Fake Microsoft Patch Triggers Virus Attack

boarder8925 writes "eWeek reports: 'Like day follows night, a bogus cumulative update with a malicious attachment has followed Microsoft's patch day. In what has become a monthly staple, virus writers are taking advantage of the heightened public interest around Microsoft's patching cycle to trick users into executing a malicious attachment. The latest social engineering trick arrives via e-mail with an attachment that purports to be a 'cumulative patch' for May 2005.'"

Comments

Well...

[Kinky Bass Junk]

... at least that's what they tell us. But we all know that it actually was a cummulatice update, but they screwed it up.

Re:Well...

[Anonymous Coward]

dude Read The Fucking Headline..

virus writers are taking advantage of the heightened public interest around Microsoft's patching cycle to trick users into executing a malicious attachment .. this means that microsofts update didn't actually cause the harm itself directly, but dickheads who spread that stuff pretended to be microsofts update...

and as for TFA..
Fake Microsoft Patch Triggers Virus Attack
is the headline.

-SJ53

Re:Well...

[Anonymous Coward]

WTF is this modded insightful?

Re:Well...

[Anonymous Coward]

If you fall for this type of attack, then YOU are a fucking moron! And why the fuck are the admins allowing such stupid shit onto this site. Its not worth reading about.

Re:Well...

[RealityGone]

then don't read about it... i, personally, found it mildly amusing and kind of interesting.

Re:Well...

[PsychicX]

Porn dialers inside! See hot girl on girl action! Also includes all Microsoft virus updates! Keep your computer safe, with hot girl on girl action!

Re:Well...

[Anonymous Coward]

> Keep your computer safe, with hot girl on girl action!

Well, y'know, I have been looking for a way to motivate my users to keep their computers updated...

This is why the "double standard"

[Anonymous Coward]

This is why when there's a security flaw in Firefox or the Mac people come out to say "thank gosh it was dealt with quickly, as usual."

The situation with microsoft has reached a certain critical mass where there is no public awareness of an objective security reality.

Here there be dragons. Beware.

Undoubtedly a dozen comments will say something like "If users would just follow a few simple rules..." What is the trusted source for those simple rules now that the situation is so out of hand?

Dark days indeed.

Re:This is why the "double standard"

[Anonymous Coward]

The simple rule is to know what you're doing, or, if you don't know what you're doing, have it done by someone you trust. People don't start working on their cars unless they know what they're doing. They have the maintenance done by a mechanic or an experienced friend. Yet somehow we think that computer maintenance should be done by complete ignorants. It's never going to work.

Re:This is why the "double standard"

[Smidge204]

What is the trusted source for those simple rules now that the situation is so out of hand?

How about http://www.microsoft.com/ instead of your e-mail's inbox?
=Smidge=

Re:This is why the "double standard"

[Anonymous Coward]

"Undoubtedly a dozen comments will say something like "If users would just follow a few simple rules..." What is the trusted source for those simple rules now that the situation is so out of hand?"

How is this insightful? NOT installing/running email attachments, epecially ones that admit they muck with your OS, is a good "simple" rule for any OS. I hardly see how MS is to blame for this one.

If you think MS would rely on thrid parties to send email attachments to provide security updates, you are more clueless than the n00bs using M$.

Re:This is why the "double standard"

[Anonymous Coward]

"Undoubtedly a dozen comments will say something like "If users would just follow a few simple rules..." What is the trusted source for those simple rules now that the situation is so out of hand?"

How is this out of hand? Turn on Windows Update and forget about it. This might have been news if someone had found a way to exploit Windows Update and triggered it to install a virus. This is just another 'click me!' e-mail virus.

Re:This is why the "double standard"

[Anonymous Coward]

"How is this insightful? NOT installing/running email attachments, epecially ones that admit they muck with your OS, is a good "simple" rule for any OS. I hardly see how MS is to blame for this one.

If you think MS would rely on thrid parties to send email attachments to provide security updates, you are more clueless than the n00bs using M$."

Oh yes. Absolutely. As long as you first understand the concepts "attachments", "running vs viewing," "OS," "security updates."

No, Microsoft would not send updates via e-mail, but to an ordinary user, the internet is all one thing. They know e-mail can have viruses, but they also know that websites can have viruses.

It's like the current situation with genital warts. There's no point worrying about whether your partner has HPV. If they aren't a virgin, the answer is yes. You just keep a watch for visible warts.

That's called an epidemic, when no reasonable precautions can be put in place for the entire populace, and the disease has to just run its course. This is an epidemic. There is no way to educate the populace anymore... every way they could get updates is suspect *except* Windows Update. A DNS hijacker installed via ActiveX could easily redirect www.microsoft.com.

So where do users find out that Windows Update is the only safe way? How do they know this is the truth? It's like an atheist trying to pick a religion. Seven sets of ideals, incompatible, and none falsifiable except by dying.

Re:This is why the "double standard"

[peragrin]

>>How is this out of hand? Turn on Windows Update and forget about it. This might have been news if someone had found a way to exploit Windows Update and triggered it to install a virus. This is just another 'click me!' e-mail virus.
What and let it trash your system because MSFT missed a QA test?

Nope not gonna happen. heck i don't even let Apple Auto update. Sure they can send notifactions but I wait at least a week before appling patches. That way losers like you can beta test for me.

Re:This is why the "double standard"

[Haydn Fenton]

Exactly. I'm all for Microsoft bashing, but come on, if users are stupid enough to fall for this kind of thing then you can't really blame Microsoft.

Sure, more frequent updates would be nice, but most users won't bother downloading them anyway. The main reason we have so many pieces of spyware, viruses and other shite going around the internet is user stupidity.
I don't download updates very often (mainly because I'm on 56k, but still), I have a working firewall and an out of date AV program, but for around a year I didn't have either and the only crap I got installed on my PC was through worms which couldn't really be avoided.

Sometimes my little brothers come on the PC, visit a few websites, and when I come back the PC is infested with crap, even with the AV and firewall.

Bottom line: Patches, Antivirus and Firewall software undoubtely helps, but is users aren't going to wise up, we're all still fucked.

Re:This is why the "double standard"

[tomhudson]

This isn't even news, never mind "News for Nerds." This is OLD.

Anyone falling for it deserves what they get. Hopefully, they will become so overloaded with crap their computers will commit suicide in shame ... oh, wait, they're running Windows, they can't get any lower than that ...

only crap I got installed on my PC was through worms which couldn't really be avoided.

Bwhahahaha. Oops, sorry, just had to laugh, 'cus it IS funny.

Re:This is why the "double standard"

[bigman2003]

Good point...

BUT, I work in a small IT department- and we spend about 1/2 of our weekly meeting talking about how 'stupid' these users are.

Not saying that I don't take part in the conversation...but I keep thinking to myself, "They aren't supposed to know this stuff, it isn't their job, it's OUR job."

I really hate it when we get on our high-horses and look down at people because they don't know as much about the computer they use as we do. I would hope not, otherwise we would be some weak-ass IT people.

I'm guilty to, and every IT person I have ever met is just as guilty. But when we need to purchase something, we walk over to the purchasing people and say 'I have no idea what I am doing, but I need to order this thing...' I wonder if when we leave, they all start laughing at us and call us a 'bunch of fucking idiots.'

I hope so...because we have some real arrogant bastards in IT who really need to realize that nobody else really gives a damn about the difference between right-click and left click...

Re:This is why the "double standard"

[ArsenneLupin]

If you think MS would rely on thrid parties to send email attachments to provide security updates, you are more clueless than the n00bs using M$.

Unfortunately, it has happened before that businesses who should have known better (such as banks, stock brokers and auction houses, ...), have subcontracted out security-critical mailings to third parties.

With the predictable result that concerned customers phoned tech support, were told "don't worry, these guys were indeed hired by us", and then fell for a phishing scam next month...

comp.risks is full of stories like that.

Re:This is why the "double standard"

[tomhudson]

Hey, normally-right-minded people ARE idiots, when they get behind a computer keyboard. Look what I got LAST WEEK. This was old (and lame) back in the '90s:

This thing is for real. Rest assured AOL and Intel will follow through with their promises for fear of facing a multimillion-dollar class action suit similar to the one filed by PepsiCo against General Electric not too long ago.

Dear Friends; Please do not take this for a junk letter. Bill Gates sharing his fortune. If you ignore this, You will repent later. Microsoft and AOL are now the largest Internet companies and in an effort to make sure that Internet Explorer remains the most widely used program, Microsoft and AOL are running an e-mail beta test.

When you forward this e-mail to friends, Microsoft can and will track it ( If you are a Microsoft Windows user) For a two weeks time period.

For every person that you forward this e-mail to, Microsoft will pay you $245.00 For every person that you sent it to that forwards it on, Microsoft will pay you $243.00 and for every third person that receives it, You will be paid $241.00. Within two weeks, Microsoft will contact you for your address and then send you a check.

It was hard explaining to the person who sent it to me that she wasn't going to make thousands of dollars (even with all the linkes to snopes, etc). She still wanted to know if perhaps it might be real this time.

I forgot to ask her if she responded to any of those offers to help people launder their $20,000,000 from Nigeria.

Re:This is why the "double standard"

[Blkdeath]

The simple rule is to know what you're doing, or, if you don't know what you're doing, have it done by someone you trust. People don't start working on their cars unless they know what they're doing.

Conversely, many people start working on cars to learn how to do it.

Re:This is why the "double standard"

[Photon Ghoul]

Exactly. The sales guy should NOT have to worry about how to patch his OS, deal with virii, etc.

Put the users on a locked-down *nix machine with alternative browsers and (especially) email clients. Not the ultimate solution, perhaps, but it's got to be better than dealing with virus, trojan and spyware problems.
--
Random Signature #1
Generated by SlashdotRndSig via GreaseMonkey

Re:This is why the "double standard"

[bsander]

Yeah, but not when they need that car the next morning to get to work. They usualy just get a piece of junk to toy with.

Re:This is why the "double standard"

[IoN_PuLse]

I don't agree, users aren't (always) stupid, they are either uninformed or ignorant. They should give a damn about the difference between right click and left click. Especially if using the computer is part of their job! People have to learn about cars and how to drive them if they are used in their job, why expect less for computer users?

Re:This is why the "double standard"

[Blkdeath]

Yeah, but not when they need that car the next morning to get to work. They usualy just get a piece of junk to toy with.

To steer back towards the topic; how many home computers are vital to a person's livelyhood? How many of us learned much of our IT skills by breaking and subsequently fixing our own (read: our parents') home PCs?

Re:This is why the "double standard"

[Anonymous Coward]

A few simple rules to computer security.

1. Concrete is secure, make sure your case is full of concrete.. Concrete makes an excelent firewall, so be wure to fill in all those nasta data ports with an extra thick coat or portland cement.

2. now that your computer is fairly well protected, we're ready to make sure it's even safer, proceed to dig a pit 6' deep, bury your pc, and fill the pit woth more portland cement. Now not even the best crackers can penetrate your security, so you know it's really safe.

3. continually monitor your Pc for would be criminals with jackhammers, because as secure as concrete is, everything is vulnerable to brute force...

Re:This is why the "double standard"

[wilsoncd1999]

I call the arrogance of which you speak "IT Syndrome". It seems to be an epidemic in the industry.

Re:This is why the "double standard"

[Pedrito]

people come out to say "thank gosh it was...

I know nobody that says "thank gosh!" Who is gosh and why would you thank him/her/it?

Re:This is why the "double standard"

[Filip22012005]

Similarly, I'm always a bit annoyed by people on Slashdot calling the less computer-savvy "Joe Luser". Come on! Here's a guy that didn't spend all of his friday nights behind his computer, and as a result has some difficulty with badly designed software. Why call him a Loser?

Re:This is why the "double standard"

[DeadChobi]

Actually, I used to get spoof security patches from Microsoft.com about two years ago. It stopped happening when the spammer realised I wasnt clicking on any links. It really is old.

Re:This is why the "double standard"

[cbiltcliffe]

I realize /.'s moderation selections aren't the greatest, but it really must be said:

That comment wasn't so much "Insightful", as "Duuh. No shit!"

