX peeps have been busy. Of course updates seems fewer than windows but it still keeps us all in work

Rus

Re:So does *NIX

[Anonymous Coward]

Don't forget proftpd and arp in freebsd (and probably the other bsds)

First Windows at Nuclear Facilities and now this?!

[coolmacdude]

Good grief. We need a 12 step program for sysadmins in critical locations to break their Windows addiction.

Al Qaeda, traitors, and virus

[WindBourne]

I find it interesting that W. and staff is pushing known insecure systems throughout the government. At the same time, they state that by putting in a firewall, a known insecucure system is as safe as *nix. But of course, in our government we have always had traitors, some who believe in a cause (such as the 2 airmen), and others who will simply take money to look the other way( or to change a final judgement) or to possibly just conenct a laptop into the network. There is no way to secure a computer network, even when not plugged into the internet. Our society is all too willing to accept an insecure system to be plugged into the network. Witness the nuke plant that was infected. It is almost certain that at this point, that a number of virus have been created by UBL that target US (and propably the world) systems to feed info back to them and quite probably to feed money back into their accounts. What Allah does not provide, then willing theives will.
W. et. push security and are having us give up liberties (supposedly temporary), but they are not willing to change their systems due to their pocketbooks.
Bad policies.

Deaths from terrorism much higher...

[MyNameIsFred]

...claimed maybe 5000 lives in the past 30 years....

I would argue that the deaths in the last 30 years far exceed 5000, although the exact numbers depend on how you define terrorism. If you include the various separatist movements such as in Ireland, the Phillipines, and other countries you would easily exceed 5,000. Or look at some of the cross-border disputes, such as Pakistan-India, many of the deaths are due to so-called terrorist activities. Thousands have died there in the last few years.

I will admit that defining terrorism is a squishy subject, that politicians modify to their advantage, but saying only 5,000 have died in the last 30 years wildly underestimates the death toll.

Re:Deaths from terrorism much higher...

[perreira]

Especially if you take into account, that we only care about terrorism in the civilized world... the same week the terrorist attac on WTC caused the death of about 3000 people, nearly the same amount of people were killed in central africa by terrorist attacs. (Sorry, no links, but maybe do some googling...)

BUT: you can get quite easy in these terrorist databases. Shortly after 09/11 there were some "investigations" going on during which some students in our university were interrogated. They were on the list, because they paid television fees and were sucpiciously unsuspicious muslims...

Gettin' Slow!

[doppleganger871]

Sheesh, I heard about this on The Truckin' Bozo show last nite. When a truck driving show beats Slashdot to the news, it's the dawn of a new age.

Looks to me like...

[Xamdam_us]

Here is a description from Symantec of what the W32.Welchia.Worm does:

W32.Welchia.Worm does the following:

1. Attempts to download the DCOM RPC patch from Microsoft's Windows Update Web site, install it, and then reboot the computer.

2. Checks for active machines to infect by sending an ICMP echo request, or PING, which will result in increased ICMP traffic.

3. Attempts to remove W32.Blaster.Worm.

Looks to me like Microsoft wrote a virus to fix Windows.

So what?

[bgarcia]

That's ok. I'll just get an American Express card instead.

Child Molesting Means Work

[ArmorFiend]

As much the Slashdot community hates child molesters and likes to dump on their flaws, I've realized one thing: child molesters means jobs in the law enforcement and social work sector. As a police detective, my job is, among other things, to make sure the latest threat to our children doesn't bring down a life in the city where I work. At least twice a week, my office has a meeting where we discuss the latest incident, organize a task force, and then do a rescue. I like to think that as long as child molesters keep on, er, molesting, I don't have to worry about losing my job. If there was some magical "perfect" society that never needed policing (note: there isn't) then we wouldn't need law enforcement now, would we?

Re:Child Molesting Means Work

[WhiteWolf666]

Umm......This is actually the case.

Except. Replace child molesters with drug dealers.

Half of the justifications of the drug war now have to do with the immense industry set up to persue it

Sadly, not funny

[Badgerman]

Though the story is worth a laugh in a way (wether its true that the system got infected or was shut down to prevent infections), it really isn't funny.

It just indicates some important systems are run badly enough that they can be taken down by some avoidable exploits (or fear of said exploits). When these are government systems . . .

I used to think the idea of an electronic Pearl Harbor was unlikely. However, considering recent events, I must admit I'm revising my opinion. If we have one it will not be so much some clever virus writers/crackers, it will be because of people's own ignorance of safe and rational computing practices.

Awww, don't be so boring...

[ThyTurkeyIsDone]

Wouldn't the summary of these kinds of stories a lot more interesting if we had to take a guess?

Welchia is an aggressive infection unleashed last month that exploits a software flaw in recent versions of _________ _______.

Ummm, maybe give us the first letter?

Obligatory VISA reference...

[redtail1]

VIRUS: It is everywhere you don't want it to be.

Uh no...

[Anonymous Coward]

From official US gov't literature:

Posts may process a V visa for any applicant with a V CLASS hit
...
Names of derivatives who aged out have not been entered into CLASS as they are no longer eligible for V visas.

It wasn't a computer virus!

[FunWithHeadlines]

I'm getting sick of mainstream media equating Windows viruses with computer viruses. This was NOT a computer virus. Were any Linux machines at risk? No. Were any Macs at risk? No. How about mainframes? Nope. Those are all computers, and yet none of them were at risk from this virus. So it is inaccurate to call these things "computer" viruses.

