Slashdot Mirror
95 Of Every 100 Windows PCs Miss Security Updates
An anonymous reader writes "From Computerworld today: 'Nearly all Windows computers are likely running at least one unpatched application and about four out of every ten contain 11 or more vulnerable-to-attack programs, a vulnerability tracking company said today.' The new data comes from Secunia's free security-patch scanner the Secunia's PSI. The complete data run-down is available here."
Well shit! this would explain all that stuff about windows and viruses I keep hearing about....
"Be light, stinging, insolent and melancholy"
So the point isn't about Windows... the point is about users.
This isn't really surprising, given that most people treat computers like just another appliance. Then again, not every piece of software alerts you when a new version comes out, so actually keeping 100% of all software on the box current is harder for Windows than say, Ubuntu.
...just the legit licensed ones they're talking about or *all* Windows PC's?
This kind of data ought to prompt serious developers to drastically re-think the current desktop security paradigm. Whether it's Windows, Mac OS or Linux, the premise is that the software will frequently prove insecure or deficient and regular updates are required. We expect users to OK these updates and wait for them to take place.
Obviously 95% of people aren't doing this, so what do we change to fix that? We need to have some combination of the following:
Personally I think the ideal solution would be to first lock the desktop down. Nothing listens on any ports, ever, unless the user downloads and installs something new. Strip out relatively unused functionality, because it's not worth the security tradeoff. No more Internet Explorers: the specific people responsible for fuck-ups so disastrous and far-reaching ought to be named, shamed, and unemployed. The same goes for the clown responsible for Ubuntu storing the root password in plain-text during installation, if you're concerned about balance.
I know this is all a pipe-dream, and nothing will ever change. What I secretly wish for is for something on the scale of the Storm Worm, only more malicious and destructive. If somebody gives the public something serious, like a computing 9/11... I don't know... Wipe all their stupid mp3s and photos or something. Really drive it home into the public conciousness. Maybe then they'll understand that the internet is serious business. Also I'm drunk, which if Taco had the slightest clue what he was fucking doing in Perl, would mean an automatic +1 Drunk post score bonus. Fuck you Rob, all this fucking JavaScript has ruined Slashdot for me.
I am not to suprised I would think this is constant 95 out of 100 Linux boxes are missing security updates 95 out of 100 Macs are missing security updates.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
When I look at people's computers these days they have heaps of different software popping up asking for updates, its got to a point where people ignore it, because its much too common.
The thing that annoys me most about update alerts is they never give you a reason why the software should be updated. It would be nice if they would give you a link or a summary of simple reasons why you need to actually update their free crapware.
Java and adobe products are probably the worst with this.
They're looking at EVERY piece of software installed on the computer, not the OS itself. They're doing this along with a very generous definition of "security update" to come up with hugely inflated numbers so they can better scare the clueless into buying their services.
Anybody who is remotely worried about security is probably not going to download a tool that reports your security status to another organization.
Run Microsoft Update not windows update on windows system to get all of the windows base os + other APIs and runtimes + office updates.
Many people have a bad impression of updates. They know for sure that updates slow down the computer and they know for sure that updates have previously broken things. So you have a choice: 1. Install something that will degrade your computer (possibly making parts of it unusable) or 2. Don't install it and just hope that you don't open a bad email or something, after all practically speaking viruses aren trojans are quite rare.
With all the pre-installed trials and other crapware the comes with home computers it is likely that many of these unpatched applications are ones that are not really at risk since they are never used. I see this even at work, where we run regular vulnerability scans. You tell a user that they need to update and get told that they haven't used said product in .
Except for the occasional windows patch, I don't think most of the patches really offer much benefit for the casual user. Is a tiny reduction in your vulnerability worth the effort/time it would take to run the update software/visit the manufacturer's web site for every piece of software that you own? I think the article would be more powerful if it stated 95 out of every 100 crash/identity theft/virus attack would have been prevented by a patch.
Agreed, users SHOULD update their software regularly. However, one thing is having the will to update software, and a very different thing is having software with the need to update every 4 weeks!
Some versions of PHP, OpenSSL and Apache are buggy. Granted. However, not all users have a webserver on their machines. The problem is when the software they're running (i.e. Windows) is so crappy and awfully designed that its security has more holes than swiss cheese.
Appget. It is what I use when I need to update a pc someone has brought me in for repair. It will show the occasional false positive, for example, saying version 1.5 is newer than beta 2, but otherwise a quick and handy way to update a pc. One of the best things about it is you can make it better by submitting download links to software that isn't in the database. The more folks that use it the better it gets. And the developers are really nice about emailing replies and fixing bugs when you submit them. So if you need a free tool to quickly find out version numbers and update a pc's software, here you go.
