Time to patch Windows again, ASAP
If you use a Windows computer connected to a network, a newly discovered bug makes it possible for a bad guy to wreak havoc on the computer without your doing anything. The most vulnerable versions of Windows are XP, 2000 and Server 2003. Vista and Server 2008 are also vulnerable, but not as badly. Microsoft considers the bug important enough to issue the patch immediately rather than waiting for their normal once-a-month patch Tuesday.
Susan Bradley, writing for the Windows Secrets newsletter recommends immediately installing the just-issued patch. Then she offers some unusual advice, suggesting people first restart their computers "to verify that your machine is bootable." Can't hurt. Then she says to install the patch and reboot again. Her article also includes direct links to the patch for each version of Windows. If, for some reason, you can't run Windows/Microsoft Update you can manually download the patch and install it.
A standard of Defensive Computing is that the less software installed and running the better. This particular bug is with a part of Windows known as the Server service. If you are not sharing files and/or printers on a local area network, then you don't need to have the server service running, bug or no bug.
Making a Windows service not run all the time is called disabling and/or stopping. Stopping refers to the instance of the service currently running. Disabling means preventing it from ever starting again. Microsoft describes how to both stop and disable the Server service in Security Bulletin MS08-067. They also suggest doing the same to the Computer Browser service.
Anyone not sharing files and/or printers on a network should also turn off File and Printer Sharing for Microsoft Networks (the Windows XP name) on all network definitions. For example, on a laptop with both wired Ethernet networking and wireless Wi-Fi networking, File and Printer Sharing should be turned off in both network definitions.
If the Server and Computer Browser services are disabled, then some people might consider the last point (and the next) overkill. I think they are a good idea because it means two mistakes would have to be made to enable file and printer sharing as opposed to only one mistake.
Build a better fence around your Windows computer.
For still more safety, look into how your firewall is configured to ensure that it does not allow incoming traffic on TCP port 139 or 445. Again, this is for someone not sharing files and printers. Firewall configuration varies widely, but if you are using the Windows firewall in XP, the exception for this is called "File and Printer sharing."
Firewalls are the first line of defense against this type of problem. With that in mind, you may want to review the series of postings I did recently on adding a second router to a LAN to provide additional firewall protection to your most important computers. See A second router protects adults from kids.
See a summary of all my Defensive Computing postings.
Michael Horowitz is an independent computer consultant and the author of several classes on Defensive Computing. He is a member of the CNET Blog Network, and is not an employee of CNET. Disclosure.
I know winblows fanbois hate FACTS, but it is what it is. Winblows is violated so often because it's so easy.
A fair criticism however involves design decisions. That OS X wasn't raked over the coals for releasing the current version of the OS with the firewall disabled amazes me. That was an inexcusable design decision.
As for mainframes, I spent a few years applying patches to mainframe software. It's buggy too.
Michael Horowitz
So as you can see it was the Linux box that was left standing not Vista. Please keep up with the news.
What happened to the Mac was nothing like what's being reported here. The giant gaping hole being reported here, requires NO USER INTERACTION AT ALL. That means you don't need to visit any website, you don't need to acknowledge any "warning" alerts. The UAC doesn't ever protect you. You simply just get the sad realization that Windows is no better now than it was 3 years ago while j03 hacker pwns your PeeCee for recruitment into his zombie army. Welcome to windows.
Once people are afraid of updating their OS, security nightmare begins. As Apple user I keep warning Apple to TEST their updates since same fashion (although not serious as win) begun. Apple's issue is way more simpler, some updates have broken professional software. Not a paranoia induced one like MS one.
So as you can see it was the Linux box that was left standing not Vista. Please keep up with the news.
<a href="http://www.roomreview.net/play-poker/"><strong>play poker</strong></a>
Unfortunately, unless it is money or t-shirts, people don't understand what free is.
[URL="http://www.roomreview.net/play-poker/"]play poker[/URL]
Also, thats fine if your firewall blocks the ports. What happens when your firewall can be bypassed? Due to a bug or something in that code? There is no one solution. Patch your system so we don't all have to suffer like back in the Code Red days, or like we do now with all the spam infected PCs send. Oh yea, you don't "patch" g-mail. Google does.
