Slashdot Mirror
Sasser Worm Disruption Growing
thebra writes "Yet another virus is causing problems with Internet Explorer. "Sasser, unlike a virus which travels through e-mails and attachments, spreads directly from the internet."A removal tool can be found here."
Here at work, none of our employees can connect to the VPN, hence nobody can get work done, hence I'm sitting here with my phone ringing off the goddamn hook.
Capital punishment for worm writers!
Sasser doesn't affect IE.
What does Sasser actually DO?
Usually, viruses have a goal, like collecting your personal information, DDOSing SCO, or SOMETHING...
What does this one actually do?
My theory is that someone wrote it to disable all the spamware-infested computers out there.
They can't be spamming us if they're rebooting constantly, can they?
And if the owner doesn't disinfect them and protect them from future attacks, they'll just start rebooting again...
I don't know the meaning of the word 'don't' - J
We tried installing MS04-014. It totally secured our network - it shut down out ADSL link until we removed it.
Thanks guys...
'Don't worry' said the trees when they saw the axe coming, 'The handle is one of us.'
Oh stupid me for typing the wrong slashes...try here instead. Oh well, a dose of humiliation before your peers is good for the humility gland.
All those moments will be lost in time, like tears in rain.
Another removal tool made by Network ASSociates can be found at: http://vil.nai.com/vil/stinger/ I've used it on a number of a machines with no problem. It only scans files (no registry). It fits on a floppy and it's free. It'll even run on machines that already have virus protection, good if someone hasn't updated their definitions and can't get on the internet. It's updated anytime a new baddy comes out, but you have to redownload the EXE file since it doesn't check for updates.
I still am of the opinion that it doesn't matter how many patches M$ releases. The fact is, we need an educated user base. So many people continue to use computers without knowing the full risks associated with them.
The Internet is great, broadband is great, computers are great. But as long as people are willing to give up their passwords for chocolate and have no clue what a firewall is or what it does, this problem will continue to plague everyone.
Nothing beats a good educated user.
Proudly supporting the Libertarian Party.
These are the three secret ingredients to a relatively secure system. Read them. Learn them. Understand them.
Hate me!
The original poster is not correct when claiming Internet Explorer has a problem. This time it's a hole in the so called "Local Security Authority Subsystem Service" that's causing problems.
See this and this for more details.
What it tells us about Microsoft, is there are people out there who cannot take care of systems.
This includes Linux boxes and Mac boxes as well.
Wake up and smell the damn coffee, it's not a problem exclusive to Microsoft, as much as some of the Linux rah-rah club would like to think.
Why is it OK for Linux to patch the hell outta itself but a damn near capital crime if Microsoft has to?
Grow up.
Microsoft released a patch, people did not install the patch. Who's fault is that? None of the 1000+ systems in my office were infected because I'm intelligent enough to have policies in place to prevent stuff like this from happening.
The poster called Sasser a virus, then proceeded to give a definition that said it was not a virus. No offense, but was the poster actually reading what he wrote?
From my understanding of the Sasser worm, it infects vulnerable Windows PCs by probing and connecting through a specific open port, and then launching some Windows specific code designed to infect and propagate the worm. My question is of a largely theoretical, yet insightful nature: if a Linux machine is running a Windows emulation environment, such as WINE, and the Sasser specific port is open, is it possible that Sasser could attack and infect the Linux PC? After all, if WINE is at a level of compatibility which allows Linux users to run complex Win32 apps such as Microsoft Office, is it also not inconceivable that some Windows vulnerabilities have been emulated also? I look forward to the community's response.
All the computers the UK Coastguard use have beeen affected according to this BBC story
Struggling to find a day everyone can make? WhenShallWe.com
Everyone with a Windows machine should sign up for MS's monthly security e-mail or religiously check Windows Update on the second Tuesday of each month. I won't go as far as recommending automatic updates, though.
When I am king, you will be first against the wall.