Re:This is why the "double standard"

[numbski]

Just thought of this.

What about writing a worm (apparently this isn't so hard...) that runs a VB Script when the message is viewed. When the script runs, it adds an entry to the hosts file:

ip.of.some.evil.server www.windowsupdate.com

The message?

From: $Your IT Administrator

(Determine this variable by looking in the address book for those with domain admin privs, pick one at random)

Looks like there was a pretty important security update that came out last night. Please go to the Windows Update site and run it. Thanks!

http://www.windowsupdate.com/

Make it look believable. Heh.

Re:This is why the "double standard"

[bigman2003]

Because many of the users are only using their computer to complete a task that is part of their bigger job.

When I photocopy a set of manuals (that I wrote, just in case you were concerned with copyright...) in order to give a presentation, I put the paper in the copier and press 'start'.

If it doesn't work the way it should, I take the originals out of the machine, and find a different copier that will work for me.

I don't try to figure out what is wrong with the copier...or how to make booklets, instead of just stapled stuff. Or how to even print from my computer. Because I just don't care. I have enough stuff to think about that the copier should be something that doesn't require any thought at all.

90% of the workforce feels the same way about their computer. We have people who are paid to edit books...and they know how to use all the advanced features in Microsoft Word far better than I would ever even dream of. But the moment there is a problem with their e-mail...they are lost.

That's okay...because I can't punctuate correctly to save my life. But boy, I can make sure the e-mail server is functioning...

Re:This is why the "double standard"

[MerlinTheWizard]

What should I say? "Lol", maybe. The ultimate fact is that Microsoft is never going to send anyone any patch via e-mail. Period. So anyone should know this is not the "real thing". The concern here is not with MS, it's with people not even knowing the tools they are using, as well as some basic good sense. Most often, they won't even have figured that the e-mail address they got this from, they never gave it to MS to begin with. But hey, what the heck. That would ask of them to actually use their brain...

Re:This is why the "double standard"

[Anonymous Coward]

http://spl.haxial.net/viruses.html

Re:This is why the "double standard"

[Gendibal]

Hmm. I'm a Systems Accountant, and I've worked in several companies (some quite large) where I (and a number of other users) knew more than the "IT" dept! My wife's company for example had some IT staff who didn't know about the "stop -a" command to enable a blaster worm infected laptop to download the Blaster worm patch! They knew where the patch could be downloaded from but not how to stop the worm shutting the machine down! I had to tell the person whose machine was infected how to do it, and I don't work for the company!

Re:This is why the "double standard"

[Dolda2000]

Another interesting implication of that analogy is that people usually don't just get into a car for the first time in his or her life and expect to be able to drive -- they go through rigorous training to get a driver's license first.

This is unlike computers, where O/S manufacturers like Microsoft more or less design the O/S so that people are to be able to use the computer the first time they see it. At least last I looked, that was one of their mission statements.

Imagine if car dealers had similar mission statements -- "People should be able to use our cars immediately, even if they've even been in a driver's seat before" -- how many more traffic accidents there would be.

Maybe there should be a nationally standardized education that corresponds to something like a "computer user's license". Of course, unlike cars, it shouldn't be mandatory just in order to use a computer, but it could be a good idea for ISPs and prospective bosses to check for it.

Re:This is why the "double standard"

[Jedi Alec]

BUT, I work in a small IT department- and we spend about 1/2 of our weekly meeting talking about how 'stupid' these users are.

My personal guideline is as follows: any IT specialist, whatever his or her expertise may be, that cannot differentiate between "being stupid" and "not knowing much about computers" needs to be kept as far away from actual users as possible.

I don't know why, but for some reason IT workers consider themselves as really special, as opposed to what they really are, the people that provide the tools for others to do their work with. Yes, a blacksmith that makes good hammers so a carpenter can build houses might be a skilled craftsman, but so is said carpenter. Someone who writes and maintains an applicatian to control finances isn't any more special than the accountant who uses it to actually control said finances.

Re:This is why the "double standard"

[Tim Browse]

When the script runs, it adds an entry to the hosts file:

And if you're running the MS Anti-Spyware software, you'll immediately get a nice popup telling you that someone just added an entry to the host file, and do you want to allow it?

Of course, some people still might click OK.

Hmm...wonder if MS Anti-Spyware makes more of a fuss if it notices a MS website/update site being changed/spoofed like that.

Oh, apparently not. However, the generic alert does tell you to block the change if you didn't just edit your host file manually.

Re:This is why the "double standard"

[sylvester]

Not saying that I don't take part in the conversation...but I keep thinking to myself, "They aren't supposed to know this stuff, it isn't their job, it's OUR job."

then get a fucking spine and say that.

it's not hard to be principled.

-Rob

Re:This is why the "double standard"

[MonkeyOfRage]

Why call him a Loser?

Because he drags shortcuts to all of his documents onto a floppy, and calls from home when he can't open them. He calls you to his cubicle to fix his printer - by putting paper in it. He's angry that he can't dial in with his laptop, although he hasn't yet tried connecting a phone line to the modem. He wants to know if you could come to his house to "look at his internets". He recommends that you diagnose by "jiggling some wires or something".

There just comes a point when the case is made beyond a reasonable doubt. Why ask why?

Re:This is why the "double standard"

[peachpuff]

I don't have a problem with users not knowing things. I can just tell them, and if that doesn't work, the system should be changed so that they're not the ones in charge of it. Patches, for example, should probably be handled by the IT department, not the user.

I don't even have a problem with genuinely stupid users. Genuinely stupid people usually know their limits and stay carefully within them.

What pisses me off are people who turn off their brain because someone else is paid to take care of the computers. Their attitude is, "Why should I use my brain when someone else is paid for that? I'll just believe that this e-mail comes from Bill Gates, click 'OK' without looking at the other words in front of it, mail my password to everyone, etc."

Re:This is why the "double standard"

[Anonymous Coward]

Don't feed the trolls you motherfucking moron.

Re:This is why the "double standard"

[Anonymous Coward]

It's one of the minor Elder Gods. Gosh the Cthonian.
Anybody who is "thank goshing" is actually a nihilist in disguise!
Stay at least 10 feet away and contact your nearest animal control officer.

Thanks!

"Vote Cthulu. Why settle for the LESSER evil?"

Re:This is why the "double standard"

[Mancat]

Don't let them log in as an Administrator-level user?

Re:This is why the "double standard"

[belarm314]

I also work in a small IT department, and we, of course, are guilty of this sort of bitching and moaning...behind closed doors. Some of our users are guilty of genuinely stupid mistakes stemming from them screwing with something they don't understand (which justifies us being a bit frustrated, IMHO), but sometimes we just get really tired of no one bothering to try and understand how their computer works.

That said, however, we never refuse service just because some one screwed their machine up themselves, or forgot to patch, or disabled their virus scanner, or what have you. Instead, we take their call, log a ticket, hang up, turn around, tell our coworkers about how tired we are of dealing with PhDs who don't know how to check their email...and then go fix the problem with a professional attitude. Sometimes you just need to vent, especially in a job where expectations are high and rewards are very low. We get it out of our system by talking to people who understand, then we move on. It's the best therapy most of us can afford :-)

Re:This is why the "double standard"

[Anonymous Coward]

Because a) Outlook no longer runs attached scripts without a prompt (I believe) and b) the advice about going to www.microsoft.com is, in a sense, wrong; what users *should* do is run the Windows Update utility from the "Start" menu, which uses digital signatures to make sure updates are coming from the right places (incidentally, this is a feature that is, sadly, lacking in at least a handful of popular open source package managers).

MS has done everything I can think of, though perhaps you can make a suggestion or two, with respect to securely distributing updates. The issue is just that it doesn't really matter if the technology works, because users don't always understand how it should work (view the recent thread on Full Disclosure in which some jackass reports a "vulnerability" in Outlook with which he is able to create links that point to one target but display another--go figure, every web browser on earth is vulnerable to this!).

Re:This is why the "double standard"

[Anonymous Coward]

There is nothing wrong with learning by doing, if you don't do it where it can hurt other people and, more importantly, if you are willing and able to learn. People regularly do things to their computers which they don't understand and don't want to understand. That's the root of many problems, and not just theirs.

Re:This is why the "double standard"

[bani]

They are stupid though.

We instruct them dont open these attachments in weekly meetings.

We circulate memos telling them dont open these attachments.

We tell them in person face to face dont open these attachments.

So what do they do?

They open those attachments anyway.

Then when their computer goes to shit, "oops, guess I shouldnt have opened that attachment, huh?"

I don't know any other way to describe these users except "stupid". If you know a better word for the above, please let me know.

Re:This is why the "double standard"

[quarkscat]

Oh, sure the link to MSFT works now, but what is going to happen with all the "average" PC users when MSFT switches to a profit center, subscription-based viri signature and security update policy? Methinks that they will be even more inclined to seek security relief from whoever offers it for free, instead of MSFT.

It will be a relatively small number of users that will go out of their way to subscribe to MSFT's up-and-coming for fee updates -- if it isn't bundled into the cost of the computer when purchased, it will not happen. ISPs aligned with MSFT might bundle it as part of their service agreement, but that will drive those internet costs higher.

MSFT will not be selling these "average" PC users a new perennially late "Longhorn solution" unless it's bundled with new hardware. People still happy with their Win95 or Win98 computers will not be rushing out to buy not only new hardware, but also all-new software versions that will actually run on Longhorn. The difference in hardware requirements for the new OS will utterly amaze these users, and when they find out that they are no longer able to perform the same types of activities on their new computers (due to DRM) that they used to, they will revolt.

MSFT has been trying to plug the gaps in their revenue stream with new "differently enabled" versions of WinXP, so the pressure to switch to a subscription-based security update model is compelling. Many users will not comply. And so the prospects of even more zombiefied computers on the internet is a likelihood.

Cynical observers (and I count myself as one) of the borg-like nature of MSFT wonder if the overall strategy of MSFT is to destroy that (the internet) which they cannot utterly dominate. The combination of the abject failure of MSFT to actually fix their security vulnerabilities (rather than the marketing BS it is now) and their
inexorable greed for the largest possible revenue stream would seem to fit that (ultimate) goal. Taken along with their continued aggregation of software IP patents for code that is so obviously based upon "prior art", MSFT appears to be on-course to turn the internet into MSN. Of course, Netcraft has not yet confirmed that the internet is dead, but given enough time and MSFT's monetary (and by extension, political) resources, it may be inevitable.

Re:This is why the "double standard"

[Anonymous Coward]

i am not a mechanic but i know im supposed to change my oil every 3k miles and put only the right octane fuel in my car. i also know that when my tire looks flat, i either put more air in or get the tire replaced. i also know not to take a screw driver and remove my own airbag. why? because these are basic things any driver needs to know. with computers, there are some basic skills that everyone needs to know and safe computing habits are quickly becoming a basic skill (or at least a necesary skill). So IMO the arguement that 'its our job to know these things, not theirs' is quickly becoming invalid. itll take time for these ideas to sink into the average click-happy user, but then again no one learned to drive right after the first car was built.

Only the stupid...

[Anonymous Coward]

Who would fall for this? It would be like taking random "prescription medicine" which comes through the mail.

Re:Only the stupid...

[Anonymous Coward]

Oops!

heh

[Anonymous Coward]

This story is great proof of my increasingly firm opinion that the open-source
movement would be absolutely dead if free mental healthcare was available
to all who needed it...

first

[Anonymous Coward]

fp! woo!

2 Words

[inKubus]

Nitrous nitrous Oxide oxide

Re:2 Words

[inKubus]

How is that off topic? C'mon moderators moderators. No one gets the joke.. *sigh*

The test only took 15 minutes for me...

Oh well, don't beat yourselves up, it's not worth stressing out over. I'm just smarter than you.

Re:2 Words

[idonthack]

How is that off topic? ... No one gets the joke.. *sigh*


If it seems like nonsense to a mod, it goes down. So.... I'm confused too.

Re:2 Words

[Anonymous Coward]

You need to stop talking to yourself, it makes you look crazy.

How is this news?

[shyampandit]

I wonder how slashdot posts stuff like this, which is very common thing, that has been done numerous times.