Call it what it is: A Microsoft Windows virus. Maybe if the media keeps pointing out what us /.ers already know, the general public will get it through their heads that their choice of OS makes a difference.

Re:It wasn't a computer virus!

[glwtta]

Dude, I am as much for MS bashing as the next person, but this is not an inaccuracy. Sure it is a Windows virus, but it is also a computer virus, since all computers that run Windows are still computers - see how it works?

Take Hepatitis C for example, it's called a "virus" (it's implied that it's a human virus), not the Hepatitis C "People-Who-Haven't-Been-Immunised-Against-Hepatit is-C" Virus.

Re:It wasn't a computer virus!

[sdibb]

True, but unfortunately, when Windows has 97% os market share, it's a computer virus.

Re:It wasn't a computer virus!

[FunWithHeadlines]

" Dude, I am as much for MS bashing as the next person, but this is not an inaccuracy. Sure it is a Windows virus, but it is also a computer virus, since all computers that run Windows are still computers - see how it works?"

I do see what you are saying, but my point is that calling it a "computer virus" is too all-encompassing. Lemme see, what examples come to mind?

If SUVs have problems with safety because they have a greater tendency to roll over, would it be accurate to headline the story, "Automobiles Have Roll Over Safety Risk"? It would be too encompassing, to the point of being misleading.

When headline writers get lazy, they perpetuate misunderstandings. If Mom and Pop Mainstream see, "Computer virus" they think all computers get these things. If they see "Windows virus" they begin to see where the problems are actually occuring. Mom and Pop MacUser will then see the headline and realize they don't have to worry this time.

Re:It wasn't a computer virus!

[FunWithHeadlines]

" True, but unfortunately, when Windows has 97% os market share, it's a computer virus."

Windows has nothing close to 97% OS market share, the limited approach to statistics on that web site notwithstanding.

Firewall == false sense of security

[Malc]

A firewall isn't going to protect your network if you have people with laptops. It only takes one person to plug it in at home or on the road to bring down the house of cards. Nimda broke out on our corporate network in this manner thanks to at least one of the marketing guys.

Your other suggestions are spot on though: keep everything up to date.

Re:Does the state dept. read /. ??? MAYBE

[deuce868]

Does the system really need remote logins though? How many databases are there out there that use various other interfaces to get to it. Seriously, something like this is going to be on a db server, with a front end app server. The db server should be locked down to only allow access from whatever method the app server uses to communitcate with the db server...that is it. I can see the app end being in some sort of DMZ, but I can't see why they do not have some sort of system image avail. for it to recover from something like this.

True

[garrulous]

Professionals are users too. :)

security will come eventually

[Hrrrg]

I think that we have to remember that computing is still in its early childhood; Eventually software will become more secure. People often state that software is becoming less secure, but one has to remember that today's software is exposed to many more challenges and malicious influences than software 5 or 10 years ago. There are a finite amount of vulnerabilities in code. Once software is "mature" and no longer has new versions coming out every few years, those vulnerabilities will start to disappear. After the same piece of software has been in use for 20 or 50 years, then I suspect it will be quite secure. I do recognize that there will always be a human factor providing insecurity. The human factor, however, will not be the fault of the software.

Re:security will come eventually

[miscGeek]

Nice theory but, you miss a major point. If a software program were to stay in it's current form, i.e. no new features only bug fixes then your theory would hold true. This is almost never the case though. Software is continously evolving. Security holes and bugs are being fixed but when new features are added you have a good chance of introducing new ones, and the cycle continues.

Windows Means Counterproductivity

[Anonymous Coward]

MY GOD! Have we all become lemmings? I mean, we could all fill buckets of water from the Pacific Ocean and then transport and dump it into the Atlantic because "we can't find a job", but it isn't productive now is it? Wake up! With the amount of time wasted on this, we could use our resources to better society, not fix the problems laid upon us by some greedy corporation. If we didn't have Microsoft problems, then you could use your IT skills to help a school educate children to use computers responsibly. That would be productive.

No, Microsoft (and any other corporation) who haphazardly builds an unsafe product and continues to build unsafe products even after being notified, criticized, and slapped on the wrists by the government solely for money at the cost of our labor pool and IT funding should be boycotted until they get their prioritites staright => custormers and their concerns come first, then profit.

"Virus Knocks Out U.S. Visa Approval System", but

[Snork Asaurus]

the illegals will still got in using American Express.

Special offer for prayer service

[Anonymous Coward]

I'm setting up an offshore prayer service, just call in with your credit card and I'll have my professional anti viri prayer staff to ensure that your machines keep running virus free 24/7*

*This statement has not been validated by the FDA or any other scientific body...

"will still got"

[Snork Asaurus]

10 Must preview after edit.
20 GOTO 10

Darn

[Hard_Code]

Was I the only one let down that this wouldn't mean I would stop getting those annoying YOU ARE PRE-APPROVED FOR A VISA CARD! offers?

What if it's not windows

[MhzJnky]

None of the article's say for sure that it was a windows viris... It could be anything.

All they do is do some speculation based on another unrelated anouncement.

Geez, if they used that same poor sepculation to link it to Linux every one would be in an up-roar about that.

Geek != MS Hater. Some of use like them and the work they do. I'm constantly amaized that all my software/hardware keeps working dispite upgrades from 95 -> 98 -> 2k -> XP.

If you want to talk about network security and best practices go ahead, but leave the MS bashing behind, you just end up sounding silly.

Press suggesting system attack methods?