What the hell has a worm that attacks through non-HTTP traffic and downloads its body through a built-in FTP client got to do with Internet Explorer?
If you're going to bash Microsoft, at least bash the right frickin' part...
The Slashdot Paradox: "100% Overrated"
What could be more "directly from the Internet" than email?
An exploit connecting directly to port 445 of a host and not requiring any user-intervention to become infected.
It's a strange problem, security. Educated users are key, but because Microsoft has the largest market share, they also get the largest number of uneducated users. What will happen if Linux eventually completely replaces MS products on the desktop? Will they have the same security problems?
It looks like it exploits LSASS.EXE by scanning for a listening port 445. Good job I've got all incoming blocked by default.
Roll on XP SP2 with the firewall on by default for everyone, then hopefully things like this will go away....
Email gets picked up by your email client. An email virus must then be run from the message either by opening the attachment or (for some Outlook versions) by having Outlook open it for you. Even just receiving a copy of an email virus requires that you run your email client.
In the case of the Sasser worm, it is using an open port to crawl directly into your computer when you connect to the internet. There is no action required on the part of the user and no infected file to load. Windows simple accepts the connection and installs the worm.
That's why worms are "more directly from the internet" than email-based viruses.
Life is short: void the warranty.
I'm not sure why everyone is so hopped up on these removal tools. It seems to me that after being infected with a worm that installs a back door, more people ought to look at reinstallation from known good media.
Biggest Windows vulnerability ever, again. How many times have we said that this year? At work, it's begining to feel a bit like a duck and cover drill.
-Peter
. Penguins Surely Ca
Down the hall are the MCSE's. I can hear them shouting at each other about why this and that system wasn't patched.
Even the network big wigs are in the room with them.
Ahhhh... the joys of *nix....
Back to my wonderful coffee....
This is a test. This is a test of the emergency sig system. This has been only a test.
i'd like to know:
when is someone going to put a genetic algorithm into their virus/worm?
something that mutates the worm's parameters (ports, timing delays, ip-search stratgy, etc.) so that the most virulent parameters are found by "natural selection"?
seems like an ideal application for genetic algorithms.
K.
People have short memories. There was an Apache worm about two years ago (in mod_ssl).
Here is a link
Of course, worms like that are few and far between, especially when compared to the number of Windows worms going about lately, but to claim a system is "worm free by nature"? I think that's more than a little premature.
I have zonealarm setup on a home PC and it failed to keep Sasser out. So much for a personal firewall.
And yes there is AV on it, but it was infected before the updates had even come down.
Same s**t, different day
Nope, this one was on /.
first
A few days ago I saw a message from our firewall asking if I wanted to allow Security Authority Subsystem to be contacted by a remote host.
A simple click on the "No" button stopped this worm in its tracks.
If more admins just installed firewalls and made sure all unnecessary services were blocked there'd be a lot less worm infections. (sure it won't protect people who need to use the Security Authority Subsystem, but I'm willing to bet a lot of the infected machines don't use it at all)
Google cache of McAfee's page on the worm
One of symantec's pages
The patch from MS : http://www.microsoft.com/technet/security/bulletin /MS04-011.mspx
just BSOD'ed my Citrix server.
YMMV
"/Dread"
A. Guy takes home corporate laptop.
B. Plugs laptop into phone-line / uses internet
C. Gets infected
D. Takes his laptop back to the job
E. Infects the entire LAN *FROM THE INSIDE* while the firewall hapilly keeps the fire "IN" (instead of out).
If you fire anyone, please fire the laptop-owner.
This unique sig is intended to make this user more recognisable.
Apache has the largest market share in HTTP servers, and it's not the most hacked.
I always see this posted and I think people get this mixed up. More web sites are hosted on Apache servers, but there are more physical boxes running Windows.
