Homeland Security says 'Patch Windows Now'

gregger writes "Wow, so the Department of Homeland Security is really concerned with Microsoft patches now... enough to come out and tell us to patch our machines. This warning, chronicled in eWeek, was issued less than a day after the release of 23 patches from Redmond. So, if you don't apply the patches, then what?"

Comments

Two Reactions

[eldavojohn]

In my country, the United States of America, I have never seen everyone so polarized. As a result, I personally highly value the ability to see actions and events from both sides. It's a becoming a rare trait.

On one hand, this announcement shows that the government is looking out for us. They are concerned about terrorists using our machines to commit acts of cyber terrorism. They are helping us protect ourselves by advising that we patch our machines with hyper critical updates from Microsoft. We should be glad that our government is so thoughtful and has decided to twist Microsoft's arm into fixing these problems and releasing updates. After all, as Americans, nothing is more important to me than my internet. It's my commerce, education, and ... uh ... love life. I wouldn't care if terrorists destroyed every TV & radio station in the United States, but I would riot if I was denied an internet connection for more than a few weeks. They're just protecting my interests much like a public service announcement or a tornado warning. I mean, the US-Cert team has been doing this for a while--even on my Mozilla browser. This "Patch Windows Now or Else..." is just FUD from the Slashdot editors--if you read the government press release, it's merely a recommendation, not a demand, warning or threat to patch your machine.

On the other hand, should we be suspicious? I mean, there have been much more severe critical problems with prior editions of Windows that the government hasn't deemed necessary to recommend. How do we know that these patches aren't part of some sort of government initiative to harvest data? I mean, we've seen it with our phones and e-mail--why not another form of technology? Could it be that these patches will occasionally phone Microsoft who then relays our data and actions to the FBI and/or NSA? Shouldn't we be suspicious that the government has never openly declared critical Linux updates an imperative? Why Windows? And how can we believe them if we never get to see the source code of the original program and the source code of the patches? Two points to note: Why now? And why isn't the government's warning message included with specific reasons and details of what the problems are and what the patch is going to do? These patches might be a wolf in sheep's clothing. I don't think the government is so worried about our interests but more so they're worried about the gathering of intelligence in their case against every single United States citizen.

Re:Two Reactions

[RedHat Rocky]

I personally have only one reaction: disgust.

I don't need nor desire the "government" to hold my hand.
I think the "government" has a lot better things they should be worrying about.

But mostly I blame the "government" for allowing the situation with Microsoft to exist.

By "government" I of course refer to the current administration.

Re:Two Reactions

[Billosaur]

It seems to me that if the terorists wanted to cause chaos and confusion, they've been doing a good job. Look at how we have to analyze this to see just what the DHS is up to, rather than simply thinking "Hey, patching my copy of Windows is probably a good idea." It's funny that when Microsoft says apply the patch, we dutifully go about it and grumble about all the bugs in their software, but when DHS says to do it, it's part of some sinister plot... or is it? We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job. THe thing that maes this problematic is that DHS is being pretty cryptic, and they have no track record of doing this. It'll be interesting to see if this happens again when the next MS patch cycle occurs.

Re:Two Reactions

[Das Modell]

I don't really believe that Windows would transmit anything to the government (and I don't even live in the states so whatever). Someone would have figured it out a long, long time ago. Seemingly everything is hacked, cracked and exposed these days, Microsoft is under constant scrutiny, and I'm sure a lot of paranoid people have been trying to find out if Windows is sending sensitive data to Microsoft.

Re:Two Reactions

[Jimmy King]

We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job.

It's not so much that people have failed to notice the government doing their job for once, several people have shown appreciation of it. It's that the government has been doing corrupt things and not protecting us for so long that people question whether they're really trying to protect us this time. It's kind of like that scene in a lot of movie revolving around highschool, where the popular kids constantly pick on and beat up the dorky kids. Then one day they invite said dork to a party, the dork thinks "wow, they've changed their minds and like me", only to show up and get their ass kicked and/or be the butt of some school wide joke.

Re:Two Reactions

[betterunixthanunix]

Shouldn't we be suspicious that the government has never openly declared critical Linux updates an imperative?