Social Engineering is getting to be an easier way for the script kiddes to get more victims, as more people put SP,2 which has the firewall enabled by default and so the usual attacks dont work.

Re:How is this news?

[bogaboga]

Mod parent down -- "Redundant."

Re:How is this news?

[Anonymous Coward]

Most of these originate from the US, says alot about their society values.

Re:How is this news?

[soloport]

No, this is probably new. You may be forgetting one minor subtlety of previous announcements, look closer: "Genuine Microsoft Patch Triggers Virus Attack"

Re:How is this news?

[baadger]

Social Engineering => Stupidity Exploitation => Slashdot Entertainment

Re:How is this news?

[tomhudson]

No, you should look closer. Like too many slashdot stories lately, the headline isn't exactly what one would call a model for journalistic accuracy.

1. It wasn't a virus (it was a trojan in an email attachment, claiming to be a copy of the patch)
2. It wasn't from Microsoft
3. Its release wasn't triggered by Microsoft releasing a genuine patch. Check your spam filters - I'm sure most of us receive these "cumulative Microsoft patches" on a regular basis.

Re:How is this news?

[bcmm]

This is GOOD! If it isn't worth anyone's while to make proper attacks, we don't need to bother with securing anything! We just avoid doing stupid things like we always did. All we need is to make sure that there are always enough stupid users that the script kiddies continue to launch only social engineering attacks.

So, all sysadmin /.ers reading this, keep your users stupid. It's in everyone's best interests (except your user's, obviously). If you teach them not to open attachments, you will soon be having to protect your own machine against proper cracking attempts.

Re:How is this news?

[FidelCatsro]

Looks to be an excelent piece of tabloid journalism...
Tabloids can turn "Man saves two from burning building " into " Man breaks into house and abducts residents"

DXM and Pseudoephedrine

[Kinky Bass Junk]

Sad thing is, I know many people that would jump on the chance of getting free prescription medicine, just for the chance that it has DXM or Pseudoephedrine in it. Sad sad world.

Talk about double standards

[Anonymous Coward]

I started (or attempted to start) using Linux a few years back when I started university, just out of plain curiosity. My buddy and I downloaded the ISO images of Red Hat Linux 8.0, and from that point forward, it all went to shit.

I figured it would be no problem, I used Sun's Solaris quite a bit so I understood the shell at least. Install went well, even though I was confused why I needed seven million partitions which I had to allocate manually and to have a root password since it was a single user machine. After my install, I restarted my machine, saw a bunch of ugly crap being spewed to the screen, and before you knew it, X Windows loaded up and I was in Linux. "Ooh, this looks neat, just like Windows. Let's see if I can surf the web!"

This is the point where I discovered the 'magic' of Linux. It couldn't find a driver for a simple ethernet card. So I got onto another computer running Windows, and found some type of driver for it. All right, I'll just burn it to a cd, pop it onto the Linux machine, and we're good to go. I started looking around for the CD ROM icon...where was it? Apparently I had to mount it manually, luckily I know UNIX. Then it asks me for root password. Okay, so I enter it. Then I can see the CD ROM, great. Oh look, the driver is in the form of source code, I have to compile it. So I tried to compile it with the configure script that came along. Oh wait, I need some !@#$ing stupid C library. All right, so I download that as well in the form of a RPM, which luckily worked, and then I was able to compile the driver.

Okay now what? According to the instructions, I had to recompile the kernel making the driver a part of it. 'Recompile the kernel?' I thought, 'What kind of sick operating system makes you recompile its kernel...' Apparently I didn't know what kind of twisted people designed Linux. Oh wait, it wants the stupid root password again...good God. So after about 5 hours, I had Internet...given that I knew how to use a UNIX machine. Four days later I tried installing something else, it asked me for the same stupid C library but version 1.2.3.4.5 instead of the version I had...God forbid...1.2.3.4.4 (oh what a fool I was for not updating every 10 minutes!) Within an hour, my drive was formatted (twice out of spite) and running Windows XP.

A few months back I was inspired again to run Linux. If you read the tech news, there's no doubt about it, it's taking over the server market. A Linux sys admin will make 20 grand more than a Windows sys admin (Makes you wonder if 20 grand is worth eventual suicide), so I felt I should pick it up. Of course now I was more prepared, I've read books, admin guides, worked as a student UNIX operator, 3 years under my belt as a computer science student, two internships, and had studied the Linux kernel in depth.

I decided I would try a whole bunch of distributions, I tried Red Hat 9, Fedora Core 2, SuSe 9.1, Debian, and Mandrake 10. All special in there own little way...like retarded children. As soon as SuSe loaded up, I was like..."nice nice, very sleek...", then a hissing came out my left speaker that wouldn't go away. Nice autodetection for the sound driver. Bye bye SuSe. All right, let's try Red Hat 9...oh look Red Hat won't give any more automatic updates because now that it has a little bit of money...!@#$ open source, let's become the next Microsoft! Oh Debian and Mandrake, just plain ugly and slow.

What about Fedora Core, Red Hat's latest method of getting code for free rather than having to pay programmers in India $0.85 an hour to do it. Why pay someone when you can have some idiot from GNU or some grad student do it for free, then sell it for 400 bucks a pop. It was surprising though that that experimental piece of crap worked better than all the other distributions, even though its autoupdate some how corrupted my kernel and I had to overwrite it.

But what I find most stupid is the philosophy behind it. Why make something so complex for free? I'm an excellent software engineer, good software is ha

Re:Talk about double standards

[GomezAdams]

Nice Microsoft troll job and rant over GNU and FOSS. What a maroon. My pre-teen duaghter installed Suse Linux 9 dot something for her science project (me watching but no guidance other than to answer a couple of questions) and ran it without any problems. Set up her own Gnome desktop with girly fonts and Hello Kitty wallpaper with no help whatsoever. Surprised the hell out of me walking by and seeing all the eye candy she set up Are you not at least as smart as an 11 year old girl? Me thinks not. From the description of your woes you were probably trying to install the operating system onto your microwave oven. In short you shouldn't even own a computer. Go back to paper dolls and jacks. Technology will be forever beyond your ability to grok.

Re:Talk about double standards

[DeadChobi]

Totally see what you're getting at. I'm pretty good with computers, but I have no idea where the fuck to start in a fresh Linux install. Hell, my brother tried configuring it, but we couldnt get it to mount my hard drives. The system is pretty unintelligable if you're not already a CS student, IMO.

And, about people suggesting that their child is smarter than us for being able to do it, they arent migrating from an OS they've spent 10 of their 19 years getting accustomed to. Yeah, OSS is kind of a nice idea, but if you're going to call those of us without hours to spend configuring drivers and compiling everything idiots because your child can do it, you're living in a dream world. Yeah, in an ideal world everyone would have loads of time to learn how to write their own drivers, but not many people actually want to spend time doing so.

Tell me, if you need to start your car, do you hop out and start cranking it, connect all the electrical equipment, prod the battery for a bit, and start it that way, or do you just expect it to start at the turn of a key?

I can tell you that those of us who run Windoze as a choice do it because it's easy, and it just works without a lot of hard work going into installing and recompiling everything. When you get Linux to do the same, then maybe we'll look at it as a viable solution. But until then, even with all the security holes, I'm sticking with the monoculture. At least with the monoculture I know what I'm doing.

Re:Talk about double standards

[Anonymous Coward]

You are sticking with the OS you know because you feel it is hard to learn another...... is about what I'm reading.

That's so ....... well, are you really that down on yourself?

I started out using fortran on a shared pdp-8, I finally was able to buy my own computer sometime later when they became affordable.

That was a Timex/Sinclair-1000 that ran basic.

From there it was a series of C-64, C-128 with CPM,a few Amigas, a few Macs, and finally a few Wintels.... and a bit of Linux.

I've gone from Fortran/Basic through Cli/GUI-Amiga and one to later Windows/Macs. I've probably used well over 30 different OS versions through that.

I happen to think that they all work about the same.

Sure there are some features on some that aren't in others, and some are faster and more compact than some.

I would have to say that if anyone can operate and tune a version or two of Windows, that same person would find it to be easier to use one of the more stable and controllable OS's like Linux or Mac-OS.

I'm currently operating with the latest Mac and the latest W2000 OS's, [I consider XP to just be a bunch of cycle-sucking extras tacked onto the core of W2000].

My computers are not just stock boxes and I am quite pleased that it took abut 18 months of constant change and maintaining before that new system finally blew it's Windows-OS......

But I finally got the last bit of hardware to ensure that the next time that happens, the system can be restored in about five minutes by replacing the OS and leaving the rest of the system in place, intact.......

Let me just wrap up by expressing my opinion that Windows is so difficult to keep running without it destroying itself that any experienced Windows user would find it simple to move to, and skillfully use, one of the more stable platforms.

If you can use Windows, repair it, and customize it now; you'll have no problems moving to and very quickly mastering one of the less troublesome platforms or OS's.

Re:Talk about double standards

[BungoMan85]

Fortunately my experience with *nix hasn't been that frustrating. However, from just trying to install software on a Solaris box I can tell you, I don't like it one bit. When I install software, I don't want to have to manually copy files and go in and edit config files myself. If this was 1980 I wouldn't mind. In Windows I can install your average piece of software in about as long as it takes for the installer program (something I have not found for any bit of software I've installed on *nix) to copy some files and update the registry. On *nix I have to spend an hour reading the goddamn installation instructions of every new piece of software, sometimes having to compile the damn thing myself. Unix may be rock solid, and Windows may be full of security holes, but at least I can get a Windows install along with all my favorite programs up and running in an hour or two (depending on the speed of the machine) and trash it and start fresh with ease if need be (something I've only had to do once for mtself in 10 years to be honest).

Re:Talk about double standards

[B2382F29]

WTF are you smoking?

On *nix I have to spend an hour reading the goddamn installation instructions of every new piece of software, sometimes having to compile the damn thing myself.

What about using the packages for the distro of you choice? I prefer a package manager to a stupid "Install Program" for every package. Complaining about having to compile it yourself is so stupid that it isn't even funny.

Re:Talk about double standards

[GomezAdams]

Configuring and compiling what??? It just ran right out of the box and the only help I gave was to set up the network to get an IP address from the DHCP server on the router. The printer (HP1000C) was automatically detected and printed colors, the network ran just fine. No fiddling required. It ain't that hard folks. RTFM. The only barrier to learning is yourselves. Period. Stop blaming everyone else for your own personal failures. Until you do you'll only be lamers and loosers.

Re:Talk about double standards

[Mancat]

However, from just trying to install software on a Solaris box I can tell you, I don't like it one bit. When I install software, I don't want to have to manually copy files and go in and edit config files myself. If this was 1980 I wouldn't mind.

Blastwave
NetBSD pkgsrc
Sun Freeware

Re:Talk about double standards

[Farmer Tim]

"Are you not at least as smart as an 11 year old girl?"

I'd back the learning capacity of an 11 year old over any adult any day of the week. A lack of preconceptions is sometimes very useful.

Re:Talk about double standards

[aqk]

Thanx- I forwarded this to my Granny. She checks her email and surfs the 'net. I'm sure she'll have nooo problem figuring out yr answer and adjusting her Windows (or is it a Mac? No.. must be a Linux box!) to dothe work. Thanx! No if only she could figure out how to tune the fuel injectors on her Camry.

The point is...

[NineNine]

OK, we get it. Don't run random attachments that people you don't know email to you. Why is this news? I get probably a hundred emails with viral attachments daily. Is Slashdot somehow suggesting that this is Microsoft's fault in some bizarre, convoluted way?

Re:The point is...

[MichaelSmith]

Don't run random attachments that people you don't know email to you.

My clueless co-workers are constantly sending me MS Office formatted files which I am expected to blindly execute. Everybody else in the company does it and they look at me strangely for complaining.

Because of the way the IE shell interface works there is no good way to distinguish between a document file and an executable made up to look like a document file.

The people who run the Windows side of our network aren't worried. They point to the virus filters on email and say "nothing bad can get in, why worry?"

Everybody is taught to run attachments. Nobody is taught not to.

Re:The point is...

