Slashdot Mirror
UK Government Launches Virus Alert Service
Phil1 writes "The BBC is reporting that a rapid alerting service that tells home computer users about serious internet security problems is being launched by the UK government. Has this been attempted anywhere else in the world? Was it successful? And will they be plugging the Microsoft Anti-Spyware package (once it leaves beta)?"
You linked to the Anti-Spyware app... and mentioned the AV app... have they already released a beta of the AV? I know it's been purchased and in the process of rebranding... but come on!
Help Brendan pay off his student loans
UK security alert service hacked, all your personal info are belong to us!
*signs up*
Only problem with email or TXT alerts is that the sender is easily forged.
Hi, this is your government alert - please download the latest patch from http://www.alerts.gov.uk
The problem is that (apart from Slashdot users of course) that the hyperlinks are hidden, so any spammer can forge these messages to catch the unwary.
That alone would bring this thing down - it would only take a few lords or half a dozen grandmas to see goatse (or worse - gator spyware) to cause a public lack of confidence in the entire government program.
You can't expect to wield supreme executive power, just because some watery tart threw a sword at you
When will we expect the first Trojan masquerading as an update from the "IT Safe" service. The over/under is about 6 hours after the service goes live.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
It doesn't matter, all it does is search for IE, and if found, tells you that you have internet security problems...
I have worse karma than M$.
But when going on the US's past programs like this, any time you get the government involved, things tend to get out of hand.
I just don't understand the need especially when symantec will do this for free.
http://jayceecorder.blogspot.com
I have to say that I am very happy with the antispyware package that they have released. It consistently finds more spyware on my girlfriend's PC than any other program I have tried.
Products such as this, and released for free, start to wash away Microsoft's evil image
Those who know, do not speak. Those who speak, do not know. ~Lao Tzu
They could come up with a color-coded "Virus Threat Advisory System". Just off the top of my head, they could use something like:
Low = Green
Guarded = Blue
Elevated = Yellow
High = Orange
Severe = Red
Who the hell knows what users should do at each of these levels, but at least they'd be using techniques that have been used in other successful alert systems.
I'm a big tall mofo.
Who will be the first person to spoof these alerts then I wonder ?
The Dutch Government CSIRT is doing this for two years already. So you can chill out to a cool Legowelt CD and get warned when there's a new threat.
Alerts will not be issued unless users can do something to protect themselves against the threat. This might include downloading an update from an anti-virus vendor or updating software to close loopholes and fix vulnerabilities. This could also include something as simple as "don't go to X domain because it hijacks your ICQ"...
The term "home users" bothers me.
Just what The UK needs anotrher higly ineffeciant government agency
If they gave poroper advise on spyware removal and forced microsoft to produce decent software fine, but not a new service that provides obvious info that can be found elsewhere.
perpetually dwelling in the -1 pits
On the site: http://www.itsafe.gov.uk/ theres no check to see if you are an UK citizen.. Also theres no mention of it being for UK'ers only on the site or in the press release...
Although i migth just use the service from DK-cert or some anti virus company..
One hopes the government is better at computer viruses than their attempts on humans.
for the las 3 years. At Alerta Antivirus
If the day of the week has a Y in it, Microsoft had a security problem today.
I just saved the government (pinky to corner of mouth) 1 Billllion dollars!
Since a few years the Belgian regulatory body for postal services and telecommunication (BIPT), has a special unit that tracks and warns for (possible) virus attacks.
Sometimes you get a warning of the BIPT in the radio news or during the traffic information announcements.
http://www.bipt.be/bipt_E.htm
I do not know how they work or how they are structured, and if it helps at all, but the UK is not the first country to do this...
Now that the UK is going to spend tax payer's money to prevent problems caused by poor design by private companies, are they going to put extra tax on the purchase of vulnerable products and licenses (mostly Windows)?
I wouldn't want my tax money being spend on plugging the holes in software I don't use.
The topic asks if this has been attempted anywhere else.
Well, there is the Computer Emergency Response Team at Carnegie Mellon University, and I like their approach.
I mean, one way they respond to threats is to contact anti-virus manufacturers. From there, it's a short step patches available via subscription.
You get the deep pockets of government to maintain the watch, and the rapid response of industry when a threat's been isolated. I like that division of labor.
668: Neighbour of the Beast
Is to not be so stupid. People are always falling for these basic traps, like clicking "YES" to browser-based software installs, opening attachments like "Imamoron-funnystuff.exe" from their friends. It's like some people just completely lack a filter that allows you to prevent 99% of viruses just by not running or clicking things they don't need to.
I think it's largely in part to the Windows interface which plays down the "significance" of running and having running programs and software while on a network (the Internet, mostly).
I haven't had a single virus on my home machine since 1996, and I think I self-infected when I was trying to figure out how it worked.