Two reasons for this: market share and business interests.

Windows simply has a bigger market share, which makes critical flaws a far bigger threat. It is just easier to gather up a botnet of 50000 Windows machines before somebody notices than to get that many *nix machines.

And the government is interested in what businesses need. Microsoft has been campaigning for years against Linux, which gives the government an impression that Linux presents a serious threat to Microsoft. Since most people have the impression that FOSS is anti-business, even people in the government, there is no pressure to pay any attention to it.

And there is also the question of visibility. How many times have you heard of a major *nix virus in the news? How many times has it been Windows or MS-Office?

Re:Two Reactions

[LS]

I'm sorry that you are so scared of the truth that you jump at such a weak opportunity to keep the rug from being pulled out from under you. Who are "they" that you speak about? You say this as if you actually prefer strong authority figures keeping the world in order for you because you are unable to do it yourself. There is no "they" that either care or don't care for this country and its people, becase the government is made up of thousands upon thousands of people with different ideas and goals, some of them good, and some of them very sinister. Stop laying your parental fantasies on top of the government, because others like myself prefer not to have these nannies looking over our shoulders, especially when some of them have already proven to be homicidal.

Re:Two Reactions

[PFI_Optix]

I don't need nor desire the "government" to hold my hand.
I think the "government" has a lot better things they should be worrying about.

I don't see where this is anything close to hand-holding. You aren't being forced to do anything, the government isn't doing it for you, and if you don't do it, they aren't going to come after you. There's nothing wrong with a PSA that encourages people to secure their computers.

And if you really need a reason for it all, it costs tax dollars to deal with things like identity theft and stolen information. By encouraging people to secure their systems, the government may reap a long-term benefit of lower expenses and increased revenue without raising taxes.

Re:Two Reactions

[ArcherB]

But mostly I blame the "government" for allowing the situation with Microsoft to exist.

By "government" I of course refer to the current administration.

Uh... M$ was making buggy software long before the "current administration" came to power. Just like the plotting for 9-11, wars between Arabs and Israelis, wars in general, global warming, hurricanes and so on all predate the current administation. I'm not saying the current admin is perfect or that previous admins are 100% to blame, but I think you need to spread that blame around.

It's bad enough people think that history began when they were born, but there is no excuse for thinking all problems began less than seven years ago, provided you can read.

Re:Two Reactions

[maxume]

DHS is a big, stupid bureaucracy. Get used to the fact that they are far more concerned with appearing to be doing something than they are with actual security.

Announcing that it is a good idea to apply security patches to computer systems is a fairly safe way to appear busy.

The security level bullshit is another great example -- if they think something is neccesary during a 'red', then it is probably a good idea to do it during a 'yellow', as their intelligence is bound to not be perfect. Announcing the 'red' and then doing stuff related to it makes them look busy.

Re:Two Reactions

[ExE122]

Wow, look at the replies... I love how aroused everyone gets over the prospect of a possible government conspiracy. I think the government really does have its priorities, but monitoring 10 million computers to find out what porn sites people like to visit isn't one of them.

From the article: "This vulnerability could impact government systems, private industry and critical infrastructure, as well as individual and home users"

I think that statement is pretty much an ordered list of government priorities when urging these security measures. Why is the government getting involved? They're looking out for their own interests. The average government worker is likely sitting on a windows workstation right now, surfing the internet with IE, creating a presentation in Powerpoint, running some calculations in Excel, or typing a document in Word... and they probably don't even have the administrative rights to run their own updates, so they sit around waiting for some IT grunt to get off his lazy ass and do it for them.

Even as we speak, I'm sitting at a Windows work station without version management and without admin rights. I have to use the company standards of IE and Office because I can't install Mozilla and OpenOffice. I don't even know if our IT department is aware that they need to run any patches. I haven't seen them do it since I've started working here. And what's worse, I'm working for a government contractor which is always making a lot of fuss about security!

Which brings me to my next point. The government is also looking out for industry and commerce. I'm sure you've noticed the U.S. economy isn't what it used to be. The last thing this country needs is a cyber attack wreaking havoc among businesses and putting even less trust in online commerce than there already is.