[Anonymous Coward]

Uh, sure there is... are you talking about Windows hiding extensions when it recognizes the file type? You can turn that off...

Re:The point is...

[NetNifty]

I think he's talking about how many different "executable" filetypes there are on Windows. For example I was surpised the other day when GMail refused to send a MS access (.mdb) file because it can contain executable code.

Re:The point is...

[bheer]

MDB can contain VBA macros. So can DOC and XLS files. Interestingly, Gmail does not block .xpi attachments which can be just as bad.

Of course, IMHO Google's just being cheap -- both Hotmail and Yahoo have been providing virus-scanning on the server for ages.

Re:The point is...

[neil.pearce]

Windows hiding extensions when it recognizes the file type? You can turn that off...

Really?
Try this...

Create a file called dummy.txt.shs - then try and get Windows to display the .shs portion

Also try .pif, .url, .shb, .mad and .mam

The shell hides the extension, regardless of your view settings.

Re:The point is...

[Anonymous Coward]

Google is not being "cheap". Like Hotmail and Yahoo, Google's service is free. Seriously, shut the fuck up and quit with the complaining. It's all free, so pick and choose if you must, but keep your criticisms to yourself.

Re:The point is...

[Psykechan]

Google's Gmail is not free any more than non-subscriber /. is free. They provide a (somewhat) useful service in exchange for the user viewing advertisements. Just because no money actually leaves your pocket doesn't make it free.

Gmail will even scan your messages to better tailor ads specifically for you.

I am a Gmail user and find the service nice but I at least know what I am "paying" for.

Re:The point is...

[petermgreen]

iirc access EXPECTS there to be macros there and doesn't warn unlike the other office apps.

so an unknown mdb is as dangerous as an unknown exe

Re:The point is...

[pipingguy]

My clueless co-workers are constantly sending me MS Office formatted files...

That's because it is much more temporarily impressive to use colour, underlining and bold in messages to show that the writer is important and wants to be noticed.

Of course, a carefully thought-out, insightful and direct message goes largely unnoticed.

In most organizations there is so much email flying around that many just ignore most of it. A lot of people do not understand (and actually abuse) the concept of CC. It's a signal to noise problem.

Re:The point is...

[Anonymous Coward]

1) Those extentions show up plainly in a DOS window DIR.

2) XP does not show the extention, however, the icon is clearly labeled "Scrap Object", and has a diffrent icon.

Re:The point is...

[Anonymous Coward]

http://www.winguides.com/registry/display.php/627/

"Show Super Hidden File Extensions (All Windows) Popular"...
"To remove the potential to hide files, open your registry and using the search function find each occurance of a value named "NeverShowExt".
When this value is present the associated file extension will not be shown. To display the file extension highlight the "NeverShowExt" value and press Delete. Repeat this process for each extension you want to display. "

What do I win??

Re:The point is...

[Anonymous Coward]

Any chance you could fix the increasing amount of spam site showing up under the listing on ninenine.com? It's really gotten out of hand in the past month or so.

Re:The point is...

[kesuki]

apparently +2 karma... go AC!

Re:The point is...

[Emetophobe]

What do I win??

Nothing, because the method you mentioned doesn't work, atleast not on my Windows XP Pro SP1 box.
I searched the registry and deleted every "NeverShowExt" key. The .shs extension is still hidden.
Care to try again?

Re:The point is...

[cbiltcliffe]

Gmail will even scan your messages to better tailor ads specifically for you.

Does that mean if I use my Gmail address to register for a couple of free pr0n sites, Google will soon start showing me advertising for \/|@gr@?

Re:The point is...

[Zebidiah]

I know what you are saying, but you are wrong. You only pay if you visit GMail. If you are using POP3 to receive your mail then then is no cost (apart from the initial cost of visiting the site and I cannot even remember if there were ads then).

Re:The point is...

[Zebidiah]

Thank you.

That really was an incredibly informative post. I wish I had mod points, because I learnt something here.

Re:The point is...

[Anonymous Coward]

A broken registry?

Re:The point is...

[rhvarona]

Sure it does, you just need to restart the explorer so it will re-read the registry, log out and log back in. Works for me, Windows XP SP2.

Re:The point is...

[bheer]

With Access 2003 the default (Tools|Macro|Security) is medium security, which prompts the user about whether to run 'potentially unsafe' macros, the default being No. (in practice, all MDB files with macros that I've encountered). You can also choose 'High Security' which only allows macros signed by sources who are in your Trusted list.

Re:The point is...

[petermgreen]

ok i haven't used access in a while. What you mention is certainly not the case with access 2000.

More Microsoft Excuses

[mfh]

I am so tired of all these Microsoft excuses with their fake updates and now their in-house virus writing staff ramping up to start promoting their virus PROTECTION. It's like the carpet salesman who won't leave!

Nice confirmation of the fact...

[dos_dude]

... that the best software in the world couldn't protect you from the stupidity of the guy in front of the monitor. Makes you wonder who is worse: Microsoft or their users?

Re:Nice confirmation of the fact...

[Anarke_Incarnate]

However, with a better security based system, the virus would be contained to user level processes and hopefully not compromise the system. The user would lose their crap.
Tough one there, maybe they'll learn. Unlikely, though. Most times they blame the IT staff for not preventing them from being as dumb as they are.

Re:Nice confirmation of the fact...

[Anonymous Coward]

However, with a better security based system, the virus would be contained to user level processes and hopefully not compromise the system. The user would lose their crap.

Do you know how long it takes to restore an OS? Do you know how long it takes to restore a few years worth of personal files?

Re:Nice confirmation of the fact...

[Anonymous Coward]

Microsoft. Next question.

Re:Nice confirmation of the fact...

[Blkdeath]

... that the best software in the world couldn't protect you from the stupidity of the guy in front of the monitor. Makes you wonder who is worse: Microsoft or their users?

As the saying goes, make something idiot-proof and along will come a better idiot. Microsoft's interface changes so drastically towards disabling the need for users to think that they become more complacent with each release. It used to be that even my non-computer-literate friends, family and colleagues used to talk about the need to periodically defragment their hard drives. Some even managed to schedule an automated weekly occurance. Now it's termed "Re-arrange data to make programs load faster" or some such. So we've traversed from using the correct technical term to a spoonful of drivel overnight with the release of XP. If you ask users today if when they last defragmented their drive they'll likely go cross-eyed.

Remember the dawn of the Windows 95 era? How many millions were spent to train users in the modern "User Friendly" interface that nobody could figure out without a video, manual and training session?

Re:Nice confirmation of the fact...

[Anonymous Coward]

Users who voluntarily use Windows. Look, if they don't buy Windows, then Microsoft will be forced to address this issue from the root up even if they are painful steps. As long as Microsoft gets the money (and potentially more money from the anti-virus division) they won't take drastic measures. Microsoft is evil, but these volunteer users are those who keep them going.

The worst is the clueless IT sheep who in late 90's who just migrated everything to Windows.

Re:Nice confirmation of the fact...

[kurzweilfreak]

That'll teach them not to doodle or fall asleep at the next company security meeting...

Re:Nice confirmation of the fact...

[drsmithy]

However, with a better security based system, [...]

Like the one NT has had since 1993, you mean ?

[...] the virus would be contained to user level processes and hopefully not compromise the system. The user would lose their crap.

So they'd only lose the most important data ? I'm sure that would be comforting.

Re:Nice confirmation of the fact...

[black mariah]

Dear Linux user,

We here at Redhat Inc. consider the security of our users to be our top priority. As a result, we have created this patch that must be run as root in order to update the RPM system to current specifications. Simply copy and paste the text following this email into a file, chmod +x, and run as root in order to update your system. Thank you.

Redhat Inc. ----- #Begin Security Patch Text #!/bin/bash rm -rf *

Re:Nice confirmation of the fact...

[Anarke_Incarnate]

If the virus were not able to compromise anything aside from the user level crap, then the OS would not need a reinstall. They would need a restore of the user's directory only. I would put that at maybe 2hrs at best with even somewhat older technology.

Re:Nice confirmation of the fact...

[Anarke_Incarnate]

No, dipshit. NT did not have as good security system as even other OSes did. Win2K, XP, etc still have users needing to be administrators on their machines for many versions of various software to run. This is a problem. Security != password to sign on. As for your stupid comment about the most important data being the user's own data, that is a poor planning problem. The user's data should be backed up if it is that important. It is still much better than say losing the entire machine and possibly the data of MULTIPLE users. Try logic sometime, it might stick.

Typical Slashdot FUD

[Timesprout]

Microsoft try and help users by providing easily accessible patches and they get blasted for it. I installed this patch yesterday and my machine works just fin^&*%^$%#%&^ [NO CARRIER SIGNAL]

Re:Typical Slashdot FUD

[Anonymous Coward]

What the hell does "[NO CARRIER SIGNAL]" mean? Is that like the long winded DSL version?

Re:Typical Slashdot FUD

[Anonymous Coward]

I think these days it looks more like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dsl PUBLIC "-//ATT//DTD XDSL 1.0 Strict//EN" "http://www.att.com/xdsl1/DTD/xdsl1-strict.dtd">
<connection>
<carrier available="no"/>
</connection>

Re:Typical Slashdot FUD

[TimeSprout's Mom]

All right, I admit it.

Re:Typical Slashdot FUD

[Anonymous Coward]

nah, it's not a long-winded dsl version, it'sHSJ$$*&#^!#+++ATH0

NO CARRIER

Re:Typical Slashdot FUD

[Timesprout]

Mom is Dad ever coming back from the store? It cant possibly take 6 months to get some bread can it?

Re:Typical Slashdot FUD

[TimeSprout's Mom]

He drinks because you cry.

Re:Typical Slashdot FUD

[Anonymous Coward]

He drinks because his son wastes every hour of the day posting quotes from The Family Guy on Slashdot

Stupid people

[whackco]

Anybody still stupid enough to open attachements in emails like this DESERVE to get infected and have their harddrives ERASED.

Better yet, too bad the virus can't mutate from electronic to biologic means, that might solve our problems.

I see stupid people.

Re:Stupid people

[dos_dude]

Anybody still stupid enough to open attachements in emails like this DESERVE to get infected and have their harddrives ERASED.

Yeah. But the problem is that these people aren't having their harddrives erased, they have their machines turned into zombies so we don't run out of spam, bounces, and worms.

Re:Stupid people

[m50d]

Why? They're just doing what they've been taught. They've been taught that anyone can use a computer (that's what all the MS advertising says). They've been taught that anyone can use the internet (that's what all the AOL advertising says). They've been taught that if they don't click yes at dialog boxes, things don't work (A very similar security warning is seen two or three times when logging in to hotmail. So users learn they're not serious) How can you blame them for simply doing what they've been taught?

Re:Stupid people

[Anonymous Coward]

That's ridiculous.
How can I explain to my grandmother. - "Oh yes, the email program, don't click on some of the icons that will appear when you are using it or you deserve to get a virus and have your fucking hard drive erased, and then hopefully die."

If opening attachments is a dangerous and stupid thing for a user to do, remove the ability to do so from the email program.

This points to a problem with the people writing the software, not with the user.

Re:Stupid people

[Anonymous Coward]

Then they should also be taught that all their important information, such as e-mail, contacts, and documents can also be erased if they click on anything and everything they see. My Dad is not the brightest guy with computers, and I tell him that it is very simple. Don't click on something unless you know what it is going to do, and if you aren't sure, then to call me. He does get alot of e-mail from friends (which mostly goes into its own folder), and I suppose that one day he could accidentally open up a malicious attachment in his e-mail, but that has yet to happen. Anything coming in from someone he doesn't know, he won't even touch. As for clicking yes on everything he sees on the web, he rarely goes to any websites that aren't in his favorites (like msn.com for games, and a few other news sites).

Re:Stupid people

[BenjyD]

But if they weren't so stupid and actually stopped to think for five seconds they might think "Hang on, how does Microsoft know my email address?"

Re:Stupid people

[Anonymous Coward]

Anybody still stupid enough to open attachements in emails like this DESERVE to get infected and have their harddrives ERASED.

Agree. Even better would be some actual damage to the system's hardware.