Example:
I just left a job working at one of the largest internet hosting companies. We hosted close to 300,000 web sites; both Windows and Linux. Our customer base was roughly 60% Linux and 40% Windows; hosted on a little over 5,000 servers.
If you were to know the number of servers we have and looked at a Netcraft scan you would assume the following:
3,000 servers running Linux web sites
2,000 servers running Windows web sites
But that would be incorrect. Most of our Linux sites are cheep little geek home pages where we have a couple hundred sites hosted on a server. Our dedicated sites, big e-commerce sites, are mostly running on Windows boxes. So we have some servers running hundreds of sites and others running 1+ sites.
What's my point? In reality it's more like 1,500 servers running Linux (Apache) and 3,500 running Windows (IIS). I've worked at a couple large hosting companies and it's the same at all of them. So when you see the Netcraft report stating that 65% of the web is running on Apache, that doesn't mean there's more physical servers out there running Apache than IIS; just Apache servers are hosting more sites due to the small, cheap nature of a lot of Linux hosted sites. So, in reality, there is a larger install base of IIS machines. Of course Apache is pretty secure, because if they attacked an Apache box at a hosting company they could take down a lot more sites, causing more havok.
Mine was probably the only PC left infected in the office. Funnily however when i tried to download the patch for Sasser from Microsoft ( I unfortunately have to dual boot), Here is what i got Thank you for your interest in Windows Update Windows Update is the online extension of Windows that helps you get the most out of your computer. You must be running a Microsoft Windows operating system in order to use Windows Update. From what i have heard from my colleagues, this worm attacks when you connect to net, and microsoft forces you to connect with a vulnerable system. But then, windows is a product for dummies from the dummies. PS: Tried fooling the script at windows update site by changing browser identification, but this only prevented the thank you message, didn't allowed to download the patch
Microsoft, Linux, Apple - all platforms need to have this drilled into their brains, coding, and documentation repeatedly with much force! Microsoft is a target because they have angered so many with their *business* activities and sloppy coding. How long before Linux joins them?
I am an avid Linux user - The only windows machines I have are for client applications that I can not run on Linux.
Most of us (yes, me included) when we scratch an itch, make it work for ourselves, not for the world in general. If we are to produce Secure, Stable and Safe programs, then we need to have a tool set that allows us to build them without thinking about it, or we need to all think about it with each app released into the wild. Asking Joe User to know enough to run a secure platform is like asking all people to be able to self serve everything in their own cars, appliances and bodies (i.e., no mechanics, repairmen or doctors needed).
'It aint gonna happen!' All of these are way to complex and most are changing faster than most people can keep up with. So, it needs to fall back on our shoulders (the developers) to make this happen. The question today (as in so many other days past) is what can we Linux developers learn from Microsoft's mud? What are the issues that are allowing these things to happen and how can we prevent them? I hope everyone has heard this before.
And, more importantly, how do we get qualified people to itch this scratch to completion? It seems to me that the world in general would benefit most from a programming tool set that built these solutions in, and that is not going to be an easy task. Microsoft is trying to address that with .net, and is still not on target (or anywhere close from what I have seen). Java tried to answer that, but it has fallen far short of what is needed.
I really do not have any answers to this. One of my bet friends has explained to me the complexities of building compiler systems and writing your own languages. Those complexities alone are big issues. I would love to read what other /.ers have to say on this issue.
InnerWeb
Freud might say that Intelligent Design is religion's ID.
Poor programming by Sasser's creator makes infected machines shut down.
That should make the writers happy... that their ineptitude made global news.
I am not impressed with the foo of these cut-and-paste virus coders. There was a time when it was actually difficult to code one of these things, but come on... they are open-source now.
No-kung-foo-required.
The built in WinXP firewall does NOT protect against the Sasser worm. I ghosted an XP box three times to confirm this-- not until after applying MS04-014 and/or using an alternative firewall (zB. ZoneAlarm) did I see protection from Sasser or its variants (if they exist... although I did see LSASS crash a few times without the presence of avserveX.exe on the system).