Shouldn't we be suspicious that the government has never openly declared critical Linux updates an imperative?

Actually, the DHS has funded open source security auditing. Its true, they have never made it an imperative critical update, but you have to take into account the users and usages of open-source products. If you've installed and/or administrated Linux, its very likely you have enough know-how that you don't need a government warning to get you to stay on top of security patches.

Windows, however, is the most widely used operating system, especially for people who don't have the first clue about security or administration. How many Windows users out there use Administrator as their standard account? People like that need to be warned about the importance of updates.

While I'm not going to deny the possibility that they do have more up their sleeves, I think the past couple years have made me less likely to don the tin foil. With the terrorist attacks, resulting WMD wars, Gee Dubya elections, and blatant fear-tactics, I've really begun to realize that "government intelligence" truly is an oxymoron.

--
Take off every sig. Move sig for great justice.

Re:Two Reactions

['nother poster]

This is unprecedented action. Why now?

Well, the first time anyone does anything it's unprecedented by definition. ;) As to why, because they felt it was necessary. The reason for the necessity is left as an exercise for the reader since I have no idea. Maybe the government wants to p0wn your PC more than they do already. Maybe they know of a specific threat from an enemy state or terrorist group and are taking precautions. Or maybe, just maybe, they are sick of 50,000 zombies spamming herbal Viagra ads to their personal e-mail accounts.

Re:Two Reactions

[SpaceLifeForm]

I'll just note that DHS is a heavy windows user,
and they have a vested interest.

Re:Two Reactions

[MECC]

How do we know that these patches aren't part of some sort of government initiative to harvest data?

Because the government isn't that competent or clever. The effective 'intelligence' of any organization is inversely proportional to its size.

Re:Two Reactions

[B11]

but when DHS says to do it, it's part of some sinister plot... or is it? We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job.

Given the track record, why are you surprised? And since when is it wrong to question government's motivation? Are we just to assume they have our best interest at heart? On a less cynical note, why would I take the computer advice of an agency that came up with the color coded alery system, and the "in case of chemical attack, duct tape your windows shut?" I'd almost trust the "Geek Squad" over the DHS on computer security issues.

Re:Two Reactions

[Silverstrike]

That's a completely nieve sentiment. I'm sorry, but government, at least in some form, is absolutely necessary. How do I know? I'm human. And by and large, humans are greedy, amoral, unethical creatures that left to their own devices lie, steal, cheat, murder and rape their way through life. Don't believe me? Look at any area of the modern world lacking a strong government, like Africa.

Now, since government is comprised of humans as well, it also must have checks and balances in place to ensure that those in power don't lie, steal, cheat, murder and rape their way through life, much to the misery of the people they rule. For examples of this, see any totalitarian regime. ie: North Korea

You say this as if you actually prefer strong authority figures keeping the world in order for you because you are unable to do it yourself.

Are you able to keep the whole world in order? You do realize at there's 6 billion people on the planet right? Most of them would kill you, your family, and everyone you know, if it made their lives even marginally better. So go ahead, try to "keep the world in order", I'm sure that'll work out great for you, by yourself. What's that? You'll get some friends to help? You do realize you just created a government then, right? Albiet, an informal government that probably would rule by force. Good job.

All that being said, I do value my privacy and freedoms greatly. I wish the government would stay out of my life. However, I also appriciate the fact that the crazies down the street know that their asses will end up on jail, should they try to hurt me or my family.

Re:Two Reactions

[twofidyKidd]

We (The slashdot conflux) have always advocated improved computer security, particularly in the case of the Windows operating system. Patches have proven to be an effective method for maintaining said system against such related problems, and from the position of the corporate sys-admin down to the family's IT technician, we've always made it a point to ensure the most updated patches were in place. Now it's finally a matter of the government's to help ensure all the citizens of this country take similar steps.