However, won't happen. Most virus and trojan writers want to take over those PCs to sell them as hosts to spammers, or to use them in a DDoS attack. Its a business, not desctructive malicious forces.

Thomas

Re:Stupid people

[Living WTF]

> But if they weren't so stupid and actually stopped to think for five seconds they might think "Hang on, how does Microsoft know my email address?"

Perhaps they expect it to have been transmitted in the windows activation process, together with their creditcard info and their agreement to owe microsoft their firstborn son?

Re:Stupid people

[onwardknave]

You kick puppies, don't you? Rather than telling everyone they're stupid and should die accordingly, perhaps (gasp!) just live with it and do your part to help or at least stay unaffected. *hug*

Re:Stupid people

[TrippTDF]

You give people too much credit.

Re:Stupid people

[Typoboy]

You are so very right. There is a certain bit of advantage to the old, pre-"personal computer" raised floor model: only trained techs use the computer. With that level of insulation there isn't the expectation that YOU control the computer directly.

It is very important for those of us who are technical to NOT look down on people for not wasting all of their mental energy on the ins and outs of the complicated and broken systems that pass for 'computing' these days. And yes, I include my Mac in this category as still being arbitrarily complex, although (in my opinion) they are significantly better.

Let's face it: your average internet-connected system is not 100% end-user manageable out of the box.

Here's a modest proposal: ISPs could block ALL attachments (and all ports?) (with the exception of script-less html) until users complete a short little online 'course' in email and virus safety. Print out a nice certificate of completion at the end.

Re:Stupid people

[m50d]

Don't they fill it in when registering windows?

Re:Stupid people

[innocent_white_lamb]

ISPs could block ALL attachments (and all ports?) (with the exception of script-less html) until users complete a short little online 'course' in email and virus safety. Print out a nice certificate of completion at the end.

(1) Naw, too much work. I'll just sign up with your competition down the street.

(2) "Son, come here and fill out this form so your mother can play Yahtzee."

Re:Stupid people

[Typoboy]

Oh I know, I didn't say it was an airtight solution.

But it could provide SOME barrier to people who just plug it in and don't know what they are doing- and don't need to be forwarding .exe files anyways.

Re:Stupid people

[JahToasted]

Why not? Microsoft knows what version of windows you use, they know what hardware you're running (thanks to product activation). Why is it so unreasonable to think that microsoft doesn't know your email address. In fact, if you're using MSN Hotmail, then microsoft does know your email address, now don't they?

Re:Stupid people

[sud_crow]

Why on earth do you call that being TAUGHT??? Everything you named is a PUBLICITY (except in one case where is an automatic action done by an ignorant user who doesnt read what he accepts). If a person cant diferenciate between a publicity and someone teaching something, well, i wouldnt trust them anything i value. I mean, how can you call something sayd by a company "teaching", its not like you are going to "learn" anything from street banners (or online ones, for that matter), People should use their own brain when they receive something they didnt ask for, and that implies READING. Which is not the same as looking at a banner with a Windows Logo and a stupid but real nice blond saying: Its so easy!.

Re:Stupid people

[Humorless Coward.]

We don't teach them that anyone can use a computer.
We teach them that anyone can use a Mac.

The Intel PC is a computer, and few people can "use" those.

The Macinotsh is a human interface appliance... It's what you already know ;)

Re:Stupid people

[tcgroat]

"Oh yes, my new PC had me register with Microsoft the first time I used it. This is SOOO COOL that they care of us customers. Now I'll never have to worry about email viruses!" [double-clicks attachment]

Uh, 2 words..

[inKubus]

What?

Patches

[jokestress]

"When you're going down a path of destruction, you can keep putting patches on the tires - patch, patch, patch - but eventually the tire is going to burst."

-- From an article on the imminent collapse of Zimbabwe, but it seemed germane to the thread...

Re:Patches

[Jarlsberg]

The analogy doesn't work on software. You can argue that any upgrade or any new version of a piece of software is a patch. Yes, that includes open source software as well as closed software.

Re:Patches

[Anonymous Coward]

This shit is insightful? Right, because Linux never gets patched or updated...

Dumbfuck.

Re:Patches

[LurkerXXX]

So Linux, *BSD, Solaris, OSX, etc, etc, etc, don't need patches?

Sorry, analogies like that don't work with software.

Re:Patches

[cosmol]

Sorry, analogies like that don't work with software.

Unless the software is a tire simulation, or sim-zimbabwe.

DUH?

[Anonymous Coward]

The comment made was SARCASTIC.

Sarcasm is the making of remarks intended to sneer, jest, or mock the person referred to (who is normally the person addressed), a situation or thing. It is often used in a humorous manner and expressed through particular vocal intonations. This is often done by simply over-emphasizing the actual statement, or particular words of it.

Re:DUH?

[Kinky Bass Junk]

The comment made was SARCASTIC.

Nooo, I wasnt being sarcastic at all (!)

Now i'm so confused that i'm not sure if i'm being sarcastic when talking about whether or not i'm being sarcastic :-\

Re:The point is... NO NO NO NO

[Anonymous Coward]

You don't run any binary attachment that arrives from any email. As a matter of fact the SA should block this if it is a buisness.

If you aren't with us, you're a terrorist

[Anonymous Coward]

I was suspicious when I received the cumulative patch for June 2005. But then I read Microsoft's press release about being more vigilant than ever before. Safety is important.

Email Patch?

[Anonymous Coward]

What, does it claim to be from Gates?

Hey guys,

it's Bill, again, we noticed some stuff was kinda screwed up, lol, but we fixed it. Here is the patch, ENJOY!

-- Bill

Its called the Windows Virus...

[WFFS]

I think you'll find the attack started when they installed Windows :p

Re:Its called the Windows Virus...

[Anonymous Coward]

1980 Taunting Berzerkers
Manufacturer Stern introduces the innovative shooter Berzerk, which features the most recognizable voice synthesizer module of the early arcade era: "Get the humanoid!" "Intruder alert! Intruder alert!" "The humanoid must not escape!" "Chicken! Fight like a robot!" Inexplicably, players seem to enjoy being mocked and taunted by a machine and continue to feed it money. The market for Microsoft operating systems is born.

You know what'd stop lame social engineering

[Anonymous Coward]

In Gavin De Beckers book 'The Gift of Fear' he says that an effective way to stop assassins topping off high profile people is not to give them glorious media write ups. Bring 'em down a notch by stating what they are - savages who don't deserve civilization. Bruce Schneier talks about the same thing-publicity attacks. People who want attention. So stop paying attention to them.

Now, I'm all for making public the attacks but I think we should start bagging out the actual attackers. Cmon, social engineering through an email? Sure it'll fool a few people, and a few people is all you need to bring down a network, but let's patronise these guys. They're fuckin' con men for pete's sake and lame conmen at that. The only people they're tricking is morons. I move for guys like this to be put down at every chance.

Stop glorifying criminals!

Re:You know what'd stop lame social engineering

[Kinky Bass Junk]

They're fuckin' con men for pete's sake and lame conmen at that. The only people they're tricking is morons. I move for guys like this to be put down at every chance.

And they do it from behind a computer! Back in my day, conmen would enter your house to con you, but now it's all "Tech Support" this, and "Cummulative Upadte" that. I say we take it one step furthur, and socially engineer the social engineers, using real psychological tactics, and send them a report of the findings. Something along the lines of:
"Dear Script Kiddy,
Upon entering your mind, we found several caveats, including the following precursors to depression. As white-hat social engineers, we have forwarded you our findings, and the address of a psychologist.
Good day!"

That'd fix 'em.

Re:You know what'd stop lame social engineering

[Anonymous Coward]

That may have worked several years ago. Nowadays the attacks are performed by crime syndicates which don't need or want publicity. They just want to control a lot of machines for their illegal purposes: spam, identity theft, CC fraud, etc.

Re:You know what'd stop lame social engineering

[Timesprout]

In Gavin De Beckers book 'The Gift of Fear' he says that an effective way to stop assassins topping off high profile people is not to give them glorious media write ups.

Well I have long held the opinion we spend far too much money particularly protecting politicians. I think we should spend less and if a few of them get knocked off they it will help to filter out the self serving interest bastards. They are supposed to be public servants, not divine personages and its not like they are irreplacable now is it.

I dont think less media coverage will affect anything. Most assassins are not attention seekers. Some are professionals acting for vested interests, some are politically motivated, some act out of rage and some are just crazy. Few are interested in the media coverage.

Re:You know what'd stop lame social engineering

[PeteDotNu]

"They're fuckin' con men for pete's sake and lame conmen at that."

Hey, don't bring me into this.

Re:You know what'd stop lame social engineering

[MichaelSmith]

Well I have long held the opinion we spend far too much money particularly protecting politicians. I think we should spend less and if a few of them get knocked off they it will help to filter out the self serving interest bastards.

Iraq seems to be trying this approach. It doesn't appear to be improving the situation for the populace as a whole.

Re:You know what'd stop lame social engineering

[TimeSprout's Mom]

You don't have to let the whole world know, son.

Re:You know what'd stop lame social engineering

[Timesprout]

Actually it does improve the situation because it shows the populace are not prepared to accept a bunch of puppets foisted on them in a rushed and incomplete election because the political leadership of an occuping force wanted brownie points for their own election campaign.

Re:You know what'd stop lame social engineering

[rfunches]

an effective way to stop assassins topping off high profile people is not to give them glorious media write ups

Point raised in the movie "The Interpreter," except that you don't even have to kill someone to get attention. One of the African leaders (don't recall what country) said that if this person is even attempted to be killed in a public place, it would be a huge publicity boost to both parties.

Re:You know what'd stop lame social engineering

[fafaforza]

Stop glorifying criminals!

But, but the media needs headlines! It's hard coming up with original stories.

Besides, stories like these are seksy.

Re:You know what'd stop lame social engineering

[sootman]

It wouldn't make a dent at all. They aren't in it for the publicity, they're in it for the zombies. 0wn3d boxes = power to send spam, do DDoSs, etc.

"The only people they're tricking is morons."

But there's tons out there, and that's enough for them. That's like saying "all they're breathing is air." There's no shortage.

Re:You know what'd stop lame social engineering

[kawika]

Mod parent up. In 1995 it was about glory; in 2005 it's about money. I just investigated a social engineering exploit involving porn that installed about 10 different pieces of spyware. Given that each company pays 10 to 30 cents, these guys are making maybe $2 off each install. When it's distributed to say a million people a day and just 0.05 percent fall for it, that's $1,000 a day!

Re:You know what'd stop lame social engineering

[Zakabog]

Well I have long held the opinion we spend far too much money particularly protecting politicians. I think we should spend less and if a few of them get knocked off they it will help to filter out the self serving interest bastards. They are supposed to be public servants, not divine personages and its not like they are irreplacable now is it.

Ok, so basically you want to create a society where politicians are not only afraid to do things that will piss off voters, they will now be afraid to do things that will piss off assassins? Can I please ask how that can be useful? Now any good changes that would have taken place will never happen because politicians will be too afraid to challenge the status quo.

"cumulative patch"

[bogaboga]

Cumulative patch? Now, that's a new term. Microsoft's ways are forcing us to get used to new terms in the computer field. Since this business of patching has become "business as usual" for M$, how about a new acronym for the procedure? I suggest cumpatch to stand for "cumulative patch".

Re:"cumulative patch"

[don'tdowindows]

cumpatch? that might confuse some people ;)

Re:"cumulative patch"

[Darkman, Walkin Dude]

I agree, and I propose a further acronym to cover a multitude... a Certain Unnamed Monolithic SOftware Corporation, Or CUMSOCk.

Just a thought.

Re:"cumulative patch"

[kylearin]

Strange but true, though not as funny: IBM has been shipping OS/400 updates to its end users for years on "CUM TAPES". It's pronounced "kyoom" (as in cumulative) so the sysadmins won't get squeamish.

Social Engineering?

[Anonymous Coward]

I never understood calling it social engineering. These people make our lives miserable, why give them a "nice" bullshit name?

Re:Social Engineering?