[PoisonousPhat]

I'm all for transparency in government and the rights of the press to publish stories as they see fit, but am I the only one that is at least a LITTLE concerned that groups and/or individuals reading this and related articles will get the idea that they can compromise important governmental systems through electronic means?

I'm not absolving the State Department of responsibility for this error; they messed up somewhere, they need to fix it. I think, though, that they could at least do some "damage control" by keeping the problem undisclosed until the security hole is rendered benign. Unfortunately, I have no idea how the State Department could keep something this large under wraps, but I'd think using a little more discretion in internal communications is in order.

Then again, if someone doesn't drop the ball in a big ignorant entity, Slashdot readers wouldn't have an easy target to insult...

78,000 people or identities?

[Kjella]

I mean, you hear about such people with a almost a full deck of fake identities. It'd be like counting unique IPs used to access a site, and equate that with the number of individuals.

And after all, I expect the terrorist:suspect ratio to be rather low, it's not like there are usually any big telltale signs you're a terrorist. Most likely they're members of some organization where extremists might resort to terrorism, would easily add up to a few people...

Kjella

What no talent ass clown would...

[Anonymous Coward]

What system admin would put such a machine on
the internet? In addition why would they *NOT* make a backup?

Easy way for the U.S. to put more restrictions on the internet because one of many government employee incompetents can't perform their function properly. If the head of the fish stinks, so does the rest of the fish.

What's the person's name anyway? If I ever hire someone to run a windows machine directly to the net without protection and no knowledge of tierciary storage or patches I want to make sure I hire the right person. (ie- operates mouse) Who is thie person's boss? Will they get fired? I want the scroop!
In the overall picture, it's just almost as bad as allowing sketchy foreignere to operate massive 747 jets. How many 747 airports are in kerplakistan anyway?

Regards,
Friendly Neighborhood Spiderman

Rights vs Citizen rights

[nuggz]

In many ways these people's rights are now forfeit.

Bullshit. These people are foreign citizens;

Sorry human rights and the right to fair treatment below to EVERYBODY, regardless of citizenship.
We have accepted standards of treatment for people we are actively at war with. People who have no apparent hostile intent should get treated at least as well.

Re:Rights vs Citizen rights

[merlin_jim]

Sorry human rights and the right to fair treatment below to EVERYBODY, regardless of citizenship.
We have accepted standards of treatment for people we are actively at war with. People who have no apparent hostile intent should get treated at least as well.

While I agree with you that there needs to be an accepted standard of treatment for terrorist actions, similar to the Geneva Accord for wartime, the sad fact is that such a standard does not, at this time, exist.

And these people aren't being treated unfairly; we're not letting them come to the United States without explaining terrorist connections. The United States doesn't belong to the world, it belongs to us, and we can say who we do and do not want to let in.

While I do feel that there should be some oversight over who gets put on this list and how they are selected, that the list should be made publicly available, and that there should be an appeal process to be taken off the list if necessary, none of those is an inalienable right.

I don't have a right to come into your home at any time I like. I can knock on your door and ask if I can come into your home. But if we don't really know each other, and you've seen me in the neighborhood a couple times with some known violent criminals, you would certainly think twice about inviting me in.

I don't see how the United States implementing a similar policy is any different.

Re:Rights vs Citizen rights

[Anonymous Coward]

BTW: Which goventment is the only gornment proven guilty of terrorism in an international court of justice???

(Get you heads out of your asses)

Re:Rights vs Citizen rights

[Anonymous Coward]

and you've seen me in the neighborhood a couple times with some known violent criminals

Like Pinochet, Noriega, Khomeni, Hussein, Bin Laden et caetera? Those kinds of violent criminals?

Re:Windows Means (meaningless) Work

[47PHA60]

Murder means work too. Are you willing to die a few years early so detectives, attorneys, and judges can have jobs?

I would really much rather design and build secure network systems than apply bandages to existing hopeless systems. If a system is available that resists viruses (like BSD or Linux), that might be a good place to start...

Oh, wait, I do have that job! And I bet I am having more fun than you. One thing is certain, my employer is not flushing as much money down the toilet as yours.

One day my job will be obsolete, but it will be because of self-healing, learning software, not software that was written 'perfectly.' Until that happens, however, we might spend our time trying to do things properly, and learning from our mistakes.

Nobody would support houses of mud and straw in the Northeast US just to keep a bunch of mud-slathering straw harvesters in jobs every time it rained. My house of stone, concrete, and wood requires maintenance on my part, and it has provided plenty of skilled, high-paying work to the local tradespeople in my city, as well as opportunities for me to learn valuable skills. Because of its construction, it also provides a safe place to sleep and run electrical wiring. But oh, the unemployed mud mixers! But when you think about it, who really wants to mix mud and straw for a living?

As for your economic 'theory,' read this, In short, it says that as an employee of the government, if you are talking about the US, you are advocating the continuous waste of my tax money so that you can remain employed. Please put that on your resume when you are out of work and apply for a job working for me!

the effect of viruses

[GISGEOLOGYGEEK]

This just goes to show that terrorism can start at home ... in the hands of people who don't keep their software patched and upto date.

Of course there's plenty of other more extreme examples of terrorism starting at home in the US too. (timmy mcveigh for one) Hmmm, I wonder why Dubya hasn't bombed Oklahoma yet ... If he did he could then go beg for some tasty UN 'foreign investment' to get that economy jumping!

No, you *really* don't want this

[edremy]

MS has byyylliuons of dollars to fight these sorts of lawsuits. I can just see all the folks on /. cheering as MS spends sagans of dollars defending itself.