ZoneAlarm, a completely free firewall, will protect all ports against incoming or outgoing transmissions until you tell it otherwise. Each time a connection attempt is made, you get a little window telling you something wants to connect in or out. You have two neat little buttons 'Allow' or 'Deny'. Free software. Works wonderful.
You can use multiple different virus scan engines that work completely online, and are completely free of charge to ensure that your machine is virus free. If you actually want to go pay the $39,99 for Norton AntiVirus, make sure that is all you buy, you don't need to spend the extra to buy their whole package. Just the Anti-Virus program works wonders.
Internet Explorer 7 will stop nearly all of your pop-ups unles you specifically turn off the code blocker. On top of that, the browsing has never been easier with tabs rather than multiple windows open. Hotkeys have gotten simpler in the new version as well.
Why would anyone make such a scene or story to scare users? If you have properly set up your computer for use on a Network, you have nothing to worry about.
I would recommend getting the latest patches to keep your Windows as tight as possible. Make sure to set a Windows Restore point prior to visiting microsoft updates, that way, if something does go wrong... it is an easy revert.
The majority of home computer users know how to use the internet and send email, thus alot of users have no clue about firewalls, networking and security. They just want to turn on their computer and have it work.
Comments like "I'm an Apple user, I'm not paranoid about updates breaking things" drive me crazy. I've never had a problem with Windows Update. Of course, I own my copy of Windows. :P The updates run automatically and I usually wake up in the morning to a message saying the PC was updated. No hitches. The Windows Genuine Advantage thing hasn't caused any problems for me personally. I wait until the first service pack of any OS comes out to move to it though.
The fact is, 90% of the OS market brings advantages and disadvantages. One of the disadvantages is you're the target. That being the case, I think Microsoft has done a good job keeping up. Bring proactive is a good thing (even when people who aren't MS users trumpet the horns everytime a patch is released).
Winblows apologists drive me crazy. I was a victim of the winblows genuine disadvantage bug that FALSELY labeled my 3 year old ex-pee install as "illegal" and TOTALLY LOCKED ME OUT OF MY OWN FREAKIN MACHINE! I had to install Ubuntu to get the hardware working again, but still couldn't access any files until I called M$'s 800 number and read dozens of code characters to some idiotic computer, which read back dozens of code characters that I had to enter to "reactivate" my legally purchased OS.
Never again will they get a single penny from me. Rape me once, shame on you. Rape me twice, shame on me. I still have ex-pee running on a partition on that machine, but that partition is nothing but a game console to me now. If I want to do any real work, I load Ubuntu and enjoy the realization that MY MACHINE IS MINE AND MINE ALONE. Gate's kill switches don't affect me anymore and yes, he has multiple kill switches in your machine. "Malicious Software Removal Tool" allows them to uninstall anything they don't like on your machine. "WGD" allows them to lock you out of the machine completely (well, lock you out of the entire winblows partition at least).
Enjoy your slavery. In a world without walls you don't need windows or gates.
go on patching all the security holes i can't wait until they find out about the
calculator vulnerability i discovered that ages ago.. along with notepad and many others
i would like to mention .. and still such a little things
hasn't yet come out to light. My recommendations for you guys is ... and this is reality . if u have ports open ,services running,programs,dependencies etc. that you don't really need or use. why have them.
Microsoft is just making you a favor by adding simple firewall etc. you gonna have to realize that your system is naked. and that your in charge of getting a good firewall.anti virus . which are just the materials .. the next step is to configure them...
You do not have to live in slavery. Be free. After you break free from your prison cell, you'll find you have no use whatsoever for windows or gates.
I'm still pissed at the NVIDIA LCD probing issue with UBUNTU, that put many peoles Viewsonic Monitors into a non recoverable sleep mode. A documented bug on the bug tracker still live in the OS just waiting from someone to blug an older Viewsonic LCD monitor and watch it go blink blink dead. If Apple or Microsoft did such a thing, people would be at the doors with torchs and pitch forks.
The MS firewall is free. If you paid somebody for it then you have just been an example of the "greater Fool" theory
There is a Windows security hole, that leaves you open to an attacked (think Blaster32), that needs no user interaction. So follow the steps above or apply the patch.. no brainer. Use a Firewall, but don't depend on your firewall. Laptops connect to all kinds of networks and can bring the bug into your network without having to go thought your physical firewall (Thats why software firewalls are a nice to have thing). Just thank the one above it is not an DNS security hole...oh nevermind that was already patched earlier this year. ; )
This is not a bug that gets into your system. This is an attack vector that lets bugs in.