And I NEVER use a real time virus scanner. I check my Windows computer when it behaves strangely, I see new processes, event viewer notices, etc. The fact is, even if you keep your virus-scanner (real time) up to date, all you're doing is *potentially* reducing the "reaction" time to the frequency of updates released by your particular vendor. Whereas with my method, I'm up to date on virus news, as well as the usual effects of them, and find solutions on an as-needed basis should I EVER become infected by one.
So. Yeah.
We are one consciousness experiencing itself subjectively. Back to you with the weather, Bob!
Snarky comments and Microsoft jokes aside (not that I don't like either), this makes perfect sense, at least on an abstract level.
Weather alerts, pollution alerts, traffic alerts, tornado warnings - all those are ways to reduce damage, save lives, and make life run smoother in the face of of problems. In the internet age, viruses and such fall into a similar category, so this makes perfect sense to me.
Also, this just increases people's awareness of inernet issues. A few years of watching virus alerts fly all over the place may make people more careful, more picky - and more demanding on certain software vendors.
Now where I WILL bet a bit cynical is if this is A) done right and B) can be done right elsewhere. I'm sure it can be done right, but the "if" is anoter question.
Still, hey, go for it UK Government.
"The Sage treasures Unity and measures all things by it" - Lao Tzu
we have such a service. They'll send SMS text messages to cell phones, free of charge. http://www.waarschuwingsdienst.nl/
;)
If it is succesful, I don't know. I just like the SMS messages
So. Do you think that this might just spawn a remarkable number of virus or spyware alerts from individuals looking for a good time? If people can successfully phish, just think of the fun that they will have scaring people about threats real or imagined.
While a good idea in principle, the reality could end up downright ridiculous- just how many of those e-mail alerts are going to cross the ocean?
befuddled (noun) 1. Unable to create a pithy sig
Yes, the giant engine works well...clearly MS wins of they get /.'ers thinking it's an MS product. "Let's buy something for a few million with a fraction of a percent of our billions, rebrand it as ours, give it away to the people who only have spyware because our software permits these drive-by installs...and hell, we should be able to write off the whole purchase PLUS get people thinking we're nice guys!"
I wonder what the frequency of choosing the words "ITsafe" or "virus" or "warning" or "alert" would be by people signing up? 50%+?
We are one consciousness experiencing itself subjectively. Back to you with the weather, Bob!
"The government expects to issue between six and 10 alerts a year"
Are they on Planet Earth? Between 6-10 alerts per year? I think they meant to say 6-10 alerts per week.
There's an election coming up, so it looks to me like another useless publicity stunt. I'm sure the web site will be left to wither once it's been reported in all the newspapers that the government is keeping us safe from "cyber-terrorism".
in Spain. http://alerta-antivirus.red.es/portada/.
Papers in spain quote that site all the time.
Why, just last night I got a bunch of helpful popup windows alerting me that "we have detected that your computer may be infected with spyware or a virus." There was also a button that I could click to download software that would fix it. Sounds like we're way ahead of the game, so chew on that for a while, U.K.!
Evil is the money of root.
Heard they are considering not releaseing it.
If they charge money for it, their makeing the industry rely on their buggy software, and then instead of fixing the software sell you "protection", sound familiar?
If they give it away, will be seen as anti competitive with all the very big business anti virus software manufacturers out there.
...
The site I'm referring to: http://www.bipt.be/ They generate virus alerts by mail. I have a subscription. I only get three our four times a year a mail, warning some old virus. Better depend upon automatic updates of antivirus packages. Prefferably use antivirus packages of different vendors.
If that site is the best my government can come up with, I may have to slap each and every Labour MP with a large trout. I may just do that anyway.
Anyhow, their HOWTO on running Windows XP's automatic updates tells people to use the "custom" option. You know, the one labelled "(Advanced)" i.e. not the one their target audience want. How in the hell are the sort of people who would use that site know what patches to apply and what ones not to? It's like that site was knocked up in an afternoon by a drunken muppet.
worms, adware, spyware, malware, adn a frenzy of activity. Talk about these things effecting "computers". Bullshit.
I am dead serious whaen I say that from now on I am going to call all of the above by one name:
dontuserfuckingwindowsyoufoolware
The UK scheme appears to be based around emailing users about security problems.
Because obviously, if you receive an email giving you security advice, its guaranteed to be up-to-date, accurate, authoratative and with excellent step-by-step instructions on how to +++ATH0 NO CARRIER
Andrew Oakley - www.aoakley.com
The terror threat level is currently: YELLOW.
Be on guard for potential terrorists and alert authorities about anyone who:
-owns firearms.
-posesses drugs or drug paraphenalia.
-supports the Constitution.
-doesn't pay a proper amount of taxes.
-downloads MP3s.
-talks negatively of the government.
Thank you for your cooperation. Together we can win this War on Terror!