That is, until RedHat gets nailed with a worm or virus. It will happen: Linux is not bug free. (Folks with long memories will remember the RTM worm: infected only Unix machines and effectively shut the entire Internet down. We were a VMS shop, which was vastly more secure.)

RedHat has two choices.

• Refuse to offer any guarantee. Congrats, you just lost the entire business sector: PHBs will simply refuse to buy software without the stamp of approval.
• Get slammed with lawsuits. RedHat does not have sagans of dollars to defend itself, much less companies like Mandrake.

These sorts of lawsuits will have exactly the opposite of the desired effect: only behemoths like IBM and MS will be able to stay in the software business, not because their software is better but because only they have enough lawyers.

Microsoft doesn't patch...

[obdulio]

The W32.Swen.A@mm exploits a vulnerability in Microsoft Outlook and Outlook Express for which a patch was posted in M$ site in March 2001.

Windows XP (which was released more than a year after the patch) is among the affected systems. So they failed to apply their own patches.

This shows that the problem with M$ security is very serious, they fail at the corporate level to address the security issues.

Re:Microsoft doesn't patch...

[Trigun]

Although I am not well versed in the vulnerability of the office package, I know that the big reason to not patch was that it greatly reduced functionality in a non-exchange environment (forcing users to save attachments rather than invoking straight out of e-mail, inflexible with what it blocked and whatnot). I am unsure if this should have been fixed in Windows XP, but rather in office XP. I am not sure if the outlook shipped with Office XP is vulnerable or not, so I cannot verify or refute your claim. Would Windows XP with Outlook 2000 installed be vulnerable? I would expect so. Could they have fixed this in the underlying OS? Probably, but it would have hurt.

Although, OE is shipped with Windows XP, so that one is blatantly their fault.

Re:Microsoft doesn't patch...

[Anonymous Coward]

Actually RTM date for Windows XP was August 22nd 2001.

5 months admittedly, but certainly not more than a year.

And prior versions were basically release candidates, which are only meant to be changed where there is core instability (because making other changes would risk instability into the master build which will be distributed for hundreds of millions of machines for one relatively untested patch).

In related news...

[Anonymous Coward]

Meanwhile, numerous government linux boxes running unpatched OpenSSH servers have also been... What? Oh, I guess it's a hard exploit to pull off then.
Nevermind.

OK, there's three

[Jack Auf]

We covered the Windows Virus-of-the-Week(tm), EU software patents, and Verisign. But where are todays SCO, linux on odd/small device, spammers get theirs, and Knoppix stories?

(And what the hell is is with /. ed's and Knoppix? Do they friends on the Knoppix team or something?)

Wow.. 78.000..

[Anonymous Coward]

That's as much as all inhabitants of the Seychell Islands.

Dear Virus Makers....

[greymond]

Could you please keep up the good work by making a virus that erases everyones Visa, Mastercard, Discover, and American Express Debt. That would really be great. Thank you.

Sincerely,
Mr. College Debt

WHAAAAATTTT????!!!!!

[droptop]

OMG!!

Please don't tell me that some idoit has implemented a nation-wide network populated with national secrets on a Windoze platform??!!!

What is it going to take to get folks who are responsible for security, to actually educate themselves on the subject, or hire those who are.

I'm not an expert, but I have yet to hear of a Windoze installation that can fully protect you... Once your in, your IN.
Even if you are totally protected from outside crackers or virus', you may still have folks WITH log-in access that have a notion of doing wrong. You MUST have a system that can not only limit access, but cannot be brought down by some idoit simply uploading a virus from a floppy on the INSIDE.

Fire every single one of those bozo's (I don't mean the IT folks, I mean the decision makers who chose Windoze) and have somone install actual security!!

I can only imagine how our military, former military and law enforcement folks must feel now... Knowing that their records are "secured" by folks that allow this sort of thing to happen.

78,000 is far too low

[CmdrGravy]

There are more non Americans than this surely. Or perhaps this is target they are aiming before the end of GW's reign.

here we go again...

[zarniwhoop]

Seems like YAMSF - Yet Another Micro$oft Flame.

If all you /. ers are so clued up, when are you going to stop the griping and realise that MS Windows is not the problem per se?

I'm willing to bet my entire net worth (beleive me, its huge) that if Linux, GNU and other *Open Source Software* were to replace every single Windows system and vice-versa we'd start seeing exploits on this scale in the beloved and holy OSS world too - viruses, worm, trojans and the whole shebang.

The main problem is not insecure software (all software is insecure) - the greater problem lies in the human factor - clueless sysadmins, users etc etc.

Re:here we go again...

[Anonymous Coward]

if Linux, GNU and other *Open Source Software* were to replace every single Windows system and vice-versa we'd start seeing exploits on this scale in the beloved and holy OSS world too

You hit it on the head. Windoze is not the target of viruses/attacks because it is more vulnerable. It is targetted because it is bay far the #1 OS in use. Any OS (OSS or not) that is #1 will become the target simply because it is not front page news to announce that a virus knocked out an OS running on .02% of the world's computers.

Re:here we go again...

[Anonymous Coward]

hmm, that is a bit ignorant of unix technology. That is like saying all unixes are equally insecure. That assumption is wrong because of the architectural design. A major flaw in unix has less risk because of the overall architecture. That doesn't mean it is any less vulnerable, but there are well defined boundaries which prevent catastrophic or system wide exploits.

Ohhhh, you're just askin' fer it!

[Thud457]

"custormers and their concerns come first, then profit."