If, for example, GM issues an announcement that a vehicle of theirs is vulnerable to an engine fire and that owners should get to their local dealer ASAP, nobody seems to accuse the media that pass along this news of 'just trying to scare people' or 'bad mouth' GM. Also, what's the point of Honda owners coming forward and saying "Well, my Honda never needs maintenance like that!" One, it's not true--Hondas need maintenance and also sometimes have recalls; Two, not everyone wants to drive a Honda.
And to say that people should know how to set their computer and/or network up properly to be safe is like saying that everyone should know how to fix their own car. Some people do know how to fix their own car and that's great, but computers are both complicated technical devices and--for many people--a necessity of everyday life. Sure, it's important to have a basic understanding, but to expect every computer owner to know how to configure routers, firewalls, virus software, network sharing, etc, is like saying "Wait, you know how to put air in your tires but you don't know how to rebuild your engine?!?! What business do you have owning a car?!?!"
And remember, not everyone is out to get you, so breath and take some time away from your computer.
I'm no Microsoft Fanboy, Apple Fanboy, or Linux Fanboy. I'm a "Company that does its job" fanboy. All I see is that Microsoft did their job. The rest is up to the user to secure their computer.
Same thing goes to Apple, for AFP. They open AFP port too. There is not a single sane person who will want to use AFP over Internet to transfer files.
That is why Samba always has security alerts.
Zerocxis
-
by iConquered
October 25, 2008 4:06 AM PDT
- It is true that no operating system is perfect. There are too many variables to account for. However, the fact is, that Linux and Mac OSX are far superior in security, than Windows is. And part of it is due to the UNIX foundation. The simple fact that users are required to input their password before installing software, is a huge step forward. One that Microsoft eventually borrowed, in order to boost the security of Vista. Windows was/is notorious for allowing software to self-install, because the user can accidentally run an executable without selecting an exe. The majority of the ill that could befall a Mac OSX or Linux user, would be entirely self induced. If you don't approve the installation of something, then it can't really affect your system.
-
Reply to this comment
-
-
-
by Ilgaz
October 27, 2008 10:35 AM PDT
- If OS Vendor opens a sub-1024 service port to Internet and tries to close it with a Firewall, it will fail. It is for ANY operating system. You just don't serve if user didn't ask for it.
-
-
-
by wolivere
October 27, 2008 12:06 PM PDT
- Wait why is it that in Linux or OSX that a person does not get pissed off about a pop up asking them to log in and elevate security. But if you get a pop up from Vista asking your permision people call it anoying. Pot kettle kettle pot.
-
-
-
by MrKleinpaste
October 27, 2008 12:31 PM PDT
- @wolivere - "Wait why is it that ..."
-
-
-
by iConquered
October 27, 2008 3:25 PM PDT
- It appears that somebody has beaten me to the explanation. As for Windows, it has problems deeper than open ports. The very nature of Windows is rife with vulnerabilities for simple things such as using Microsoft Word (various security updates have patched MS Word and Office in general).
-
-
Showing 1 of 2 pages (55 Comments)Windows greatest issue, is security from malicious attacks from outside parties. In terms of functionality, Windows operates similarly to OSX and Linux. Nobody expects an OS to never crash, but you do expect there to be less issues with detouring hackers. The fact that installing Office onto a Windows system, puts you at risk with online use, is a pretty terrible situation to deal with.
The issue is simple, they are running really unneccessary services wide open to Internet and expect user to run firewall to close them. It doesn't work.
If every OS X came with printer sharing and file sharing turned ON and open to Internet by default, it would only take weeks for black hats to exploit them. Apple does what OS vendor should do, they turn them off by default. MS doesn't do it. That is the issue.
Because it doesn't have to pop up as often as it does in Vista. The UAC is like a jack russell terrier. You only get them when you're running an application or taking an action that changes system files. Not regular applications that were written by lazy programmers that still write code as if they're programming for windows 98. There is no reason whatsoever, that I need "Elevated Permissions" to view processes for "All Users" when I'm in "Task Manager".