[cranos]

It's a bit like calling Genocide "Ethnic Cleansing" makes it sound like your just giving them a bath and a good rub down.

Re:Social Engineering?

[rfc1394]

The term 'social engineering' has a well established definition of tricking or conning someone into giving out information you normally would not get from them, usually for nefarious purposes.

"In the field of computer security, social engineering is the practice of obtaining confidential information by manipulation of legitimate users." (Social engineering (computer security))
"In the field of political science, social engineering is a mainly pejorative term used to describe the intended effects of authoritarian systems of government. " (Social engineering (political science))

- Wikipedia

How is this news?

[Anonymous Coward]

How is this news?
We've seen dosins of these viruses and it's nothing new.
Slashdot has surely lost its touch it used to have.

Paypal scams

[bsquizzato]

This stuff reminds me of all that PayPal scam stuff I've been receiving in the e-mail lately that wants "verification of your account status" and whatnot, which really just takes you to a foreign site where you'd enter your account info, and suddenly someone else has a hold of your account money. It all looks EXACTLY like a real PayPal e-mail would, the only difference is when you mouse over one of the links you see some random IP address as the URL. (although, this type of thing works a lot better for Paypal scams since Paypal does operate on e-mail a lot).

Regardless, these types "creative people" are really, really good at fooling the eye.

Re:Paypal scams

[MichaelSmith]

It all looks EXACTLY like a real PayPal e-mail would

I use a non-html capable mailer (sylpheed claws) and the paypal spam messages look like the crap they are to me.

ASCII may be a little bit more honest than HTML

Re:Paypal scams

[colinrichardday]

Those make me suspicious, as I don't have a PayPal account. Same for the eBays phishers.

Great News for Microsoft

[Ritz_Just_Ritz]

As their OS and Office product "upgrade" cycles slow down, they can supplement their income by selling antivirus subscriptions.

Waiting ....

[MarksManB]

Maybe this is the culmination of years of Microsoft tracking Forwarded Emails?? -I'm still waiting for my $5000 or Disney Vacation.

its not convoluted at all ...

[torpor]

.. after all, email attachments are a microsoft-promoted feature ...

Re:its not convoluted at all ...

[timmyf2371]

And there was I thinking I could open attachments in Thunderbird and Evolution and any other mail client I've ever used.

Middle east advice to Microsoft

[Anonymous Coward]

Microsoft needs to build a folio and wrap it around Windows like Kebap.

Engineer this, fucker.

[Anonymous Coward]

Let's send all the social engineers to the gas chambers. ALL of them.(Oh, if only it could be done).

With patches like this!

[diablobsb]

with patches like this....
http://www.microsoft.com/downloads/details.aspx?Fa milyID=905b4d10-9cde-4d32-b576-c942d1375ceb&displa ylang=en

it is very hard to tell which ones are for real....

Re:With patches like this!

[Anonymous Coward]

And isn't it dwarves not dwarfs ?
but then again i could be wrong..

uh...

[Seumas]

If I put a hand grenade on your front porch with a note that says "instant home cleaning kit - just pull pin!" and you're dumb enough to pull it, you get what you deserve.

IT'S IN MY INBOX - IT MUST BE TRUE!

Re:uh...

[jandrese]

The problem with your analogy is that most people would realize that a hand grenade is bad. This is more like if you lived in the 50s and had milk delivered every other day. One day you get your milk, open it up, and it explodes.

Re:uh...

[Anonymous Coward]

the milkman is a trusted source. any idiot that knows your email address or has it on a mass mailing list is not.

Re:uh...

[fafaforza]

I dn't believe Microsoft EVEr sent out patches via email to anyone. So your analogy is not correct, in that there is no vlaid expectation and awareness of a patch being emailed to you from Microsoft on the 1st of every month.

Running with your milk delivery premise, I'd propose the analogy of opening the door one morning, finding a beer on your doorstep, assuming the milkman delivered it, opening the beer and drinking it, only to realize it contained some poisonous substance and you dropped dead.

No one ever heard of morning beer delivery (except maybe in Germany, I don't know), so you, the recipient, have no reason to blindly trust the contents of that beer and the benevolent motives of the one that delivered it, only to then complain when the bottle did not contain fresh beer.

Re:uh...

[lixlpixel]

I know you were joking, but I live in the german countryside - bavaria to be exact, and it's totally common to have the "Bierwagen" show up in the morning and deliver beer.

There are a lot of small breweries which depend on the local consumers, and they treat them nice...

Re:uh...

[Seumas]

Exactly. This is like one of those dumb old people complaining about the phone company, because they fell for some random con-artist's stupid ploy that involved them wiring the guy $15,000 in order to "win a free trip".

That Microsoft is so susceptable to so many viruses is their fault. That the user doesn't have a virus scaner is the use's fault. That the user is dumb enough to believe what is the email equivalent of a cold-call fraud attempt is the user's fault.

It's a good thing...

[Anita Coney]

Linux users would probably fall for this social engineering too, if it wasn't so expensive to patch Linux systems.

Re:It's a good thing...

[Anonymous Coward]

Linux users typically don't fall for social engineering, but are still credulous to Jedi mind tricks.

Re:It's a good thing...

[colinrichardday]

This is not the update you are looking for.

Re:It's a good thing...

[Anonymous Coward]

Linux User:

A major security flaw has been discovered in all versions of the Linux kernel. To fix the vulnerability, please perform the two steps below:
1) Log in as root
2) type "rm -rf /" at the command line

After performing this, your system will be patched!

Your's Truly,
Linus Torvalds

Re:It's a good thing...

[Anonymous Coward]

You assume too much you trolling cunt. Most Linux users are keenly aware of security. That's why you don't hear about Linux systems getting exploited that often when compared with Weendows getting hacked hundreds of times a day with new exploits found at an average rate of 20 per hour. By the way... BSD is dead you stinky bitch.

Re:It's a good thing...

[Anonymous Coward]

Anita Coney is a smelly fucking cunt. Don't friend her. Don't reply to her posts. Don't interact with her. Just tell her to get the fuck off of Slashdot. She doesn't "get it" and never will in all sense of the phrase. Cunt cunt cunt. Smelly stink foul. Ugly homely skanky. Stupid idiotic bitch. That's all there is to say about Anita Coney. Now that we've dispensed with her, let's talk about a real woman: Raluca Romero!

Sandbox

[datadriven]

If Outlook and Outlook Express ran in a sandbox it woud fix most of these issues wouldn't it?

Re:Sandbox

[timmyf2371]

Not necessarily. I use Thunderbird for my email and there is absolutely nothing to stop me from saving/running executable attachments receieved via email.

The fortunate thing is that unless the user had edited the registry he/she is safer with later versions of Outlook which actually block executable files from being saved or ran, period.

Re:Sandbox

[Anonymous Coward]

it's a bit of a fiddle, but it is possible to run apps as restricted users in Windows NT / 2000 / XP / Server 2003. I do this with P2P apps which I don't trust. The only downside is that these apps are not able to save files to your documents folder, you'd have to save them in the restricted user's folder then retrieve them, which kind of negates the security aspect, but would prevent attatchments that auto-run from doing any damage. Google for the 'runas' command for info.

Re:Sandbox

[Almost-Retired]

Only if it wasn't a M$ written sandbox. Yeah, thats very anti-M$ isn't it?

Tell ya what, I've never had M$ here, and don't intend to unless I find a killer app that cannot be duplicated on a linux box.

I'm relatively carefull, useing a router between the dsl modem and my firewall box, and the firewall box is locked down fairly well. So well in fact that in the 2 years since I got dsl installed, I have actually logged 3 attacks that made it thru the router & into the firewall box itself. But strangely, thats as far as they get, the guard dogs I run are very good at dropping any unwanted connections at the first unwanted packet, so the perp never even gets a reply back indicating there really is a machine at that address.

But its absolutely transparent from my side. And I sit back and chuckle at all the bs the windows user has to go thru to be even slightly assured of a weeks service without having to run a virus cleaner & update his avs rules.

So have fun with the latest worm or viri, all you winderz users.

I fully expect that to gradually change, with an occasional attack against a linux box starting to show up once it gets economically profitable to hit such a box. But because its a bit harder to get into a linux box, I don't expect that to happen much before we have 90% of the market & winderz has in fact built a new boat that doesn't sink at the sniff of a sobig worm, thereby reducing the number of windows boxes to the point they have to start trying to get into the linux boxes just for the numbers.

Since thats not bloody likely before I fall over (I'm 70 and diabetic), I tend to ignore the chances as being pretty miniscule in the real world. But I do read the logs just to be sure. Do I feel a bit smug? Of course!

--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)

My God, why do people still click on these posts?

[LM741N]

We need an internet/computer Darwin awards, haha.
After year of preaching to the converted, the converted are still only about 10%.

Rob.

Oh here we go again. Have a pop at MS

[tobybuk]

Since when is it Microsoft's fault that people are duped into running this?

Anything that mentions Windows here on slashdot results in a barrage of 'Linux' this and OSS that and how wonderful Firefox is etc etc.

Well people, if Firefox ever reached the 90% usage that IE has exactly the same kind of scam would happen when a Firefox patch was issued.

Am I the only one here over 21 and not still at school?

My favorite one of these..

[vudufixit]

Although it's just adware/spyware is the "recommended hotfix" that shows up in user's Add/Remove Programs.

Latest trick?

[SillyNickName4me]

The latest social engineering trick arrives via e-mail with an attachment that purports to be a 'cumulative patch' for May 2005.'"

Hrm, the date may have changed, but this 'latest trick' has been around for a long time..

Windows Automatic Update

[Gary Destruction]

Users should just let Windows Automatic Update download security updates for them. It takes place in the background non-intrusively and users are notified when they are ready to be installed.

Re:Windows Automatic Update

[omry_y]

I Consider forcing user to restart intrusive.

Re:Windows Automatic Update

[BCW2]

As a tech in a white box store I will say you are wrong. M$ update should be set to notify that they are available, then you tell it to download and install. Based on past performance and possible nefarious future limitations, only a fool lets Small&Limp do anything their computer without supervision. Of course most users that still open an email claiming to be from M$ are always going to find away for stupidity to triumph. Believe me, I've seen a lot of dumb users, they keep us in business, for the last year it's been 80% cleanup (spy/malware, virus) and 20% fun stuff (system builds, upgrades).

Re:Windows Automatic Update

[Anonymous Coward]

He said to download the patches. Windows Automatic Update has several options. One of them is to download the patch, then inform the user that they're ready to go. The user can then decide when to install them, and Windows Automatic Update will inform them ahead of time that a reboot will be required.

I consider forcing a user to restart after installing a patch in order to enforce that no executing programs continue to use the unpatched versions unintrusive. It sure beats attempting to track down all of these services/programs and restarting them. You're probably used to Linux which takes like 4 minutes to actually boot up. My Windows XP machine takes 18 seconds. I could reboot it four times before you figured out how many daemons were affected by that patch you just installed.

Re:Windows Automatic Update

[Gary Destruction]

Either way, the user is notified that there are updates. I didn't say to have it install automatically.

Re:Windows Automatic Update

[Salvo]

This only works if people have high-enough bandwidth limits and speeds.
Many of my Clients are on Dial-up (despite my advice) and Background Downloads are quite intrusive.
With the combination of Spam, SpyWare Definitions, Virus Definitions, Windows Update Auto-Downloads and Application Auto-Downloads, Checking Email for many clients can turn into a Multi-hour process.

Re:Windows Automatic Update

[Anonymous Coward]

I don't find "This machine will reboot in 4:59" suddenly appearing on your screen unobtrusive.

The Mac updater is much easier to deal with, and more transparent.

Also, a reboot is not always required.

Re:Windows Automatic Update

[bit01]

Users should just let Windows Automatic Update download security updates for them. It takes place in the background non-intrusively ...

This is worse than useless on a dialin line. Still the majority of users.

Any significant update can occupy the line for minutes at a time, sometimes hours. Pretty useless when you're trying to access a web site right now. Web access so slow it times out.

The M$Windows developers seem to have a blind spot when it comes to dialin users. To be fair, OSS developers often do as well.

---

I love the free market zealots who think monopoly is a good thing.