1. custormers and their concerns
2. Profit!

How apropos

[krysith]

The name of the article is rather appropriate for this discussion!

Thank you for the good link.

For those who don't follow the link, it is about the economics of breaking actual "real world" windows, not MS Windows.

welchia... set the date to 2004

[Anonymous Coward]

when the date reaches 2004, welchia deletes itself and goes away, it's a so-called "benevolent" worm.

Re:welchia... set the date to 2004

[sammaffei]

Still compromises the system even if it deletes itself. Integrity cannot be guaranteed.

Are you sure it's the same strain?

i guess you could say now

[krist0]

that america has no CLASS

Solution: Ban Windows from the Internet

[JThaddeus]

I've about reached this point with the Swen worm. Since this past Saturday, about 80% of my email--home and office--is either the fake MS support announcement or message errors that tell me that my address was faked in trying to send Swen (got to be faked--I only run KMail on Linux). As my home email is dial-up (the pains of rural life) this is a real burden. Honest to God, are people really THAT STUPID? Until Microsloth can get it act together, we need to start blocking IE, Outlook, and Windows in general. Maybe then people would wise up and either fix there PCs or run a reliable OS.

Demand some accountability from the vendors.

[miffo.swe]

Why dont the govt just demand better software? They are such a huge player that there would be a new market created just to sell secure software.

I dont buy this bullsh*t people keeps spreading that its impossible. It aint, just as you can build secure bridges and houses you can make software that is much more secure than todays crap.

There hasnt been a strong enough market for secure software and its up to the consumers and govts to start demand better software.

Even open source could use a kick in the but to get their act togheter.

Compare vsftpd to some other random ftpd and youll get my drift. Security is about design and not about being bugfree.

coincidence?

[jdvernon1976]

anyone here think to put together 2 basic assumptions?

1) hackers are people with serious technical skills and (stereo)typically not big on personal skills - those individuals most likely to have their job outsourced/off-shored

2) the frickin' VISA department got blasted, the people that hand out H-1B and L-1B visas to the people coming here to get training and take their jobs

(rest of post assumes this is not a coincidence)

Being vindictive isn't going to solve anything, it's just sticking a finger in the dike. Unless these issues are resolved at a legislative level, people will patch their systems, move to Linux, whatever, and then the old policies will continue to be carried out.

The Visa system needs a major overhaul

[Orion Blastar]

need I remind anyone that the 9/11 Terrorists all had Visa or Bogus Visa information. One of them even got stopped for a speeding ticket and had a bogus driver's license. Apparently they can forge or fake Visa information. So they don't need to go through our Visa system when they can steal a Visa or produce a fake one good enough to get through our system.

Either they need to patch their Windows servers and install a software firewall and keep their AntiVirus programs updated, or they need to get off of Windows and move to Linux or something that the Windows viruses won't run on.

How do we know that the virus didn't do something like pass certain Visa applications through without a security check? How do we know that Terrorists aren't using viruses to cause damage and bypass security in Visa checks? I heard that North Korea spends $3M USD a year to create viruses and trojans to attack various countries and systems. I wonder what other countries and organizations do this?

a major victory in the war on.....

[Anonymous Coward]

Finally a major blow to al-Qaeda terrorists...errr I mean college students from the middle east.

Great PBS Frontline Show - Cyberwar

[tucay]

Is this just part of a series of well planned terrorist cyber attacks?

Try this:

[Copy and paste a single line to console and remove slasdot inserted space after 2116 for each url. This should work with a recent mplayer installed.]

• mplayer mms://media3.online.pbs.org/media4/frontline/2116/ windows/1_hi.wmv
  
• mplayer mms://media3.online.pbs.org/media4/frontline/2116/ windows/2_hi.wmv
  
• mplayer mms://media3.online.pbs.org/media4/frontline/2116/ windows/3_hi.wmv
  
• mplayer mms://media3.online.pbs.org/media4/frontline/2116/ windows/4_hi.wmv
  
• mplayer mms://media3.online.pbs.org/media4/frontline/2116/ windows/5_hi.wmv
  
• mplayer mms://media3.online.pbs.org/media4/frontline/2116/ windows/6_hi.wmv

Not in their best interest

[Tony]

Unfortunately, newspapers are not in the business of reporting the news, but in selling eyeballs to corporations in the form of advertising. As long as Microsoft (and other business that feel they are reliant on Microsoft products for revenue) buys ads, and Linux (or other alternatives) does not, they are going to slant the news Microsoft's direction.

Plus (to borrow from another post in a child thread), they can sell a lot more newspapers (and thus eyeballs) by saying, "Automobiles subject to rollover!" than by saying, "Some models of Foo's SUVs subject to rollover at high speeds in tight turns."

That's part of the reason the US news agencies feed into the fear culture that's been building here for the last several years.

Re:Not in their best interest

[FunWithHeadlines]

Sadly, I think you are 100% correct.

In Related News ...

[quarkscat]

660 guest workers from Cuba were granted
USA permanent residency status & green cards.

New IT head at Dept. of Homeland Security
inks deal with Microsoft for HSA server OS,
desktop OS, and applications software.

John Poindexter's TIA Project certifies
Microsoft XP as the preferred national OS
of choice.

Steve Ballmer cinches $10 Billion sale of
Microsoft OS and Office Products to the
Kingdom of Saudi Arabia.