I don't know about you guys, but the SASSER worm turned an otherwise boring Sunday into wickedly exciting day! Thankyou worm-guy!
-s
Wow, I'm witness to Slashdot jumping the shark. An article summary bore no resemblence to the actual article. This hasn't happened before.
I've found that the best solution to the problem of Microsoft's constant and ever more serious security holes is simple:
Dual boot with Linux. Linux for the network; Windows for the games.
Just use Linux as your network-enabled OS, and Windows for everything else. Log off the internet or disconnect your DSL or broadband before you reboot into Windows, and you'll be fine.
It is really that simple - I just disconnect my network connection when I'm running Windows. Let's face reality here:
So the solution is simple: Linux is your network OS, and Windows is your "friends and family" OS.
The society for a thought-free internet welcomes you.
A. Guy takes home corporate laptop.
B. Plugs laptop into phone-line / uses internet
C. Gets infected
D. Takes his laptop back to the job
E. Infects the entire LAN *FROM THE INSIDE* while the firewall hapilly keeps the fire "IN" (instead of out).
This actually happend to us last year.
If you fire anyone, please fire the laptop-owner.
Uh, problem being that it's good odds that the laptop owner is the boss of the people wanting to fire someone.
My Karma: ran over your Dogma
StrawberryFrog
Just like the ASN.1 vulnerability that is patched through one of the recent Microsoft patches. Supposedly Win98/ME PC's aren't affected by the issue. But looking at my company's Win98 PC's I saw the msasn1.dll file present. And researching things a little bit I saw that the standard implementation of the ASN.1 command parser is affected on any and all platforms. From a Nortel H.323 gateway to a Cisco router to a Windows 2003 Server to a Windows 98 PC.
This was months ago that I read this. I called into the Microsoft PCSAFETY toll free number and a tech indeed acknowledged that Windows 98 and ME PC's were vulnerable. And they e-mailed me a link to download the patch (not one of the hoax e-mails either, so no jokes!!). Since then I deployed it to all of my Windows 98 PC's and know that they are at the same standard as the Windows 2000 and XP machines.
What kind of company releases patches and leaves out some client versions that are still safe from the EOL cycle? That's what Microsoft did with the ASN.1 patch.
And what kind of company releases patches that obviously weren't tested on clients that were running USB storage, DLT storage, and IPSec agents? Look at the KB835732 patch. It broke all of these driver loads, leaving patched PC's running at 99% CPU utilitization after rebooting.
Nice, really nice. Risk stability and compatibility issues versus being exposed to an Internet-borne worm. I'm not blaming Microsoft for having vulnerabilities. All OS'es do to one degree or another. But I am blaming them for leaving our client versions and not thoroughly testing code they should've been working on for 5 months.
If enough machines get infected you won't have to worry about anything. The network will be flooded.
Seriously folks. Microsoft release the patch 21 days ago. If the worm came out before the patch I would be more critical but it didn't. Hopefully Microsoft decided to turn on automatic updates by default in service pack 2 for XP.
And let's face it; if your machine is not properly patched, it's probably already being used as a spam relay, so it's not the spammers who would want this.
In a corporate network environment, such as mine, a few weeks is barely enough time to get a patch onto every desktop. First a few days are spent testing it. Then it has to be pushed out to all of the users. Server patches often have to wait until weekends because they can't be down during the week. Then manual installs have to be done for all the "non-standard" setups.
Then there's the new computer I got yesterday with our standard corporate developer's build. Of course the build doesn't have the latest patches yet, so when I turn on the computer for the first time, immidately after logging in McAffee catches the virus. So then I have to hunt down the right patches from the right people and reboot repeatedly until I can log into the network without getting the virus.
So I lost all of yesterday fixing the problems on my two computers and my office is as up to date as possible with getting patches onto workstations. Machines go for weeks without new patches because it's impossible to distribute them when some break applications, and therefore require much testing.