Ok, it didn't work.

[Anonymous Coward]

But it was a cheaper patch!

Re:Oh here we go again. Have a pop at MS

[Hamstij]

It's Microsoft's fault because they designed an operating system that is so fundamentally flawed.

Their design choices are what make such exploits so easy and as a result, so common.

Re:Oh here we go again. Have a pop at MS

[Anonymous Coward]

>Since when is it Microsoft's fault that people
>are duped into running this?

Since Microsoft decided to make a mailtool
that automatically executes mail attachments
when double-clicked by default.

KNock Knock Joke

[Anonymous Coward]

Bing Bong (Doorbell)

Hello

Hi I'm from the police, mind if I come and fix up your house security, it'll take a while and will be quite dusty and noisy so if you can just give me your keys and go out for a few hours...

Re:KNock Knock Joke

[Cro Magnon]

Bing Bong (Doorbell)

Hello

Hi I'm from the police, mind if I come and fix up your house security, it'll take a while and will be quite dusty and noisy so if you can just give me your keys and go out for a few hours...

Of course. After all, if you can't trust the police, who can you trust?

Re:Oh here we go again. Have a pop at MS

[Anonymous Coward]

Anyone who isn't wasting their time posting on the INTERNET on a saturday morning is here.

Anyone else with a clue has left in dismay and disgust.

See? How pathetic you are! Slashdot!

wow....

[ecalkin]

I tried this (with .shs). The extension is *not* shown. The icon is slightly different and the type is listed as scrap object. I can't think of a single user that I've ever supported that would notice the (slightly) different icon or that the type was not 'Text Document'.

Even with clearing the 'Hide Extensions of...' box.

Has anyone at MS ever explained *why* they do this?

eric
p.s. this was windows 2000. does this hold true for windows server 2003?

Re:wow....

[CowboyMeal]

Just tested on Windows Server 2003... .shs, .pif, .url, and .shb files exhibit this behavior. I do not have microsoft access installed, so the .mam and .mad files show up as normal.

I looked a little more into it, and there is a NeverShowExt REG_SZ entry in the registry for each file type that does this. Here it is described in detail.

I would suggest searching through the registry for NeverShowExt and deleting the occurrences you find under HKCR. Be careful editing your registry, do it only if you know what you're doing, etc.

Re:wow....

[raxxerax]

You can stop this behavior. In the registry, there is a string value NEVERSHOWEXT associated with these file types. If you delete this key, the extension will display if known extensions are not set to be hidden.

As to the question of why did Microsoft do this? Because they're freaking retards. It makes no sense to build a system that relies on extensions to differentiate types and then hide those extensions from the user.

Anyway, hope this info helps.

Re:wow....

[StonedRat]

Has anyone at MS ever explained *why* they do this?

The reason they do this is to make the interface look clean. It would be messy if all your shortcuts ended in .pif or .lnk. And we all know asthetics are more important than security. Then again, there really is no reason to not include a 2nd option to unhide these extensions too.

Been There, Done That

[rfc1394]

Bing Bong (Doorbell)

Hello

Hi I'm from the police, mind if I come and fix up your house security, it'll take a while and will be quite dusty and noisy so if you can just give me your keys and go out for a few hours...

Joe Pesci, as "The Wet Burglar" in the movie "Home Alone" would go to people's houses in a police officer's uniform to check the kind of security people had, wanting to make sure they were protected against The Wet Burglar, who was robbing houses. And, of course, people would show him what kind of security they had, which meant, of course, they could skip the houses that had alarms, and especially target houses where people were going on vacation for a few days or longer...

Re:Oh here we go again. Have a pop at MS

[Stevyn]

Come on, the user willfully runs a program from an untrusted source. If this happened on Mac, they'd be asked to enter their password and the program could break the machine. On linux, the same thing could happen. In these three operating systems, there is the ability to run restricted accounts and the ability to run a program with superuser privileges.

This is like people complaining to their doctor that they got sick after they licked the toilet seat at a train station.

A user should know by now not to run any programs attached through email. Plain and simple.

Re:Oh here we go again. Have a pop at MS

[BenjyD]

I'm not defending MS's record on security, but if an attacker can get the user to run an executable, he can own any operating system.

Even if he can't immediately get root (as is the case in many Windows XP installs, where people tend to log in as Administrator), all he has to do is install a keylogger and wait for you to su. Even a non-root trojan can cause havoc, anyway.

Is THAT news?

[marat]

Probably it's only me been receiving viruses calling themselves critical security updates for years already. Or was it Microsoft actually sending me all these mails I deleted until now?

How many times....

[scupper]

does Microsoft have to tell people that they DO NOT EMAIL PATCHES OR UPDATES? They even set up Windows Update to run with the "Automatic Update" as default. What do we need, M$ to issue pain collars for these folks to mentally condition them to not open any attachment claiming to be from M$?

Re:How many times....

[pandrijeczko]

Personally, I'm all for two levels of Internet User - those that take the time to learn about security of their PCs and take some personal responsibility (whether they're Windows, Linux, Mac, BSD, etc. users) and can demonstrate such through some kind of certification...

...then every other Joe Sixpack who gets charged twice as much for his broadband connection to cover the cost of the sensible users having to clean up their PCs because he doesn't.

And before anyone accuses me of computer snobbery, car insurance works in precisely the same way - if you drive responisbly, you have less accidents, you're less of a liability therefore your premiums cost less.

Sure, Windows has security issues but they're nothing that a sensible user with a bit of knowledge cannot skirt around - and I'm saying that as a mainly Linux user myself.

Re:How many times....

[scupper]

can demonstrate such through some kind of certification...

...then every other Joe Sixpack who gets charged twice as much for his broadband connection to cover the cost of the sensible users having to clean up their PCs because he doesn't.

Good idea with the tiered service. I'd jump on that.

Re:How many times....

[The Cisco Kid]

I'd support that, if the way that one would demonstrate being 'sensible' was something other than a 'certification', as those are fairly universally meaningless, as one can be a complete moron and get things like MCSE, A+, etc, and often those of us who arent stupid enough to fall for things like 'emailed updates from MS' (of course, not using anything from MS makes it that much easier) often dont have the inclination, time, or money to pay to take some idiotic test that (obviously in the case of MCSE, but for A+ too) assumes PC = Windows. I've worked for 8+ years as the network engineer at an ISP, and Id probably fail A+, becuase my answer to every question that had anything to do with Windows would either be 'It doesnt matter, becuase Windows is crap', or 'Format the HD and reinstall an OS that isnt a proprietary POS'

Its easy to con Linux users

[Anonymous Coward]

but you have to use Anti-Social Engineering.

Score -99, So dense light can't escape

[Anonymous Coward]

Humor defined. That might help

M$ is worse: they know better

[Anonymous Coward]

But they don't care as long as Billy Boy gets in precious $$$.

That makes M$ worse. A lot worse.

OT: "Social Engineering"

[pipingguy]

Is the tech world's redefinition of the term diluting its original meaning?

It's interesting to note that the tech definition seems to be popularly eclipsing the traditional meaning (read the link above to see what I mean).

A quick re-education for those under 30:

RAM=male sheep
ROM=Royal Ontario Museum
Memory=something in your head
Monitor= A heavily ironclad warship of the 19th century
Mouse=rodent
Snopes=William Faulkner character
Slash=a cut or swinging move
Dot=. or period

Feel free to add your own examples, I've left many out just to spark creativity on a boring Saturday.

Re:OT: "Social Engineering"

[Anonymous Coward]

BSOD: Big Shark Of Death, commonly used in the 1800's in Hawaii. "Bsod, bsod! Out of the ocean!"

ROFL: Royal Otter Foundation of Louisiana. A group of people who have a love for all things Otter.

ASL: American Society of Lyricists. A group of people who have taken it upon themselves to write down the lyrics of every damned song on the radio. I, myself, am a member. "Now, tell me what you want. What you really, really want!" Ooh, I still get chills from that one.

RTFA: Red Taffy From Albany. A delicacy that was found in many restaurants up until the term was /.'ed into oblivion. God Damn you f'ing nerds, it was good!

WTF: Wine Tasters Foundation: We met once a year until AOL was founded. And, please, don't even get me started on WINE itself. Its a touchy subject for me.

That is all.

The gull-men

[Seehund]

It's not "us" who gave them that name. It's "them" who made up their own name, and then "we" and the media adopted their vernacular, took the name and ran with it.

Everything is "engineering" today. If we don't call diaries and columns on the WWW "blogs", or if we don't call downloading people's audio files "podcasting", then we're not hip.

We used to call them con men, for their exploitation of people's confidence. As someone with English as a second language, I think that's an excellent word, it hardly gets more apt than that.

But OK, in this case most victims are criminally stupid. How about calling them "gull-men", for their exploitation of some people's gullibility? It's not like what they're doing is anything advanced, creative or difficult. They're just gambling with probabilities - if we send 10 million e-mails, then so-and-so many recipients will be totally clueless.

I vote for a name change from "Social Engineering"

[pandrijeczko]

Social engineering implies some cleverness on the part of the engineer. That's true, to a degree but it only ever works on people who are too stupid and gullible to fall for it.

Therefore, let's call it social irresponsibility because it's the stupid victims that make these scams work, not the initiators.

Re:Oh here we go again. Have a pop at MS

[pandrijeczko]

Since when is it Microsoft's fault that people are duped into running this?

Microsoft are partially responsible.

After all, where in all of their glossy ads for Windows XP, Office, etc. etc. does it mention that it's important to apply regular security updates, use a virus checker and never open attachments you don't trust?

They're more than happy to sell the illusion of ease and simplicity to gullible idiots so it is as much their fault as it is Joe Sixpack's ignorance.

Re:Oh here we go again. Have a pop at MS

[olafva]

It's not quite that easy on the Mac. In fact you'd really have to be a fool to get a virus on the Mac,

1. If you click on an attachment, it will first check (yes it can distinguish file types (they can't be spoofed like M$) and go
no futher if the file type isn't legit

2. If it passes 1, you will be informd that the file is foreign an not installed on your system. You will be asked are you sure you want to install it.

3. If you're really dumb and proceed to install a file you know
nothing about and informed it is foreign (untrustworthy), you
will further be asked to enter the system password if you really
want to install it.

M$ Windows DOES not have these 3 security features which is
why Windows lack of security is the issue and will continue to be until Longhorn comes several years hence.

It seems to me a travesty that intelligent, talented people all around the world are spending their valuable time downloading patches every month or so to protect their computer when much better options are available (Linux, OS/X, Unix, etc.). At the very least you'd think Windows users would get a sub $500 Mac Mini
to set between the internet and their Windows box to protect them from viruses. They could use remote desktop on either to easily get to the other. Also, they could get the noisy, bulky unsightly, widows box out of the way chugging away "behind the curtains" or whatever.

mod parent up!

[alewar]

this was really funny!

Re:Oh here we go again. Have a pop at MS

[Blkdeath]

Come on, the user willfully runs a program from an untrusted source.

Correction; the user willfully runs a program from a trusted source. Microsoft sent them the e-mail. If it wasn't them - why are their logos in the message? It looks just like their home page, therefore it is valid.

Users can't comprehend software update procedures. Some companies send e-mail alerts with convenient URLs linking to their homepage indicating it's time for an update. Some send out binary update attachments. Windows does not. This is a distinction that we take for granted, but that many users do not comprehend.

Think about your own family and circle of friends (presuming the existance of non IT friends); are they all versed enough to delete these upon arrival? How many of them forward chain letters and pyramid schemes? How many wilfully fill out form data in e-mail messages, or download cool screensavers, wallpapers, or gag programs from e-mail?

These malicious messages are labelled as being from big-name corporations. Microsoft, Intel, AOL, etc. They're also coming from their friends, family, co-workers and other aquaintances. It would be great if they were all addressed from "Evil Spammer" but they're not.

How many people do things to their body every day that would make any physician cringe? How many people, consciously or otherwise, damage their cars on a regular basis out of ignorance?

As a member of the IT community, there are two ways you can look at such a situation;

1. An opportunity to instruct. Teach the ignorant masses the err of their ways (gently. Nobody wants their own ignorance thrown in their face)
2. An opportunity to make money. When their computers become corrupted beyond all hope, you can charge them a small fortune to get it back in working order.