Newsies are missing the point

[KleinKlone]

Yet another Windows virus. The newsies are missing the point. It is not that the virus writers are so bad (they are...), but that Windows is so bad! You can destroy your computer by reading an email message. By opening a spreadsheet or word file. By inserting a disk. No decent operating system, no decent application program should allow such things to happen - and yet there is Microsoft, vulnerable to every attack. Boxes, bottles, and jars in the store all have safety caps - where is the safety in Windows? Microssoft keeps producing systems with new features, but with no appreciable new safety.

I'd rather see the headline read: "Windows is still broken"

If my car stopped dead in it's path or swerved off the road because someone flashed their lights at me, if the rental tape I just inserted in my VCR could cause it to turn on my microwave on "high", if my neighbor could turn off my furnace from their house, if talking to a certain someone on my cellphone could induce that same cellphone to automatically start making crank calls - well, we'd be suing manufacturers, seeing global recalls, and raising a hue and cry for better product safety.

But with Windows, we blame the virus writers.

Enough! Yes, they are at fault, but the real fault is back door - no, the back wall - has been left open for too long. Blame Microsoft.

My millions-of-hits-per-day Unix web server has been running for 317 days without a reboot. My Macintosh desktop has been running for 67 days without a reboot. Neither system has ever seen a virus, worm, or trojan. I want Microsoft to be as bulletproof, and I do not want to see terrorists getting into this country because some "Virus Knocks Out U.S. Visa Approval System".

Although it sounds like it, I don't hate Microsoft. I hate Microsoft's bugs and their lackadaisical attitude towards basic security. And the State Department shares the blame.

And in related news ...

[quarkscat]

660 guest workers from Cuba were granted
USA permanent residency status & green cards.

New IT head at Dept. of Homeland Security
inks deal with Microsoft for HSA server OS,
desktop OS, and applications software.

John Poindexter's TIA Project certifies
Microsoft XP as the preferred national OS
of choice.

Steve Ballmer cinches $10 Billion sale of
Microsoft OS and Office Products to the
Kingdom of Saudi Arabia.

Quoted "78,000 suspected terrorists" was
ammended to "78,002 suspected terrorists"

Re: a irewall is no defense

[MrBlint]

It is if you run one on every machine. Oh look there is one built in to XP.

OK, let me get this straight...

[wouterke]

... The US government is actually trying to stop terrorrists by trying to trace them using one of the most insecure operating systems ever? Are they for real?

Poor people

[jagilbertvt]

Terrorists need credit cards too!

Go Microsoft! Go!

[Anonymous Coward]

Keep those pesky Russians/Chinese/Israeli/Indian programmer away from MY job

Re: it all boils down to time and money

[ubiquitin]

I can't speak for whoever is moderating my comments, but I from where I'm sitting this is not a blind hatred for Microsoft. It is absolutely a blind hatred for anyone wasting my tax dollars who shrugs off accountability.

Between procmail, spamassassin, bogofilter, mime defang, and any number of freely available solutions to the spam and virus epidemics, the *nix MTA problem set has a number of very effective low cost solutions ready to go. A sysadmin familiar with any scripting language (perl,bash,csh,etc) can script the patches to fix an arbitrary number of remote servers in short order. And do it securely!

I've recently heard a number of Windows/Exchange admins from different companies complaining about having to go from desk to desk, from seat to seat, from box to box applying patches which can't be scripted.

The thing about all those openssh patches is that I can control the patching mechanism itself in ways that MCSE's could only dream about. I desperately want the U.S. government to have full advantage of this efficiency instead of purchasing Symantec virus subscriptions at top dollar and then billing me next tax season for the self-congratulated job well done.

Your point about competent administration is well taken. Hopefully my point about technology tax dollars accountability will be too.

Too expensive?

[burgburgburg]

How expensive is the constant recovering from viruses, trojans, worms, etc.?

With the DMZ, they wouldn't have to come in early. The end users would just be treated with the wariness that they deserve. It would be as if they were still in front of the firewall.

Re:When are SysAdmins gonna learn

[Anonymous Coward]

You're smoking crack

The simplest antivirus filter

[dimss]

The simplest antivirus filter: drop any message that contains 'MS-DOS executabe' according to file(1). Nobody sends executables except worms.

Now I am testing this filter implemented in postfix/procmail/perl/munpack/file. Next week it will be installed system-wide. Filter like this costs nothing and is effective enough to stop next epidemy.

Re: it all boils down to time and money

[Chibi Merrow]

It is absolutely a blind hatred for anyone wasting my tax dollars who shrugs off accountability.

Now you're talking my language! Yes, I agree that tax dollars could be better spent than propping up iffy Windows servers and desktops and wasting man hours fixing exploited boxes. But in many cases a Windows box is the ideal solution from a usability and ease of integration standpoint. Linux desktops just aren't there yet.

I've recently heard a number of Windows/Exchange admins from different companies complaining about having to go from desk to desk, from seat to seat, from box to box applying patches which can't be scripted.

Erm then maybe they should be looking for new work... Most every patch I've seen could be installed using some form of Windows Scripting (VBScript for instance) securely from the Domain Controller as either a login script or by pushing it out one way or another. There ARE ways to push out patches, many of them automatic, but you're correct in that they don't give you the same granularity as open source solutions. But then again, this wasn't a case of there not being enough control on the patching process, the boxes *weren't* patched, *period*. An unpatched Apache/OpenSSH/wu-ftp/sendmail install is just as dangerous as an unpatched IIS/DCOM/SQL Server/Exchange install. I agree tax dollars aren't being spent properly, but in this case it's more that the IT staff wasn't performing the duty we pay them to do, not that the money was mis-spent on the software purchase.