Well, different strokes for different folks, I guess.
I mean, I want the government out of as much of my life as possible. So, I wouldn't want the my (US) government sending me notifications about my AV software. The UK is a different country, they do things differently there, if this scheme works for the citizens of the UK, well, good for them. Mind you, I'm sure others will point out problems with this scheme.
668: Neighbour of the Beast
"The government estimates it will issue security alerts about six to 10 times a year"
"Those signing up will only be told about the most serious security threats that have the potential to affect millions of people."
This sounds like a particularly ineffectual and pointless exercise. This level of virus information could be picked up from doing nothing more than watching BBC news or reading their site during the year. Further, it makes you wonder if the whole project will be run by a single guy who's job description has just been extended to include 'watch BBC news programs then forward email warnings to UK PC owning in-duh-viduals'.
However, it is also an extremely cheap way of getting +ve headlines (even Reg refers to it as an 'initiative'). I guess each government department has been told to come up with crap like this because we're in the run up to a general election.
Plus the advice summary is bullshit:
Install anti-virus software
That's corrective action. How about prevenaitive action like pointing out secure products and warning the public to avoid defective ones? An ounce of prevention is worth a pound of cure.
Keep your anti-virus software up to date
You can't patch fast enough. That includes so called anti-virus software. Someone has to get hit first. AV companies have to then react and update the AV software profile. Then users have to add the updated profile, over a modem that can take time. MS-Slammer reached saturation in 8.5 minutes.
Install a personal firewall
Web pages and e-mail go right through that fire wall, they're supposed to, so do outgoing connections usually. Unfortunately most MS malware comes in via MSIE (the web) or MS-Outlook (mail), so how exactly is a firewall going to help? How about swapping out vulnerable applications and services instead?
Use Windows updates to patch security holes
There are other systems besides MS-Windows. Currently these do not even get viruses or worms. Some of these (e.g. Ubuntu) are easy to install and work on existing x86 hardware. Macintoshes are low maintenance and work out of the box. Unless you're a heavy gamer, you don't need MS-Windows.
Do not open e-mail messages that look suspicious
A virus is only harmless data, unless your system is designed to run it on sight. How about choosing an e-mail client that's not designed to spread viruses. Thunderbird, Mozilla, and Eudora are excellent choices.
Do not click on e-mail attachments you were not expecting
Use one of the above mail clients and/or switch to an operating system not designed to spread viruses.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Now the scammers there's a official institute to send their fake alerts.
http://www.michel.eti.br
You mean, like US-CERT?
How funny, my wife just gave me a cool postcard yesterday and on the back it said something about an anti-virus warning service provided by the Dutch government.
Anyway, the website looks pretty good, but it's been around since 2003 and i think it didn't really catch on. They offer email alerts, sms alerts etc.
Sample this!
Completely useless and ineffective, but that's not really the point.
come come mr mod, that's not very fair to label it as troll. It's a POV on the subject. Obviously you don't know anything about Mr Blair. That's ok though there are all subjects we don't know about..
Does it respond within 45 minutes?
Slashdot: News for Nerds, Stuff that matters only to them
Although nobody knows about it, Canada has a website that posts alerts for computer security issues. You can go there and look for yourself. I'm sure many other countries have services like this. Whether or not anybody knows about it, or uses the service is another story.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Windowsland:
Today: Partly viral, chance of spyware in the evening. Run Windows Update and reboot.
Tomorrow: Unpatched viral storm expected! Leave your Internet disconnected. Run Windows Update and... ah, nevermind
Macland:
Today: Not a virus in the sky. Security update and a chance of reboot. Nothing urgent however. Jobs doppler is picking up some activity on the west coast
Tomorrow: Sunny interface, clear connections, low ping. Rumor flurries in the evening
did anyone click on that link on the comment which leads to goat.cx and found yourself staring at this:
:(
Suspended Domain
The domain www.goatse.cx has been suspended by the registry.
This is generally due to lapsed registration or violation of policies.
To renew your registration please visit your registrar.
NOW THATS NEWS..... can you picture a world without goats.cx ?
In the coming weeks we will surely see one of the parties issue an initiative against [insert tabloid internet evil du jour here] on the internet, with absolutely no technical information other than "we'll do it"... it happened last general election with children being groomed in chatrooms.
One would think that the government, rather than having to implement a program to make up for the deficiencies of a private product would start regulating that class of products. I havent' RTFA'd, but I can only imagine that the target for this program would be Windows based systems. If MS made cars and there were all these breakdowns, accidents, deaths, crashes, etc. wouldn't the government tell them to stop producing and such low quality, shoddy products? Wouldn't there be some type of regulation, like automobile safety standards?
Just a thought...
...But does it work on Linux?
in USA there is NO health care at ALL; you are pretty much on your own, so some even flawed is MUCH better than none.