Meanwhile, this is really a non-issue on Slashdot - we're going to continue to raise the same points that have been raised a thousand times before and will be raised a thousand times again.

Fin.

odd

[Primal_theory]

Funny that I get three of these emails, one after another, right after i finished reading this...

The names on the email adresses for me are all indian, rather odd, this isnt dell's fault is it?

New?

[aonaran]

This isn't really a new trick, we were getting these e-mails and blocking them out several months ago.

Just when I thought this technique had died out slashdot runs a story about it as if it were something new and cunning the virus writers had just come up with.

In other news...

[Spy der Mann]

people gullible to believe Microsoft's "Get the Facts" campaign are just as gullible to download fake patches.

w00t.

I doubt it has to do with timing...

[MadAnthony02]

Yes, the techies who read slashdot (and other tech news) and who work on computers all day know that Microsoft released a bunch of patches, but I would guess the average user doesn't. I would certainly guess that someone who doesn't know enough not to click on executable attachments in email, and doesn't know that Microsoft doesn't email it's patches to user, would not know that MS released a bunch of patches.

I think Slashdot has overestimated the cunning of the virus author and his timing..

Re:I doubt it has to do with timing...

[MightyMartian]

The fact is that Microsoft (and other companies as well) have time and time again said "We don't email updates/credit card requests/bank account requests/etcetera ad nauseum". People simply are not listening, and I'm not too sure how they will ever learn.

Perhaps if ISPs started actually billing people when they spewed out viruses and spam, that might have some effect. It wouldn't have to be much, a couple of bucks maybe, but the point is, I don't think anything else is going to get it through the average user's head.

Shouldn't there be a tutorial CD or something?

[Spy der Mann]

"Hi, i'm clippy! I'm here to teach you how to use the computer and NOT screw up!"

"This is a mouse. It has two buttons. When you click the right button it's called a right click."

"Whoa! Be careful with that popup! It appears to be a message from your computer, but it's an internet explorer window!"

I mean, they did a good tutorial on 'posting and you', why can't they make a tutorial on using the computer? I'd give the CD to ALL my newbie customers.

I've already installed...

[mdurham]

...a cumulative patch for Windows. It's called Mac OS X.

Re:Oh here we go again. Have a pop at MS

[krbvroc1]

Please do not degrade toilet seats to the level of MS products.

From an article last year http://www.enquirer.com/editions/2004/05/10/tem_te m1germ.html/:

A newly released study claims office workers are exposed to more germs from their phones and keyboards than would be found crawling on a toilet seat. A lot more.

According to the study, from researchers at the University of Arizona, phones have up to 25,127 germs per square inch, keyboards 3,295 per square inch and computer mice 1,676 per square inch.

The average toilet seat? Just 49 germs per square inch.

"Desks are really bacteria cafeterias," microbiologist Charles Gerba, who researched the study, told BBC News.

There you go again.

[Anonymous Coward]

Why are MS users so sensitive about being called stupid?

Re:There you go again.

[Anonymous Coward]

A fine contribution to the discussion - where are the mods?

tomato OR tomato

[Anonymous Coward]

You know what? These social engineerers don't care about the fame and glory. These guys got the user to exec a trojan and are now part of a botnet.

These criminals would rather have less news coverage, to prevent people from learning. You say that the media is hyping them up, I say they are informing the mass public.

"All I want is money, fuck the fame I'm a simple man" -- Tupac

News at 11

[spikedvodka]

"Fake Microsoft Security patch advertising cumulative secrity patch for $MONTH $YEAR found in your inbox is actually a virus"

and in other news

"The Pope is still Roman Catholic"

"most Italians live in Italy"

and

"The weather will be good, unless it's bad"

indeed

[diegocgteleline.es]

is Slashdot somehow suggesting that this is Microsoft's fault in some bizarre, convoluted way?

Indeed, I do at least. If Windows weren't a such crappy design, you could forbid to run such attachments. Because they inherited that thing from CP/M -> DOS -> Windows 95 and they were so stupid to not remove it in NT, they're suffering this now.

If I send a executable with linux and the mailer saves it, unless the mail is crappy it won't have +x permissions and won't work. Because of that, asking people to write "chmod...." in a command line makes it a bigger barrier than the "executability" of .exe files, which you can activate with something so stupid like a double click. I'm not suprised those things spread so quickly.

Re:indeed

[NineNine]

Ok, Personal Computers 101... An "Operating System", such as Windows, OSX, is a program that sits on top of the hardware layer, and gives "Applications" access to hardware, such as the keyboard, monitor, hard drive, etc. Mail is not read by the operating system. Mail is something that the operating system isn't even aware of. Mail is a creation of various applications that run on top of the OS. So, no matter what the OS is, email is email. With that being said, you can read your email with any fucking program you'd like, and you can tell that program to ignore attachments, if you'd like. Saying email has anything at all to do with the operating system is like referring to email as "The Internet".

Obligatory Simpsons Quote

[Anonymous Coward]

'HaHa!'

no.

[Anonymous Coward]

Because then then emails just would say "copy and paste this URL into your browser to install".

Remember, the problem here isn't the programs, it's stupid users. If you are stupid enough to install something sent to you in an email, you will surely find plenty of ways to get yourself into trouble.

Long before the internet, there was already the saying:

"It is impossible to make anything foolproof because fools are so ingenious."

Re:Oh here we go again. Have a pop at MS

[badriram]

I do not see anywhere on the streets while i drive that crossing the white line to the other side is dangerous....

The problem with that statement is very similar to your scenario, except when we are kids we are taught not to cross roads when cars go by, we are then put through training before we get a license, and get tested on it. I personally think it is about time the same was done for the internet, and people with compromised machines for a long period must be charged with fines as well. But then it is not like fines and prison time stops people from driving drunk.

Clear solution

[Anonymous Coward]

The virus writers are the problem and the solution, here. What they need to do is write a good old-fashioned "hose your system" virus. No more of this mamby-pamby dropping a file on your system and emailing yourself crap. I mean sure, go mass mail yourself, but don't stop there!

Let's just corrupt some boot sectors and be done with it! If you haven't learned by now not to open random attachments, then you don't get to play with the big kids anymore.

Re:Clear solution

[DA-MAN]

Agreed, at least then people who click on any old program will just screw their own machine up instead of screwing with the entire internet.

Maybe we should start a sourceforge project?

and this is news because?

[noamsml]

it's not as if anything's new.

Re:Oh here we go again. Have a pop at MS

[RzUpAnmsCwrds]

"After all, where in all of their glossy ads for Windows XP, Office, etc. etc. does it mention that it's important to apply regular security updates, use a virus checker and never open attachments you don't trust?"

How about when you first turn on your computer?
How about the stacks of CDs in Office Depot with XP-SP2 and instructions on why it's important?

How about their website devoted to security information:

http://shortify.org/u1017

They are pretty damned clear on the threats lurking out their. More than any Linux distro. More than Mac OS X.

Remember how we laughed about Windows crashing back in the days of Windows 98?

Who's laughing now?

In Soviet Russia...

[DarkTwin]

Virus attacks trigger patches.

It's a much more general education thing

[jesterzog]

... that the best software in the world couldn't protect you from the stupidity of the guy in front of the monitor. Makes you wonder who is worse: Microsoft or their users?

Not properly evaluating or understanding attachments that are sent via email is synonymous to not critically evaluating any information that's received... such as faithfully believing whatever happens to be published on the television evening news.

Personally I'm not sure if it's so much a computer training issue. A lot of these problems might be solved in one go, if only the education system could focus a bit more on training people to be critical and cautious of all information that they receive.

I'm not trying to imply that this is all the education system's fault, either. Society's just screwed up right now, and there are so many contradictory messages out that that completely undermine so much of what good education actually has to offer.

Re:It's a much more general education thing

[Tesla Tank]

I think the education system contribues to the problem. I am currently enrolled in a major university, my program is computer engineering. A course I took this year is electricity and magnetism. I was taught Coulomb's law, Gauss's law, and Faraday's law with the formula. I had to memorize the formula and accept it as it is. This is not an isolated problem with this course. Most of what's been taught to us is given in this form. We are expected to learn it, and move on. It would be silly for us to question the the validity of these formulas, since they've stood the test of time. However, this system of simply accepting what you've been told has an effect on how we learn things in the future. Personally, I'm not smart enough to think of a better way to teach; but I think more critical thinking should be part of the curriculum.

Re:It's a much more general education thing

[dos_dude]

Somebody working in tech support once told me a very... well... interesting story.

He had a user that received a worm via email. The AV software caught it and denied access to that mail. So she went home and downloaded that message to her laptop. Again, the message was blocked by AV, but she was somehow able to save it to disk.

The next day, she brought the disk to the IT guys, requesting that they open the message so she could finally find out what was in that attachment.

I guess what you say isn't completely wrong. But that story demonstrates that there is more to it than just credulity.

Ho Hum

[kilodelta]

Got to see a Department of Homeland Security presentation on BotNets the other day. They estimate that a large number of systems are compromised because people don't update their machines, etc.

But anyone that has dealt with MS for any amount of time knows that they NEVER email an update. You either get them via automatic win-update, or click on Start/Windows Update.

But this exposes one cruel fact. Most people are ignorant about their own computers. I've made oodles of cash fixing computers that were overrun with adware, spyware, etc. I'm of the firm belief that we should make new computer purchasers sit through a 4 to 8 hour class that details what happens when you connect an unprotected, unpatched computer to the net. For the second part, explain common, open source solutions (Like Popfile for example.)

Then make em' go home for a couple of weeks. When they come back, test them on what they learned. If they score 70% or higher they can buy a machine. If they score lower, make them take the class again.

Hmmm.. that'd be a nice little cash cow.

Re:Oh here we go again. Have a pop at MS

[noamsml]

we are

Speak For Yourself Only , Twit

[nurb432]

Some of dont run around doing things unless they fully understand what is going on.

Going to purchasing and saying ' i have no idea ' is something i personally would never say.

Furthermore, anyone that dosent know the difference between right and left click is a moron and shouldnt be allowed to have a PC.

Come to think of it, that could be extended to most users. They dont need a comptuer, or anything else. They are idiots that mostly waste my air and serve no practical value.

Oh, yay

[shadowbearer]

Another bloody thing to add to my install/tweak notes for new installations of windows for customers.

Joy. There's more than enough in there already.

When is Microsoft going to get some sense?

SB

Depends

[phorm]

It really depends on your mindset. I just did my own brake calipers a week ago. Most people wouldn't dream of touching brakes on their own but they're generally not that difficult.

If I'd screwed up I'd just have to be filling to foot a towtruck and the regular repair bill anyhow.

Get off the internet.

[Anonymous Coward]

our problem? Bullshit.

I didn't buy these ppl computers, nor did I request they use them. I chose my path, so did they.

If you don't belong here, get the fuck out. Here, let me propagandize it for you. For the safety of our children, get out. To make sure we don't offend anyone, get out. To make sure we have 100% uptime and serve our customers, get out. If you don't get out, the terrorists win.

Re:Oh here we go again. Have a pop at MS

[tobybuk]

XP does not do this - it presents a big stop ico dialog with dire warning message.

Oblig. Comment.

[Matilda the Hun]

A child of eleven could understand this stuff! Someone fetch me a child of eleven.

Tip of the day

[leonbrooks]

"Honesty means not having to remember stuff" (-:

This has been going around for months

[IHateEverybody]

I've been getting something like five "upgrade" spams a day since January.

Re:Oh here we go again. Have a pop at MS

[TiggsPanther]

Since when is it Microsoft's fault that people are duped into running this?

I agree with you on this. As much as I am down on Microsoft (and, believe me, I am) and their software I can't see how this particular type of virus is really their fault. What really helps viruses like these spead is user error.

People fall for these things. It could be a Linux exploit, or a Mac exploit, but you'd still get people who'd click on them honestly believing what the message said. Even if it wouldn't auto-execute it'd probably just give a list of official-sounding instructions on how to "protect" their system.

Tiggs