I wrote a 70 page document explaining why we should switch from Windows to Linux. Management wouldn't even start to read it. This is what they get for their ignorance.
Developers: We can use your help.
It's funny how articles claim that the worm has caused all kinds of damages -- from banks to postal systems, to transit systems. The tone of the article seems to lay blame largely upon the worm itself. This is absolute horseshit. If users (and IT personnel) at these governments and places of business were responsible enough to do their jobs and ensure that computers were adequately patched, this problem never would have occured.
Furthermore, if personnel took a single iota of initiative by installing and maintaining a simple firewall -- these issues would have been far less widespread (although this can still be spread through a network via infected laptops brought in from a home network). The important thing here is that the creators of this worm, the IT groups who let this happen, and the individual broadband users affected really share blame for the spread of this worm. Let me use an example, if you live in a shitty neighborhood and you leave your door unlocked, you are partially responsible for some jerk breaking into your house -- sure, they broke the law, but you helped facilitate that.
OK, one more topic to rant over then I'll STFU. I see alot of Slashdotters blaming Microsoft for this problem -- saying that running Linux or xBSD would solve this problem. Bullshit, fanboys. I am a Linux/Free software advocate and that argument is absolute bullshit. Every once in a while, remote exploits are discovered for these Free products. Most of the time, patches for these apps are released right away -- faster than their commercial counterparts are able to react. The users will still need to be smart enough to apply the patch. Well, in this case, Microsoft's patch was available before an exploit was in the wild. The reason why this worm is so widely distributed is because the user base (and administrative base) is large enough that there is a large cross section of people who have no idea what they're doing.
If Windows went away tomorrow and Linux became the defacto standard, we would have the same issues. All of those MCSE's who allowed this to happen will become RHCE's who will still allow something like this to happen. That certification doesn't make them any smarter -- bad admins are bad admins. Clueless users are clueless users, regardless of the operating system they use. It's easy to blame Microsoft for this, because they have deep pockets, a huge market share, and shady business practices -- but all code has bugs. Microsoft did the right thing, their userbase just wasn't smart enough to do the right thing.
-Turkey
If most users would quit being so cheap and buy a firewall appliance like a linksys router, or (for the more savvy) build a Coyote linux box we wouldn't have half of these problems. I run Win2k, Solaris and SuSE linux. The linux box is the only one exposed to the net and hasn't been rooted/hijacked once in the three years it has been exposed. Running stuff like Zone Alarm is like giving a band aid to someone who has a big gaping wound.
"I bow to no man" - Riddick
this is going to be a long day.
No, that's inaccurate.
Worms can spread to other machines on their own. Viruses require some external intervention (such as file sharing or e-mail) to spread to other machines. See this entry in the Jargon File for a more verbose answer.
Now, many of the latest e-mail "worms" would be better classified as viruses or trojan horses, as they are incapable of infecting other hosts without direct user intervention (i.e., opening an attachment.) They've been (IMHO) mis-labeled as worms because they display worm-like behavior once they've infected a machine--that is, they mail copies of themselves as trojan-style attachments to other users.
So yes, the Sasser worm is a bona-fide worm. It transmits itself to other systems without any external help.
Obliteracy: Words with explosions
Autoupdates and immediate patching aren't options for large corporate networks. Patches often break existing applications. Even after extensive testing some patches have caused more problems than they fixed. Windows Update sends enough information back to Microsoft for them to determine what's installed on our private network, so we block it from running.
It takes weeks to test a patch and push it out. Servers often can't be rebooted until weekends. Then there are users with special situations that require manual installs. It takes time to do hundreds of installs manually. It also takes time to get the patch onto the standard corporate "build" of Windows, so for a while new computers need the patch pushed out after logging into the network the first time, leaving a gaping hole for this virus to spread.
Developers: We can use your help.