Should we: A) rejoice because someone of authority has finally been sold on Windows security through patching by some qualified expert, B) assume that there's a greater conspiracy at work here which involves improving the government's ability to surveil their constituency, or C) imagine that there's a very legitimate, non-civil-liberties threatening need for the government to urge the users of the majority operating system in the United States, and very possibly the world, to maintain their systems at a sensible level of security? Maybe Al-Quaida (sp?) communicates via holes in certain unpatched systems (wild-guess speculation), or maybe terrorists are being funded by income brought in by spam-bots and zombie machines (plausible).

The real problem is that our cynicism makes viewing realistic possibilities hard to imagine, and our tools go logical deduction sort of seem to fail. Occam's razor can't be used in a situation like this because time has proved over and again that the interests of people at the government level aren't always in the interest of people at the constituency level. This is one of those times that we (the slashdot conflux) would like to imagine that someone (like Lawrence Lessig or Brad Templeton) has finally said something to an official that he finally understood and as a result has taken this action, but since we often have a hard time getting our own management to listen to the good ideas we put forth, we're hesitant to believe such a thing has happened. In fact, given the recent history of our government, we're much more inclined to consider a sinister purpose. The DHS press release has many of the "hidden agenda" trappings, like specifically indicating which patch to apply, as well as the call of immediacy.

Just to put things in perspective; right now, Britons are unloading all liquids and gels into trash cans prior to boarding US-bound planes, while we're wondering if the US government is acting in our best interest by adamantly suggesting we patch our Windows computers.

Re:Two Reactions

[NeutronCowboy]

I think before calling people naive, you might want to check what said people are exactly saying. No one said (and certainly not the post you replied to) that governments should be abolished. No, what he said is that if some government is good, more government is not better. There are many instances where it is patently obvious that more government is actually far, far worse than no government at all. And one of those instances is, gasp, Africa. Far from being weak governments that wreck havoc there, it is the strong, autocratic and centralized governments that are responsible for the worst abuses. Darfur is not a problem because of too little government, it is a problem because the government cannot be stopped by the population it is terrorizing.

Again - the central problem raised is not that government in general is bad. The central point is that more government is not the answer to government problems.

Re:Two Reactions

[Anonymous Coward]

> That's a completely nieve sentiment. I'm sorry, but government,
> at least in some form, is absolutely necessary. How do I know?
> I'm human. And by and large, humans are greedy, amoral, unethical
> creatures that left to their own devices lie, steal, cheat,
> murder and rape their way through life. Don't believe me?

Wow. Remind me not to leave you alone with the kids.

> Look at any area of the modern world lacking a strong government,
> like Africa.

You don't suppose that poverty/a screwed economy could have anything to do with it, do you?

> Are you able to keep the whole world in order? You do realize
> at there's 6 billion people on the planet right? Most of them
> would kill you, your family, and everyone you know, if it made
> their lives even marginally better. So go ahead, try to "keep

O.K... Everyone back away from the parent poster slowly. Try not to show fear or your skull might be crushed so he can grab that nice mechanical pencil you're holding.

so....

[Anonymous Coward]

this means the gov't mandated backdoor has been placed in the update queue?

Re:so....

[milamber3]

Seriously, people are laughing at the parent post but they would have laughed at a sacastic post about the NSA getting warrentless taps to listen to our phone calls in the recent past as well.

Typical over-reaction from the Slashdot staff

[Megaweapon]

It's just a recommendation, and they've been doing this for a while now. Perhaps this is to save a little face for the massive Rails exploit posted just a few stories below?

malware

[Blighten]

So, does this mean that the creators of malware/viruses/spyware are going to be classified as terrorists?

Re:A plot?

[Red Flayer]

Or it could be DHS making a publicity move. They've got to justify their budget to the public somehow, and a lot of what they do is behind-the-scenes stuff.

Also, to be cynical as ever, we DO have elections coming up in a few months.

As far as I'm concerned, the boy has cried wolf far too many times for me to react to any warning DHS or any other governmment agency says about threats.

solution

[larryau]

Use linux.

Sorry, slashdot is just tinfoil hat heavy

[AHumbleOpinion]

What a remarkable commentary on the sad state of affairs in the "Land of the Free" that our government makes a press release regarding patches to our computers and the first thing we think of is that the patch is associated with monitoring us somehow. For the record, I had the exact same thought as the OP and agree 100% with what he said.