ACs don't waste your time replying, your posts are never seen by me.
... Windows Update tells me that the only update I need is "Windows Genuine Advantage", which I don't want, anyway. No other updates needed, since Microsoft told me that WGA wasn't necessary to get security updates... just "new features".
Yeah, right....
We in dual-boot land call them "driver downgrades".
Just look at the "fixes" in MS Office 2003 in the last SP.
Those removed the ability to open older spreadsheet formats we still have data stored in, so we had to roll them back.
And most of the fixes were already done when we switched to the more secure Firefox as our default browser and got rid of all Outlook instances.
-- Tigger warning: This post may contain tiggers! --
We deployed it at my previous job, for 1100 machines. I found it a huge waste of time with large numbers of machines unable to update, or only partially updating. Almost none were completely updated. Status reports were off, reporting missing patches that I KNEW were on the box (installed manually and verified). I'm pretty sure it reported patches on that weren't. So not only could I not rely on it to do the job, I could not rely on it to tell me where it had succeeded and where it had not. I found it marginally better than nothing, not a solid enterprise ready tool.
It will take MS another 10 years before it's products are enterprise ready. Enterprises use their stuff anyway, but the products aren't ready.
... at least if they are still running Windows.
MS needs to come out with a common update system that is easy for games and other apps to use and is free for developers to use. Then you can at lest get rid of having to deal with games and other apps having there own built in updaters and needing admin just to run them as some force you to get the updates to use them. This system can also make it easy to keep your whole system up to date. You will just need to be an admin to run that common update system or even let it be setup to auto run in the back round at system level. Also MS needs to let get the all of the updates form windows update using auto update. Runas does not work for windows update in windows xp and 2000 and you need to run that to get the Optional updates.
Most auto-update applications have something like this:
Check for updates:
*once a month
*once a week
*once a day
*every time you run it
OK the last item is missing from many applications. I bet most people run "unpatched" applications in the first hours after an update.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
This isn't entirely the fault of users. One of my major complaints about windows updates is that they so often require a reboot. This is disruptive for any user, it's understandable that people would want to avoid that and "update later" (which is always forgotten). If windows updates were as minimally disruptive as possible (and I know for certain that reboots can be avoided almost always) users would be much, much more likely to allow automatic application of windows updates.
That doesn't help much if the exploit targets Firefox or Adobe Reader or Photoshop or iTunes or...
The cake is a pie
Well, your department, maybe not you personally. I have no idea what the office politics are like there, so I don't know what's actually stopping you from implementing best practices...
There's nothing magical about WSUS.
I don't know how easy the tools are, but you should be able to build and maintain your own repository for your distro of choice. Then just add a daily cron job to each machine, forcing it to update. If it's a desktop Linux machine, institute a policy that machines get shut down when you leave -- thus allowing you to upgrade the kernel.
So you're right, it has nothing to do with what OSes are being run. But you're wrong to blame the users here -- many of them (rightly) feel that this should not be their job. I get to admin my own machines where I work, so keeping them up-to-date is my job -- and also my responsibility; there's no IT department to blame if something goes wrong. But in an organization which does have an IT department, even if it's a one-man IT department, keeping the system up to date should be IT's job.
Don't thank God, thank a doctor!
And what will update my video drivers?
Oh, whoops -- nvidia doesn't have ANY automatic update.
So yes, Microsoft Update is a start, but until it's just a generic Update feature which all apps can hook into, it's pretty useless for keeping the whole system up-to-date.
Don't thank God, thank a doctor!
Ripping off Sudo was a good start, but they really need to learn some lessons from Linux package managers.
OS X has the same problem, by the way. Linux distros are really the only place you see a system-wide package manager.
Don't thank God, thank a doctor!
The report from Secunia is based on their users' PCs and thus is not statistically valid (has there ever been a statistically valid survey reported on Slashdot?). In addition, they have a vested interest in reporting a high number in order to promote their non-free version.
I wonder...of all of these unpatched systems, how many were pirated? That was the big stink when MS briefly turned off updates for non-verified Windows installations. Maybe people are afraid to update their pirated MS Office stuff in fear of being caught?
Well, I wouldn't say I've been "missing" them.
They don't even know they are there...
