Slashdot Mirror
1 In 3 Windows PCs Still Vulnerable To Worm Attack
CWmike writes "The worm that has infected several million Windows PCs, Downadup or 'Conficker,' is having a field day because nearly a third of all systems remain unpatched 80 days after Microsoft rolled out an emergency fix, security firm Qualys said. Downadup surged dramatically this week and has infected an estimated 3.5 million PCs so far, according to Finnish security company F-Secure Corp. The worm exploits a bug in the Windows Server service used in Windows 2000, XP, Vista, Server 2003, and Server 2008. Qualys' CTO said, 'These slow [corporate] patch cycles are simply not acceptable. They lead directly to these high infection rates.'" This is indicative of why some are calling for Microsoft to rethink Patch Tuesday, as reader buzzardsbay pointed out.
This is why I recommend everyone have a router installed on their internet connection, even if they have only one PC. Routers inherently block almost all worms.
I know a lot of people who are afraid of updates because of the genuine advantage validation. They got student priced versions of the software 5 years ago and are no longer students. They don't want to risk losing Visio/Word/PowerPoint or having some other software disabled on their computer.
The fear factor of automated reporting/validation is stopping a lot of people from running the updates.
Jeez, with virus scanners, several types of automatic updates, and other gadgety things polluting the standard corporate desktop, it is a wonder that people can get any work done on their PCs anyway. Six Inches of Air.
Zhrodague.net - I do projects and stuff too.
If my years of tech support taught me anything it's that 9 out of 10 Windows users are more damaging to computers than anything else.
Do you D?
With all this talk of Microsoft losing money, maybe they should get into the botnet business for themselves. Vertical integration!
How much downtime is caused (money is lost) by patches that break things versus how much money is lost when machines get hacked? This isn't a windows only issue. I've seen Debian security releases break things too. They're a bit easier to rollback, but the problem is fundamentally an ROI or EV problem, not a technical one.
What drives me absolutely nuts is how people who are not computer professionals talk about patches with contempt. In any magazine article about an operating system, whether it be from the Windows family, Mac OS X, or Linux, when the subject of patches comes up, the writer will usually say something to the effect that a downside of using this operating system is the high frequency of patches.
In a perfect world, software would have zero bugs (security holes are bugs, too, if you think about it). No product would have any problems. Everything would be perfect. There would be no need for patches.
But unfortunately we do not live in a perfect world, and software does have bugs. When patches are available at a frequency such as daily (as is sometimes the case if you use Ubuntu, patches not only for the OS but for any programs you have installed too), or every few weeks as is the case with Mac OS X, you know that people behind the product are responsible, are continuing to develop and refine the software, and you benefit from those refinements at the frequency of the patches.
We all know this, yet because many people feel contempt toward software patches, and because magazines and newspapers write inaccurately about this subject, many boxes out there are vulnerable to many types of attack, and this won't change any time soon. I think some effort needs to be expended by the marketing departments of various software companies to convince people that patches are good, not bad.
I just had one additional thought about this Windows patch. Perhaps some of these boxes are using illegitimate copies of Windows and are therefore ineligible for the patch?
I'm immune to the worm. I'm still running Windows98 and it doesn't have "Windows Server service" and all that other wormbait crap.
Oh, hold on.... I'll be right back. I've been online 40 minutes and I need to reboot.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
It's also not acceptable that corporate desktops become useless because of an update that MS rolled out that broke mission-critical software.
There's a reason there's an IT vetting process with patches (fool me once, shame on you... fool me twice, three times, every patch tuesday, shame on me). There's also a reason why those processes take a while. If you disagree with IT workers doing their jobs and making sure that an update won't screw up the network/application/productivity/company, take it up with software vendors and MS, not with the people who are trying to make sure their company stays functioning. Or will you be willing to pay for their time in fixing problems if they apply patches that break things?
The update was issued in October.
If you haven't patched, there's no fault of anybody but your own.
If your car has a recall for a safety belt problem, and you don't get it fixed and get into an accident, is it suddenly the car manufacturer's fault? No.
And likewise it's not MS's fault if you can't install patches on your OS.
The price is always right if someone else is paying.
Have you ever tried managing 17,000 desktops? No, didn't think so.
Most large corps run WSUS, with updates on a weekly schedule, at most. To do otherwise would cripple the network, or require such an investment in equipment and manpower as to be nearly impossible to pull off.
Having said that, most large companies also have a mechanism for quick-release of highly critical patches. I know we rolled out the MS08-067 patch to our desktops immediately, and had a 98% acceptance rate within 3 days.
Killing the RPC service effectively kills the computer. Pretty much everything is dependent on it.
It's basically like running in safe mode, but without the "Safe Mode" in the corner of the screen, and with more stuff that doesn't work.
Like the Event Viewer. You can't even see the list of events in the viewer if the RPC service isn't running.
It's ugly. Don't do it.
"City hall" in German is "Rathaus" Kinda explains a few things......
Although I do use and support Windows every day, I don't claim to be an expert on the Windows services and the apps that need them....
But yes, I *do* believe you need to leave the RPC service running in most circumstances. The fact it is called "remote" doesn't imply it only relates to remote computers on a network. Rather, it means separate program modules, even running on the SAME machine. Service Pack 2 for XP turns it on by default, and even grays out the option to disable it - which is a strong hint that you're supposed to leave it running.
A list I found on the net of things that require RPC in Windows include:
Background Intelligent Transfer Service (Used by Windows automatic updates)
Cryptographic Services (Used by Windows updates, both automatic and manual)
Distributed Link Tracking Client (Maintains links between NTFS files)
Help and Support System
Logical Disk Manager
MS Software Shadow Copy Service (MS Backup requires this)
Network Connections
Print Spooler
Protected Storage
Shell Hardware Detection (Do you want to play a music CD? You need this)
System Restore Service
Task Scheduler
TrueVector Internet Monitor (Required by ZoneAlarm, and probably other apps)
Volume Shadow Copy (Backup uses this)
Windows Audio
Windows Installer
Windows Management Instrumentation (Many apps depend on this service)
All that does is drops unsolicited messages, kinda like the windows fire wall does, which has been activated by default for almost 4.5 years.
In really big shops the bottleneck is usually testing patches against a zillion weird|old|crazy applications that someone, somewhere absolutely needs.
lol, trust me, it would take a lot longer to get this network working under linux than windows, and that's before you count the couple of dozen specialist apps that simply don't exist in Linux. Linux is good, but it really isn't the answer to everything. I'm not aware of anything that as easy to use and effective as group policy for securing computers and deploying software. I can rollout new versions of some of our apps to 100+ computers in under ten minutes of my time (and that includes the download!).
Having said that, my own workstation is running Ubuntu 8.10, and we have a good few Linux servers now :-)
However, I think you'd be surprised just how low maintenance this lot is. Yes, it took some setting up, but we're reaping the benefits now. To give just one example, patching software is something we can do in our own sweet time, even though we use WSUS we run 2-3 months behind and let other people do the testing :)
I believe the original poster meant to say "Household Routers". I would say 99.9 and probably even a higher percent of "Household Routers" do NAT since most if not all people that use them do so to share one IP address among all their home computers.
Every single windows systems is vulnerable to something, it's just a matter of time until the right attack vector is tried.
If you use windows you will get some kind of malware sooner or later. If you are lucky this will be something relatively harmless. If you are unlucky you have already been sending personal and company data to organized crime groups for some time.
The big picture has not changed in many years. Windows is not fit to hold anything you don't want made public. Anti-virus software and firewalls are a band-aid not a fix.