In this case, there was no massive downtime due to exploits, the system was brought down for a review to assure that the small amount of exploitation didn't compromise the system in some other more devious way. Had these been Linux boxes, and they'd been victim of an OpenSSH exploit, they'd of had to do the same forensic analysis and would've experienced the same downtime to assure they were clean. Look at the FSF's recent exploitation for an example of this.

In a situation where the Open Source offering is clearly a better solution, believe me the Government will make use of it. But there's not that many cases where it's true... I'm still confused as to how Exchange entered this discussion as the article has nothing whatsoever to do with Exchange... but Exchange is an excellent example of this problem. There is nothing on the market that even comes close to providing Exchange's functionality. And all of the methods you mentioned before of how to deal w/ viral e-mails will work just fine with Exchange (SpamAssassin especially). Where I work we use non-Free software to provide spam and virus filtering on the server side (we really don't have the manpower to support using Free software) and aside from the occassional glitch with our mail routing (I blame the consultants) it works pretty darn well.

In the case of our Exchange installation, I'd vehemently deny that tax dollars were wasted on purchasing the software (maybe I'd agree that it was wasted on the consultants, but I digress) as there was no other alternative on the market for our needs. If you think you know of a server that's a drop-in replacement for Exchange that costs less and is more reliable, please let me know! Otherwise, I can't see your argument for tax dollars being wasted on Exchange.

They must be terribly thick-headed

[pmz]

Many US agencies standardize on a single vendor (a fascist one, nearly).

Then, they suffer crippling downtime from that vendor's flawed products.

Side-splitting laughter ensues.

"Where is that laughter coming from," asks an official.

"The rest of the populated world," says his aide.

I have heard people post things like, "in the government, no real system uses Windows. Critical things still use OSXYZ, etc." Okay, then why do whole portions of the US government infrastructure go down due to a casual Windows-borne virus?

Another question, does anyone working IT in the government enjoy their job? I mean saying they really enjoy it without resorting to cynical quips about their bureaucratic superiors to change the subject?

Very pathetic indeed.

[getnuked]

The state department is last place you think anyone would allow windows PCs to run, apparently not even protected by the latest patches from microsoft, or even a simple firewall. America is so screwed if these noobs are their 'last line of defense'.

Hey ashcroft, why not look at Linux or OpenBSD, or did microsoft pay you so much that you not only looked the other way when the doj only slapped microsoft on the wrist after it was found a monopoly, yet now you have sold out the defense of your own country?

Windows is in critical systems everywhere

[mnmoore]

Recently while checking bags at the airport ticket counter, something caught my eye...

Apparently one of the machines that sniffs for explosive residue in those swabs they wipe luggage with had stopped working. They fixed it with a power cycle, and I was greeted with a familiar sight... the Windows 98 boot screen. Be afraid.

State/National administrations are not tech-savvy

[SysKoll]

More generally, administrations are not tech-savvy. Even if you abstract away the low pay, adminsitrations don't attract the kind of geeks that are likely to put up extra hours to make a badly designed system work in spite of user carelessness. Of course, you find exceptions to this rule. But sadly, this department had no such computer-babysitting geek.

Procurement of computer hardware (and worse, software) in state and national administrations is not a pretty sight. Little things like reliability and security tend to get lost in the bigger issues of "Will this project make me/my boss look good?"

The quality of the purchased products is much less of an issue than the degree of supplier's salesmanship. If Microsoft was selling papier-mache bridges and cardboard water mains, they'd manage to sell them by wining and dining the right officials. Not bribery, mind you, just convincing sales pitch.

Having witnessed the technical projects process in a federal administration that shall remain nameless (and which is gonna be broke in a few years so better milk it now), I can safely predict many more disasters of this nature!

-- SysKoll

yup CNN, that is gotta be correct.

[Anonymous Coward]

When was the last time CNN said something that was correct. Remember they are mouthpieces for the Govt and Corporations.

Yay, go virus!

[Anonymous Coward]

I'm mean boo, virus bad(but look what it knocked out!).

whew..

[kguilber]

For a minute I thought that meant I couldn't charge something to credit :)

Oh, that visa

[Anonymous Coward]

For a minute there I thought they meant Visa Credit Cards, I was going to say it's gonna suck for the next few days not being able to use my CC at all.

78000!

[Hylander]

There are 78000 terrorists!? No wonder i've been blown up 12 times this morning!

I am safe, I update hourly

[Anonymous Coward]

I know that my system is safe from nasty viruses.
I install every Microsoft update and security patch, on average of one per hour.
I thank Microsoft for working so quickly to keep me protected,
and all I have to do is install the many patches which they email to me.

I'm sure one of these patches will soon fix my email program,
it recently stopped displaying the contents of email which
could not be delivered. I'm simply resending all my mail, to make sure
the people will get my mail.

I'll call Microsoft Support if that email problem is still happening next week, I have a company
credit card for this, and I'll make that get fixed. For some reason my techs are very busy lately, and I
don't want to bother them with something which I can get the experts to fix with fifteen minutes on the phone.

78,000 suspected terrorists!

[old_unicorn]

78,000 suspected terrorists! What are they doing, putting everyone who applies for a visa on the list!

