Slashdot Mirror
UK Government Launches Virus Alert Service
Phil1 writes "The BBC is reporting that a rapid alerting service that tells home computer users about serious internet security problems is being launched by the UK government. Has this been attempted anywhere else in the world? Was it successful? And will they be plugging the Microsoft Anti-Spyware package (once it leaves beta)?"
You linked to the Anti-Spyware app... and mentioned the AV app... have they already released a beta of the AV? I know it's been purchased and in the process of rebranding... but come on!
Help Brendan pay off his student loans
UK security alert service hacked, all your personal info are belong to us!
*signs up*
Only problem with email or TXT alerts is that the sender is easily forged.
Hi, this is your government alert - please download the latest patch from http://www.alerts.gov.uk
The problem is that (apart from Slashdot users of course) that the hyperlinks are hidden, so any spammer can forge these messages to catch the unwary.
That alone would bring this thing down - it would only take a few lords or half a dozen grandmas to see goatse (or worse - gator spyware) to cause a public lack of confidence in the entire government program.
You can't expect to wield supreme executive power, just because some watery tart threw a sword at you
When will we expect the first Trojan masquerading as an update from the "IT Safe" service. The over/under is about 6 hours after the service goes live.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
But when going on the US's past programs like this, any time you get the government involved, things tend to get out of hand.
I just don't understand the need especially when symantec will do this for free.
http://jayceecorder.blogspot.com
I have to say that I am very happy with the antispyware package that they have released. It consistently finds more spyware on my girlfriend's PC than any other program I have tried.
Products such as this, and released for free, start to wash away Microsoft's evil image
Those who know, do not speak. Those who speak, do not know. ~Lao Tzu
They could come up with a color-coded "Virus Threat Advisory System". Just off the top of my head, they could use something like:
Low = Green
Guarded = Blue
Elevated = Yellow
High = Orange
Severe = Red
Who the hell knows what users should do at each of these levels, but at least they'd be using techniques that have been used in other successful alert systems.
I'm a big tall mofo.
The Dutch Government CSIRT is doing this for two years already. So you can chill out to a cool Legowelt CD and get warned when there's a new threat.
Alerts will not be issued unless users can do something to protect themselves against the threat. This might include downloading an update from an anti-virus vendor or updating software to close loopholes and fix vulnerabilities. This could also include something as simple as "don't go to X domain because it hijacks your ICQ"...
On the site: http://www.itsafe.gov.uk/ theres no check to see if you are an UK citizen.. Also theres no mention of it being for UK'ers only on the site or in the press release...
Although i migth just use the service from DK-cert or some anti virus company..
One hopes the government is better at computer viruses than their attempts on humans.
for the las 3 years. At Alerta Antivirus
If the day of the week has a Y in it, Microsoft had a security problem today.
I just saved the government (pinky to corner of mouth) 1 Billllion dollars!
Since a few years the Belgian regulatory body for postal services and telecommunication (BIPT), has a special unit that tracks and warns for (possible) virus attacks.
Sometimes you get a warning of the BIPT in the radio news or during the traffic information announcements.
http://www.bipt.be/bipt_E.htm
I do not know how they work or how they are structured, and if it helps at all, but the UK is not the first country to do this...
Now that the UK is going to spend tax payer's money to prevent problems caused by poor design by private companies, are they going to put extra tax on the purchase of vulnerable products and licenses (mostly Windows)?
I wouldn't want my tax money being spend on plugging the holes in software I don't use.
The topic asks if this has been attempted anywhere else.
Well, there is the Computer Emergency Response Team at Carnegie Mellon University, and I like their approach.
I mean, one way they respond to threats is to contact anti-virus manufacturers. From there, it's a short step patches available via subscription.
You get the deep pockets of government to maintain the watch, and the rapid response of industry when a threat's been isolated. I like that division of labor.
668: Neighbour of the Beast
Is to not be so stupid. People are always falling for these basic traps, like clicking "YES" to browser-based software installs, opening attachments like "Imamoron-funnystuff.exe" from their friends. It's like some people just completely lack a filter that allows you to prevent 99% of viruses just by not running or clicking things they don't need to.
I think it's largely in part to the Windows interface which plays down the "significance" of running and having running programs and software while on a network (the Internet, mostly).
I haven't had a single virus on my home machine since 1996, and I think I self-infected when I was trying to figure out how it worked.
And I NEVER use a real time virus scanner. I check my Windows computer when it behaves strangely, I see new processes, event viewer notices, etc. The fact is, even if you keep your virus-scanner (real time) up to date, all you're doing is *potentially* reducing the "reaction" time to the frequency of updates released by your particular vendor. Whereas with my method, I'm up to date on virus news, as well as the usual effects of them, and find solutions on an as-needed basis should I EVER become infected by one.
So. Yeah.
We are one consciousness experiencing itself subjectively. Back to you with the weather, Bob!