Sorry, but these two post really comment on the sad state of affairs on slashdot. Slashdot is a bit heavy with tinfoil hat types. One of the primary rules of espionage is to just blend in, fade into the background, don't call attention to yourself. If the government were to do something like this, and I don't believe they would, it would be quietly slipped into a run of the mill security update. Nothing special, just a routine monthly security update like the ones we have come to expect.

Re:Sorry, slashdot is just tinfoil hat heavy

[The Spoonman]

Sorry, but these two post really comment on the sad state of affairs on slashdot. Slashdot is a bit heavy with tinfoil hat types.

Perhaps, but I would argue that the growing number of tinfoil hats is due to the growing amount of government misconduct going on right now: erosion or outright removal of basic rights, blatant collusion with corporations to screw as much money out of consumers as possible which includes rewriting emminent domain to allow corporations to take people's property, spying on the populace's phone and financial records, a growing theocracy hell-bent (pun intended) on ensuring EVERYONE follows christian beliefs, no matter how whacky. Let's not forget trying to subsititute "intelligent design" as actual fact in the classroom, all the while calling global warming "junk science".

And, as bad as all of that sounds, that's just the small stuff. If we start counting in the current jihad...er, crusade...uh, "War on Terror"...yeah that's it...well, the atrocities just keep adding up.

As the old adage goes: "just 'cause you're paranoid, don't mean they ain't out to getcha."

Re:Sorry, slashdot is just tinfoil hat heavy

[AHumbleOpinion]

But a lot of people don't download the updates, which could be the reason for the warning.

The updates are automatic. You have to manually disable that feature. Do you really think the type of person who would manually disable automatic updates is going to run out and do whatever Homeland Security says to do?

Re:Sorry, slashdot is just tinfoil hat heavy

[AHumbleOpinion]

... a growing theocracy hell-bent (pun intended) on ensuring EVERYONE follows christian beliefs, no matter how whacky ...

Sorry, but you're going to have to go find some impressionable young mind that doesn't know any better to buy that. I'm old enough to remember how Reagon was demonized just like Bush Jr., how Reagan/Fallwell were going to turn the US into a theocracy, ... I'm old enough to remember how Gore was going to outlaw free speech in music and movies, ... I'm old enough to remember how Clinton was demonized, how Clinton was going to turn the US into a socialist state subserviant to the UN, ...

The truth is the people, the voters, are in control. Politicians of the left and right are only getting away with what the voters *allow* them to get away with. Stupid crap happens because the irritation level does not rise to a level that motivates enough voters. When politicians do cross that line they get whacked down by the voters.

because they got hacked

[stormi]

I'm sorry but all of these conspiracy theories floating around seem completely ridiculous to me. If I were to guess why the government is recommending we patch Windows, I would say it's because they got hacked just a few weeks ago and there was an article on slashdot about it. This is probably their lame way of covering up or making things right again, even though anyone who cared has obviously forgotten about it by now anyway. Microsoft's advice to them on how to not get hacked was probably along the lines of "patch Windows regularly" and they probably bought it. Now the Government says to the Vulnerable Public, have no fear! We have it figured out! It happened to us too, but we know you need to patch things!

Just my two cents.

This can mean two things

[Opportunist]

First, if you consider your government to be benevolent, that the security hole this patch should fix is so critical that it does not only affect you, and your machine, but also the rest of the net, by the very simple reason that your machine is connected to it. Governments are rarely if ever concerned with the well being of a single citizen (seriously, it does not have the means to), it is concerned with the well being of the total populace. So it didn't care about the security problems that opened your machine and compromised your security, but it is concerned with security issues that allow an attacker to use you to affect the rest of the net.

Second, if you consider your government to be malvolent, that this patch introduces a better way to eavesdrop on you, that it opens up a spying channel for them, that it removes some security means that allow you to encrypt data better than they can decrypt them with their sniffing tools or that it's the first step to putting the blame on you should your computer inflict some damage to something "important" under the control of a trojan.

Which one it is is up to you.