Although the site claims to be XHTML 1.0 Compliant, when you parse the URL through the W3C validator, it says otherwise, with 7 markup errors. I have emailed them about this matter and currently awaiting a reply.
Weather alerts, pollution alerts, traffic alerts, tornado warnings - all those are ways to reduce damage, save lives, and make life run smoother in the face of of problems. In the internet age, viruses and such fall into a similar category, so this makes perfect sense to me.
Natural disasters aren't a result of shoddy product design. There's nothing you can do to prevent tornados and nothing you can do to stop them, so you have warning systems in place.
If there's a hairdryer that needs a recall despite UL underwriting, that's because humans are imperfect creatures and despite best efforts problems slip through. That there are truck-sized holes in IE is due to rapid time to market and ignoring industry best practices. If it happened once or twice, sure, no sweat, we'll give them a by. If it happens thousands of times over decades, it's a pattern, or as they call it in MBA school, a business method.
This is the government helping to prop up unethical business practices, not helping out on an honest mistake.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
No health care is better than bad health care. Here in Cananda we cross the border to the states and pay cash when we need something done. It's better than waiting two-three months to get your tonsils out.
The Department of Homeland Security is already doing this in the US, except they send all the alerts to ISP's instead of users. Each week I get several e-mails alerting me of IP addresses on our cable networks that have been spreading viruses or worms. It's helpful to keep viruses off of my networks, but it gets to be a pain after a while. For what it's worth, I think the UK e-mailing individual users about it won't do much to stop the problem. Chances are, if the user knows enough to remove the virus after they read the e-mail, they probably already knew enough to keep the virus off in the first place. Your casual home user that doesn't know much about computers is just going to delete the e-mail without thinking twice about it.
You're telling me! Shoddy web code for a start!
One of my pet hates (as a freelance web developer, diehard on web standards and doing things properly) is people who pretend to use XHTML, but don't actually fucking USE XHTML!
This site is written oldskool style, with a table based layout done in XHTML - completely missing the point of using XHTML to do semantic layout and CSS for visual arrangement. OK, they've used CSS, but it's to style their already laid-out-in-a-table content.
Furthermore, the site does not validate - not even close! Yet again, half the point of using XHTML is to make well-formed documents. What's the fucking point when developers don't even check their pages validate?
We've got nesting errors, invalid characters, use of attributes that don't exist in XHTML, and two closing html tags? You might have thought whoever wrote this site might have validated their code before putting it live, but the author of this page appears not to even have given it a cursory glance.
Who knows how much this site cost? I'll bet it was a considerable sum of tax money, and it hasn't even been built properly. Fucking USELESS!
When are we going to see a government site built properly, using web standards correctly? It's hardly rocket science, but these idiots in charge of our national computer security can't even use a fucking HTML validator, so is it any wonder the public are screwed?
Organic free-range music... yum!
I have a page on home computer security too!_ 0e.htm
:)
http://www.seguridaddelainformacion.com/seg
I am the king of Alcorcon! I was there first! credit me!
Options like Mozilla, Firefox, Opera, Thunderbird, Eudora, and OpenOffice.org, to name a few for starters, should at least get a mention. They work here and now, even on MS-Windows. Aren't we talking about technology where we can choose the best tool for the job or is it a religion where we all face Redmond and bleat "yaaaay Bill!" ?
By neglecting to mention better options, even those options usable by MS systems, the site does two disservices. First, it turns an otherwise good idea into a state sponsored marketing campaign for a single vendor. Second, it keeps people in the dark, preventing them from improving their existing systems or to making more informed choices in the future.
Along the same lines, further proactive effort is needed to prevent defective systems from becoming a problem in your cars, television sets, taxes, public records or health care. All ofthis makes a good illustration of why commodity services and protocols are good for the market by preventing lock in.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
It's Crown Copyright, meaning material "may be reproduced free of charge in any format or medium provided it is reproduced accurately and not used in a misleading context[...]the source of the material must be identified and the copyright status acknowledged.". Which basically means, anyone is entitled to view information.
They will probably advocate the use of ANY antivirus. But I would bet that if MS bundles their AV into the system (and you know they will), then that should be recommened because of the "ease of use" factor for most users. Given that, I would not rely strictly upon the MS offering for my AV protection.
The http://www.us-cert.gov/cas/signup.html#a "National Cyber Alert System Mailing List" looks like it does the same thing. Run by the US-CERT (Computer Emergency Readiness Team)
When it comes to computers the UK government are utterly clueless. They'll buy whatever shit Microsoft tells EDS to sell 'em them and we'll all suffer for it.
Retards the lot of 'em.
PC World store in the UK are already doing this - their instore radio service is *appears* to be sponsored by Symantec, and through the day these virus 'alerts' get honked out. OMG NEW VIRUS! BUY SYMANTEC AV!