I run Secunia's PSI, and I noticed a few flaws, which pretty much catch anybody. For example, it lists seven instances of Sun Java JRE on my computer, three instances of Adobe Flash and two instances of Adobe Reader. On top of it, it lists several instances of Macromedia Flash as "End of life" software. Obviously, all of those listed have been upgraded to recent versions, but the older versions either weren't properly removed by the upgrade, or Secunia never updated its database on my computer. Be it as it is, if you run a Windows PC and have Flash or Java installed, your computer will fall under the 95% of insecure computers regardless whether you update or not.
It's about BOTH. Pretending it's only about one or the other is an attempt to purport that the quality of Windows does not even enter into the equation and thus that the quality of all OS's is effectively equivalent. This is obviously false, the crappy quality of Windows most DEFINITELY has a lot to do with it too (and this is why the parent was also rightfully modded flamebait).
Click the "Start" button, Shift-right-click the Windows Update icon, select "Run as...". Alternately, start Internet Explorer as Administrator (Shift-right-click) and run Windows Update from the "Tools" menu.
First you should be running Microsoft Update and you need to be admin for it to fully work. They must of changed windows update / Microsoft Update to some what work with runas in the pass you got the admins only page / updates failing to install.
If you buy a game for PS2 or Gamecube at least you know it will run the next time you try to play it (I'm not sure about Wii/PS360 though).
And people like Adobe keep "upgrading" their licenses.
I wouldn't really say I've been missing my updates...
keep your NSA KEY and remote exploits up-to-date!
Be sure and keep your diary on the same partition as your porn so chair thrower can masturbate while reading your adventures in loser land while wearing SUSE lizard pajamas and fondling Silverlight within Runescape.
Security updates are a damned if you do, damned if you don't situation.
Would you rather have the poison of known-broken code with a known exploit, or the possibly-good-possibly-fatal-poison of the latest patch?
For servers and users who run a predictable workload with a predictable exposure profile, "known code" is frequently the safer option. For users who surf the web randomly using IE with possibly-buggy firewalls and likely-incomplete virus protection, and who could trip over the next "MS just patched this hole" bug the day after Patch Tuesday, keeping updated may be worth the risk.
In either case, back up early and back up often.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
So Microsoft should be responsible for all the updates for every POS crapware and trialware and Bonzi Buddy program out there? And they should provide this to free to every person who wants to include their updates in the program? And none of these "altruistic programmers" would EVER try to sneak their potential spyware updates into the program at all would they.
And no one would blame Microsoft if they did provide this and somehow, someone installed spyware on every machine that used to program.
Yeah, that makes perfect sense....
I am an IT person who constantly updates the operating system and software at work. I know another IT person who almost never updates the operating system at his work. He has less stability problems than I have to deal with. So go figure. Perhaps some places have the thought process of if it aint broke they won't fix it.
At home I never update my computer or my software. I have adobe photoshop cs3 and Windows XP service pack 2. I never go to any websites except ones I trust, I only run programs I have purchased, and I only open email attachments that I trust. I've never had an issue. If I ever do, I'll just restore the info I don't want to lose from back up. Although I can't take this approach at work, I guarantee I have saved labor hours at home by taking this approach.
I'll secure my operating system by keeping it behind a good, configured firewall, not using IE for ANYTHING EVER (EVER!), and not visiting shady sites and opening spam. This is far from "secure", but its a passable system for user who knows about computers and realizes what s/he is clicking on. In addition, these solutions can be applied to any operating system, not just windows. To be fair, my personal laptop is running win2000 tho.. and i use XP SP2 at work, updates are forced by group policy.
I'd say I know something similar to package manager for windows...
;) ) and allows you to update the apps you want when you want...
It's Valve Software's Steam... Ok, nowadays it's predominantly used to distribute games but who says it couldn't provide other kinds of applications? I know it's not perfect - you cannot choose mirrors and it has only god (or some admin at Valve) knows what info it send home, but it's something that does exactly this kind of job - it keeps a list of apps (games) installed on your machine, provides you with info on updates (and related products of course
just a thought...
First of all, Steam has no provision for third-party stuff, other than signing a deal with Valve. This makes it about as useless as Microsoft update, or Apple's Software Update.
But there are a number of things I can't do with Steam that I can do with real package managers:
I could go on... Most of these seem pretty minor, though, aside from the fact that Steam is yet another proprietary auto-update mechanism, and thus only works with Steam games. So now I need Microsoft Update and Adobe Update and Sun Update and Firefox Update and Software Update and Steam Update, too.
So, really not a solution until it actually starts replacing the other auto-update mechanisms.
Don't thank God, thank a doctor!