OK this sasser worm can install istelf open a few ports, serve files as an FTP daemon, place itself where it pleases, and gobble up your network.
Other virus's do all sorts of nasty things, but they all seem to stop short of REALLY bad things. Search for files they can delete, look for a network drive and have their way, find interesting files and mail to random people, rename this or that to render the machine useless.....
To me this seems very strange. Is ther some kind of virus writers code that has some small bit of ethic? Is there some undergound society that meets the 3rd wednesday to discuss safe virus exploits? Does Microsoft create these things to get people to upgrade? Maybe McAfee and Norton are funding them and they just want a profitable year?
Now I am not asking for this kind of damage, but as my boss points out he has no reason to switch to anything more secure because nothing really bad happens.
A tool that I use quite often seems to go ignored time and time again.
Trend Micro Damage Cleanup is a free after-the-fact cleanup tool that will fix just about any virus (As long as the pattern file is downloaded...) It scans drives, registry, etc. The only drawback is that it's quite large (The pattern file is ~8.5MB and the Scanner is ~1.6MB).
It blows Norton's one-fix-per-virus tools away, except from a portability standpoint. Also helps make sure you don't leave other viruses behind. (Did I run the Netsky.QZX removal tool, but not the Netsky.ZZB one?)
Yesterday it found 530 copies of Agobot (3 Variants) and Sasser.B on one person's PC.
PS: Tried fooling the script at windows update site by changing browser identification, but this only prevented the thank you message, didn't allowed to download the patch
That's because windows update installs via an ActiveX object. Only IE can run that. You probably downloaded the ActiveX object, but since it can't run without IE, it didn't download the update. If you need to download the update separately, check out the adminstrator section of windows update. MS provides all updates as a separate download that you can burn to a disk and install that way.
No matter how many of my rights are taken away, somehow I still don't feel safe. -Frigid Monkey
I think you've missed the point.
1: There ARE more web servers out there running Apache than anything else. So, why is it that there is an unbalanced proportion of these boxes remaining intact and and with 99% (sic) uptime than the Windows boxes?
2: Apache runs properly with fewer system resources, hardware and preventative maintenance than Windows. Set & forget, to a great extent.
3: One of the main reasons that many corporate/commercial servers are still running IIS is because of the ease of use in integrating MS SQL and specific data export services from what the desktop is running: Windows. If from your average net admin's perspective, they could easliy and definitively state to their bosses that they could run a given database server on Apache for X dollars instead of on MS for XXX dollars, they would do it. It is difficult for the admins on two fronts: a) persuading their employers that a free product could possibly outrun what the so called market leader has provided, and b) if something goes wrong, fewer heads will roll if they're using MS instead of a "free", "open-source" product that, in the eyes of their employers was a gamble to start with.
This will all change VERY soon.
It's all a mind game....
My point wasn't that M$ has absolutely no guilt in the matter. You bring up a good point by comparing the issue to driving. BOTH parties are responsible for using the product correctly and safely.
The manufacturer should make every effort they can to ensure the product works 100% out of the box. If you know full well that your Ford Explorer has tires that blow up on impact, you should not sell the product with those tires. In the event that you did so accidentally, you should make the public very aware of the situation and attempt to rectify the problem. Now, Microsoft has done reasonably well on the second account (a patch was/is available) but not so much the first. I think that having something similar to a "recall notice" for Windows OS that is very public could be a step in the right direction.
However, it is also the job of the consumer to be educated in their use of the product. A Ford Explorer is perfectly capable of towing a boat, but Ford does not necessarily include the right tools to do so. It may have the hook thingy in the back of the body (pardon my lack of vocabulary) but if you try to tow the boat behind with a rubber band, it is not Ford's fault you were uneducated about that decision. In the same way, Windows is perfectly capable of being an OS that can be connected to a network to transfer data. But if you decide to do so with a DSL modem that has no firewall, that is not Microsoft's problem. In that regard, MS has made the attempt to educate their user base (link) , but it is up to the consumer to read and educate themselves at that point.