Snarky comments and Microsoft jokes aside (not that I don't like either), this makes perfect sense, at least on an abstract level.
Weather alerts, pollution alerts, traffic alerts, tornado warnings - all those are ways to reduce damage, save lives, and make life run smoother in the face of of problems. In the internet age, viruses and such fall into a similar category, so this makes perfect sense to me.
Also, this just increases people's awareness of inernet issues. A few years of watching virus alerts fly all over the place may make people more careful, more picky - and more demanding on certain software vendors.
Now where I WILL bet a bit cynical is if this is A) done right and B) can be done right elsewhere. I'm sure it can be done right, but the "if" is anoter question.
Still, hey, go for it UK Government.
"The Sage treasures Unity and measures all things by it" - Lao Tzu
I wonder what the frequency of choosing the words "ITsafe" or "virus" or "warning" or "alert" would be by people signing up? 50%+?
We are one consciousness experiencing itself subjectively. Back to you with the weather, Bob!
There's an election coming up, so it looks to me like another useless publicity stunt. I'm sure the web site will be left to wither once it's been reported in all the newspapers that the government is keeping us safe from "cyber-terrorism".
Why, just last night I got a bunch of helpful popup windows alerting me that "we have detected that your computer may be infected with spyware or a virus." There was also a button that I could click to download software that would fix it. Sounds like we're way ahead of the game, so chew on that for a while, U.K.!
Evil is the money of root.
Heard they are considering not releaseing it.
If they charge money for it, their makeing the industry rely on their buggy software, and then instead of fixing the software sell you "protection", sound familiar?
If they give it away, will be seen as anti competitive with all the very big business anti virus software manufacturers out there.
...
The UK scheme appears to be based around emailing users about security problems.
Because obviously, if you receive an email giving you security advice, its guaranteed to be up-to-date, accurate, authoratative and with excellent step-by-step instructions on how to +++ATH0 NO CARRIER
Andrew Oakley - www.aoakley.com
"The government estimates it will issue security alerts about six to 10 times a year"
"Those signing up will only be told about the most serious security threats that have the potential to affect millions of people."
This sounds like a particularly ineffectual and pointless exercise. This level of virus information could be picked up from doing nothing more than watching BBC news or reading their site during the year. Further, it makes you wonder if the whole project will be run by a single guy who's job description has just been extended to include 'watch BBC news programs then forward email warnings to UK PC owning in-duh-viduals'.
However, it is also an extremely cheap way of getting +ve headlines (even Reg refers to it as an 'initiative'). I guess each government department has been told to come up with crap like this because we're in the run up to a general election.
Plus the advice summary is bullshit:
Install anti-virus software
That's corrective action. How about prevenaitive action like pointing out secure products and warning the public to avoid defective ones? An ounce of prevention is worth a pound of cure.
Keep your anti-virus software up to date
You can't patch fast enough. That includes so called anti-virus software. Someone has to get hit first. AV companies have to then react and update the AV software profile. Then users have to add the updated profile, over a modem that can take time. MS-Slammer reached saturation in 8.5 minutes.
Install a personal firewall
Web pages and e-mail go right through that fire wall, they're supposed to, so do outgoing connections usually. Unfortunately most MS malware comes in via MSIE (the web) or MS-Outlook (mail), so how exactly is a firewall going to help? How about swapping out vulnerable applications and services instead?
Use Windows updates to patch security holes
There are other systems besides MS-Windows. Currently these do not even get viruses or worms. Some of these (e.g. Ubuntu) are easy to install and work on existing x86 hardware. Macintoshes are low maintenance and work out of the box. Unless you're a heavy gamer, you don't need MS-Windows.
Do not open e-mail messages that look suspicious
A virus is only harmless data, unless your system is designed to run it on sight. How about choosing an e-mail client that's not designed to spread viruses. Thunderbird, Mozilla, and Eudora are excellent choices.
Do not click on e-mail attachments you were not expecting
Use one of the above mail clients and/or switch to an operating system not designed to spread viruses.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
You mean, like US-CERT?
Completely useless and ineffective, but that's not really the point.
Does it respond within 45 minutes?
Slashdot: News for Nerds, Stuff that matters only to them
Options like Mozilla, Firefox, Opera, Thunderbird, Eudora, and OpenOffice.org, to name a few for starters, should at least get a mention. They work here and now, even on MS-Windows. Aren't we talking about technology where we can choose the best tool for the job or is it a religion where we all face Redmond and bleat "yaaaay Bill!" ?
By neglecting to mention better options, even those options usable by MS systems, the site does two disservices. First, it turns an otherwise good idea into a state sponsored marketing campaign for a single vendor. Second, it keeps people in the dark, preventing them from improving their existing systems or to making more informed choices in the future.
Along the same lines, further proactive effort is needed to prevent defective systems from becoming a problem in your cars, television sets, taxes, public records or health care. All ofthis makes a good illustration of why commodity services and protocols are good for the market by preventing lock in.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.