Demand accountability fr same AP om the News Media

[Avihson]

Just a bit of Bias showing in the two versions of the

Demand accountability from the News Media (fixed)

[Avihson]

Ok Windows screwed up ;) Check out the bias in these two stories, from the same AP source: http://abcnews.go.com/wire/Politics/ap20030924_650 .html Virus Hits Federal Visa-Checking System Computer Virus Cripples State Department's Visa-Checking System for About Nine Hours The Associated Press WASHINGTON Sept. 24 -- A computer virus disrupted systems at the State Department for checking every visa applicant for terrorist or criminal history, leaving the U.S. government unable to issue visas for roughly nine hours. And the following from MSNBC: http://www.msnbc.com/news/971031.asp Computer virus hits U.S. visa system Government was briefly unable to issue travel documents ASSOCIATED PRESS WASHINGTON, Sept. 23 -- The State Department's electronic system for checking every visa applicant for terrorist or criminal history failed worldwide for several hours late Tuesday because of a computer virus, leaving the U.S. government briefly unable to issue visas. Now, CNN does not even have the story yet, or deems it not newsworthy. Avihson ( have to learn to keep the sweaty palms away from the touch pad)

CLASS was never infected...

[Overt Coward]

I work as a contractor to the State Departent, on the next-generation of CLASS (still in limited beta testing). The CLASS system was not infected and was never down because of the virus. CLASS isn't even on Windows -- it runs on a mainframe.

The sub-network CLASS resdies on was disconnected from the rest of the State Department network in order to clean other systems -- during that time, CLASS could not be reached by consulates. There was no security problem because visas cannot be issued when no name check system is available -- just some inconvenience for people waiting on their visas.

Ob. WTF

[Trailer Trash]

It's gotta be said, WTF are they doing running important government functions on Microsoft OS's? When are people going to learn?

geez

[sofar]

for a country that preemptively strikes into other countries it sure has a horrible reputation of security... Too bad it's yet again the normal people who are the victims of this patriotic system since they will yet another time have to wait longer for their visas.

yanks, time again to write to your congressmen!

A "PEACE" of advice

[timlyg]

INS, the more you tighten your visa policy, especially against those already in the USA; the more threat you expose this nation to.

Re:Does the state dept. read /. ??? MAYBE

[Thing 1]

This is not your mom-n-pop accounting database, this is used all over the world. Eliminating remote access is not really an option.

Umm... Remote Logins != Remote Access.

More specifically, Remote Access < Remote Logins.

Allowing Remote Access is fine. Allowing Remote Logins is a no-no.

uhhhh, yeah.

[twitter]

The truth, however, is that picking operating system X or Y would not guarantee that something similar could not happen again.

Let's give credit where credit is due, shall we? The inverse of your statement is true. Picking Windblows garuntees you will have some kind of virus, worm or whatever eat your machine at some time. It's a simple matter of poor design. Having a mail client that auto executes crap like sounds from anyone on the world wide web as "administrator" or root is brain dead. Microsoft's Outlook does just that by default and I'm not sure you can make it or Internet Exploder do anything else. This is why we have I Love You, Blaster, Code Red, Slammer, Swen, Klez, Bugbear, and all year after year.

A monoculture of OpenBSD would not be good, but it would be vastly better. Any free software offers enough variety to give you the diversity you seek. Not everyone who runs Debian uses Exim, for instance. Debian has 7,000+ packages available and there is lots of functional repetition. This redundancy makes even a monoculture of Debian boxes look far more diverse than a bunch of M$ crap which must ALL have the same mail client, browser, media players and other fat ugly software integrated into the GUI.

Wouldn't it be ironic..

[Anonymous Coward]

if they outsourced the IT to India.

Can't have it both ways

[SgtChaireBourne]

As usual, the type of software is probably not the problem. It's the fact that the people running the system either don't know, or don't get the time for the necessary security measurements.

Look, you can't have it both ways - either it's so simple a monkey (aka MSCE) can run it or not. It's ridiculous to make this claim and then blame the admin, the user, the moon, lack of faith in His Billness, or whatever. I smell false or misleading advertising there.

There is no difference between those that cannot read and those that do not. If the state department could / did read, then MS products would not be allowed on networked computers. Windows, among other MS products, is not ready for the Internet.

Re:Can't have it both ways

[lanswitch]

I smell false or misleading advertising there.
At home I use slackware 9.0, after playing with Caldera (i'm sorry), Debian, Mandrake and Redhat. I also use W98 for an app that does not exist under Linux'.
At work we use Novell (secure), Linux (mostly secure) and various flavours of windows (not so secure, if). Windows boxes usually cost more time if you want to secure them, but with proper planning (and sometimes daily patching) you can keep them secure. If your management gives you the time and funding to do all that, then you could say that windows can be secure. But the same goes for Linux, although it will generally cost less time (and money) to keep the box secure. Plus you don't get the worms...
When we are talking (computer)security, we are mostly talking about human error (or worse). The technical part is just a small part of the whole. So the discussion about platforms is even a smaller part of that.

Feds interested in security? Not!

[Anonymous Coward]

They are either hypocrites and not really concerned with security or they are idiots!! If the federal government is really interested in security, why do they insist on continuing to spend 10 times more money out of our tax dollars to run one of the most (to the best of my knowledge, THE MOST) insecure computer system in the world? Every other alternative to Microshaft crap is more secure, both free and commercial: FreeBSD, OpenBSD, NetBSD, Linux, or Apple OSX as examples.

Re:morons disempower/knock out unprecedented evile

[Anonymous Coward]

Dear AC,

I've just metamoderated your offtopic rating, and all things considered I felt obliged to mark that rating as "Fair".

However I did read your diatribe in full, and I found it creative, insightful and inspiring. I hope you will post again, and I hope you will do it where more people are likely to see it.

Yours sincerely,
RC