When this worm could have been stopped very easily with a properly configured (and inexpensive no less!) firewall, I find it hard to pin all the blame on MS.
Proudly supporting the Libertarian Party.
First, I didn't choose Windows. I recommended Linux and/or BSD with a 70 page research document to back it up. Management ignored it. Second, I'm a developer, not an admin, so I have no say in the patching process.
As a developer I can tell you when patch goes out that breaks an existing corporate app, execs get furious at the developers. If I write application X then any time X doesn't work it's my fault. No matter what, the apps have to work. The multi-billion dollar corporation comes to a halt if the fundamental custom apps aren't working. A problem caused by a patch from Microsoft can't always be resolved by adjusting code in our apps. Management cares a lot less if we're rooted because at least business can continue.
Of course I think Microsoft should be sued for some of the problems we have. I don't think everything in the EULA will hold up in court in every state. But it's not my decision. And I also agree management has no one to blame but themselves for sticking with Microsoft. They get what they deserve. All I can do is write the best apps I can and get paid for it.
Developers: We can use your help.
It's bullshit and you know it. One of the April 13th patches funged IE, and within a week there was a follow-up patch, that still leaves you two more weeks to patch.
What else did it break? Nothing?
I got a laugh when our security team sent out an update to their vulnerability notice for Sasser (doesn't affect my servers, hehe).
"[We] have learned of issues loading the Windows 2000 patch in MS04-011 when complying with [vulnerability ID].... systems can stop responding, users cannot log on to Windows, or CPU usage for the system process approaches 100 percent after installation of the security update. Additionally, [we] have heard that some systems may require a complete rebuild once the patch causes system to crash."
And the kicker, "Systems Administrators are advised to proceed with caution when patching Windows 2000 systems." Um, how exactly does one do that, with one hand on the power cord, or click the install button very slowly? Does applying the patch warn you "About to hose your system, proceed?"
You speak the truth. However, as always, the car:computer analogy fits here. If you think about what you need to know to use a car, it's not very complicated. There is a core set of knowledge that you need:
1. Operational (How to turn it on/off, put it into gear, brake, accelerate, speed, re-fuel, etc...)
2. Navigational (How to get from point A to point B. Understand traffic flow and direction. Read signs and street lights, etc...)
That is the bare minimum you need to drive a car. Many people these days seem to just barely know (or care) about any of that. In addition there is extended knowledge:
1. Maintenance (Get your oil and filters checked/changed. Tune-ups. Fluid checks. Cleaning.)
2. Enhancement (Learn more about your engine to get it performing to the best of it's abilities. Understanding the interaction between your car's tires, the road and aerodynamics to get the most out of your car)
3. Interior/Exterior Decor ("Trick Out" your car and add high performance with stickers, spoilers, tailfins and fartcans. Make sure your stereo can tip off Richter scales for miles around, etc...)
Very few people ever get to that level of knowledge. There really isn't any real reason for "Joe Average" to get there. But as far as the core knowledge goes, would you want someone out on the road who can't read directional signs, doesn't understand the concept of direction (N, E, S, W) or speed limits? Trust me, I see people on the road every day who appear to be lacking these basic skill sets and they are largely responsible for the accidents we see regularly.
Apply this to computers, and you can see that we are, indeed, in a sorry state by comparison. Again, there is a core skill set that a computer user SHOULD have to be fairly competent. But it's much more complex than what is required for driving a car:
1. File System - An understanding of how files are organized in an OS is very important at this point. It's a LOT like knowing how to read a map and get from point A to point B. Sadly, most users DO NOT have this skill set. In the interest of being "user friendly", applications like MS Office have attempted to abstract where files actually are located. This harms the user because if MS decides to change the location in a new version of the OS or program (My Documents has moved from where it was in NT 4.0 compared to Win2K and WinXP for example) then the user may think their documents are "gone". Tools like "Find Files" aren't any better at helping either because the user will ignore the path and just double click the file to have it open in Word. Or worse, there will be a "shortcut" in the "Recently Used" section of the Start Menu. I ask you, would you set up a physical filing cabinet this way with post-it notes in folders saying "This file is in Cabinet 35, Drawer B, Divider 2, Folder 12"? Shortucts (and sometimes symbolic links in Unix) are a BAD IDEA.
2. File Types - One of the worst things about most OSes (Macintosh pre and post OS X excepted) is the non-existence of standard file types. Part of this is due to the fact that file types and data types are a moving target. HTML files didn't exist in 1984, so a Macintosh from back then wouldnot have had a built in association with an application that could read them. In the Windows world, the association between application and file was (and can still be) manual procedure that will perplex most users. Considering how much data and file types come and go and change, I am still wondering why there is no DNS type of system for file types that any OS worth it's salt would hold to. Imagine... a central DNS like repository that holds a database that an OS queries: "I have a file with the following type: x-application-doc. What applications should I use?" The server responds to the OS: "mswin-winword.exe, mswin-soffice.exe -writer, generic-unix-soffice, linux-kword, multiosapp-abiword". Then the l
Who is Twirlip of the Mists?
In interesting quote from that article: "Experts agree that Linux computers are not as susceptible for a number of reasons including clear separation of functions like email and applications so that hostile code cannot be run without significant user intervention;"
It seems to me that non-hostile code cannot be run without significant user intervention either.
we collect data from clinical trials, and we do so in a validated manner as we're inspectable by the FDA. i'd rather disconnect our LAN from the WAN and work with reduced functionality than just patch the servers willy nilly and break our validation. we can't apply *anything* without formally testing it as it could potentially affect data. it's fine if you're just doing bogstandard file'n'print, but for other stuff you can't just go installing patches that may or may not impact production systems.
1) Several groups were relying on SUS in order to get those patched distributed. If you go into SUS, the patches were 'approved' on one screen, not on the other. I wasn't alone in seeing this. Suffice to say, I was also a bit shocked when it started to blow through and none of my machines were protected.
2) When it installs (sasser.d) it writes itself to 'System Volume Information' - allowing it to not get caught by NAI's on demand scanner, and re-infect the box if you don't do a C drive scan manually.
--pete
spread fast for the first few hours or days, until it saturated the vulnerable population, then cut way back on network traffic and hide.
not crash machines or trash all their files - instead, it would slowly and subtly modify user data files (see here for a few suggestions).
Imagine what would happen to modern business if they discovered that they couldn't trust any document that had ever touched a Windows machine... the world's economy would grind to a halt. Not even Microsoft has enough money to pay damages for an event like that, though the combined law firms of the world would try to get it from them.
To a Lisp hacker, XML is S-expressions in drag.
I also work with clinical trials and the FDA breathing down my neck. My office is all running Macs. Intentionally. We knew that the small functionality loss from "going Mac" would be much much less than the horrific security problems unleashed on the Windows World.
"One touch of Darwin makes the whole world kin." George Bernard Shaw
Of course I think Microsoft should be sued for some of the problems we have. I don't think everything in the EULA will hold up in court in every state. But it's not my decision.
Okay. How about those people who don't even run Windows and therefore have no part in the EULA? Their networks are being ground to a halt because of flaws in Microsoft software and their patching process, as infected machines attack them.
Analogy: car company X builds cars with defective brakes. You didn't buy that car. Your wife and children are driving home from shopping and someone driving X's car runs through a red light because he can't stop, and plows into the side of your wife and kids. Now, not that I'm overly litigious, but there's a time and place for companies to be held responsible for the damage caused by their poor products and designs.
Who do you sue? The guy driving the car with defective brakes, or the company that has a pattern of time and time again making defective products?
Fire and Meat. Yummy.