Faith No More

Faith No More
Tim Mullen, 2004-02-02

Microsoft can end the scourge of e-mail viruses by ending its support for old software, and the clueless users who refuse to upgrade.

Colapse all | Post comment

Faith No More 2004-02-02
Kudos (2 replies)

mydoom / Novarg comes in the form of a zipped attachment which gets around the exe filter in outlook and most mail gateways (that dont have antivirus on them). I agree though that education of users and having a lifetime on products is a smart idea. Users are usually unaware that a products support ...

[ more ] [ reply ]

SRP in Windows XP would have stopped MyDoom 2004-02-04
colinbo

Setup correctly, Software Restriction Policies in Windows XP nukes the users ability to run unauthorized software. I think that alone is worth the price of admission considering that there are some old dogs not willing to learn new tricks....

[ more ] [ reply ]

Faith No More 2004-02-05
Anonymous (1 replies)

> Some form of built in software expiry might be necessary one day forcing a client to upgrade

That is absolutely stupid. The ISPs should be the only line of defense required to combat this. Your machine gets infected and starts attacking other machines? Guess what, you are booted off the netw...

[ more ] [ reply ]

It's about time... 2004-02-05
Matthew Murphy (1 replies)

The theory of software expiration is no more ridiculous than the theory of ISPs single-handedly securing their own networks. Time and time again, backlogs of infected machines on the networks of home and small business ISPs are showing the incompetence of these ISPs in understanding security, or th...

[ more ] [ reply ]

It's about time... 2004-02-08
Anonymous

What the ****?

I use "outdated" software (Windows 98SE (I would never upgrade to XP, I want my stability, thankyou) and have never once gotten a virus.

It doesn't matter if you're using XPSP2 or 3.11, if you click on the virus attachment you will be infected.

Matthew: you another consultant...

[ more ] [ reply ]

Off The Mark... 2004-02-02
Anonymous (4 replies)

So the solution is to not support older software? How is that going to work? People will not upgrade just because they are not getting patches, they just won't patch. Some people still happily use Win95. This will only make things worse in at least the short run. When all that hardware finally ...

[ more ] [ reply ]

Off The Mark... 2004-02-02
Anonymous

Dunce! It does not matter if they happily use Windows 95! That is the point. They also happily and ignorantly get infected. Microsoft may support Win95 (stupidly) but they don't patch it anymore anyway. ...

[ more ] [ reply ]

Off The Mark... 2004-02-02
Jim (hi tim!)

Attempting to bring the Win9x Os family "into the 21st century" is a complete waste of time, IMHO; they just don't have the "guts".

The MS dev / test resources can and should concentrate where their efforts will actually bear fruit; like Win2K and later.

...

[ more ] [ reply ]

Off The Mark... 2004-02-04
Greg

As a current user of mulriple versions of Windows (98se-NT4-Win2K-XP, I have to strongly disagree that the problem is out of date OS/software, at least with email viruses.
The problem is The HUMAN !
Added to that Microsoft still to this day is shipping an OS that defaults to hiding file extentions...

[ more ] [ reply ]

Off The Mark... 2004-02-09
Anonymous

The real fix for this is: everyone who wants to use a PC at home or at work must have a Computer Science degree... that should fix every thing (yeah right). The next step is to force everyone to upgrade on a yearly basis, and because hardware requirements will also need to be upgraded, then the fi...

[ more ] [ reply ]

Faith No More 2004-02-02
Anonymous CISSP

A thorougly enjoyable rant! LOL!

Oxford Dictionary:
stupid /stju:pid/ adj.(stupider, stupidest)
> a tempest of white noise rages in the part
> of their brain where conscious thought
> should be.

Yup. ;-)

Others you may like to include are:

Users:
"I like them, but could never e...

[ more ] [ reply ]

Faith No More 2004-02-02
Anonymous (1 replies)

You think Microsoft wouldn't love for all those people still using Win95 to upgrade to Win2k or WinXP? With all that lovely revenue? Of course Microsoft would. Problem is, those people won't, and (especially after Software Assurance) might just switch to an alternative (cough, Linux, cough) if pr...

[ more ] [ reply ]

Faith No More 2004-02-03
rolaids0 (1 replies)

Agreed. I have several boxes here that are "outdated" that run linux just fine. Really he got to the heart of it. Lusers don't patch, upgrades won't do anything. M$ doens't release new versions of their software at the same rate as the do paches, so to cast aside old software under the premise that ...

[ more ] [ reply ]

Faith No More 2004-02-03
Anonymous (1 replies)

> Win9.x didn't have the rpc problem that
> 2k, xp, nt, 2k3 had. Upgrading, where
> fixing old problems, only (by design)
> includes new problems.

Actually, the Win9x line did have the same problem, but the path was a little different. The sploits were written for the version in the NT cod...

[ more ] [ reply ]

Faith No More 2004-02-07
Anonymous

IIRC, 9x was vulnerable iff DCOM was installed, which was relatively rare....

[ more ] [ reply ]

Faith No More 2004-02-02
Anonymous

Third World Orgy? You are making me jealous!...

[ more ] [ reply ]

Faith No More 2004-02-02
Anonymous

Any action of that sort on Microsoft's part would probably be conceived as abuse of power. Even 'free' upgrades/patches cost the 'stupid' end user money, as they will usually call up the local computer guy to perform such updates. here's an idea... since end-users pay ISPs, let the ISPs be the poi...

[ more ] [ reply ]

Faith No More 2004-02-02
Anonymous

Now what we need is an e-mail virus that deletes outlook of the local-host......

[ more ] [ reply ]

Faith No More 2004-02-02
Chris Caydes (1 replies)

So basically, you mean further shortening the already short life span of software ?

Some big companies are not over migrating from NT to 2K (well yeah it takes some time when you have 10000+ workstations and 800+ servers to manage), and you'd like them all to already go for XP and 2003 ?

Then ...

[ more ] [ reply ]

Faith No More 2004-02-02
Anonymous

The fact remains that even if you are using the latest software the vulnerabilities that were exploited by sobig and blaster will still be prevelant (if not in their current form from base unpatched installs - in newer forms as new vulns come out).

Patching processes under XP especially with quic...

[ more ] [ reply ]

Nice article but... 2004-02-02
Anonymous (1 replies)

I think this is a good analysis of the
problem except for the obvious fact that
individuals who are using this legacy software
are doing so because they cannot afford any
better. After working with machine after machine
for hours, which really should be scrapped for
any useable parts, and th...

[ more ] [ reply ]

Nice article but... 2004-02-03
Anonymous

The article points out that MS should just stop supporting legacy software. If people cannot afford new hard/software, that does not mean that they should still get support for something that is/was never meant to be secure. It makes sense to me....

[ more ] [ reply ]

Build a better OS, and I will buy it... 2004-02-02
Unca Xitron (5 replies)

As as SysAdmin, I've seen nothing come out of Redmond that justifies upgrading from Windows 98. In my opinion, that was their peak.

Every time you buy a new computer, with its new, faster hardware, you "upgrade" the Windows OS, and never see any real gain as a result of the "bloatware" and freak...

[ more ] [ reply ]

Be a better sysadmin and you would... 2004-02-03
Anonymous (1 replies)

As a sysadmin, you are totally ignorant and uninformed. In fact, I sincerely doubt whether you are a sysadmin at all. As a sysadmin, you should know that the NT line has a vastly superior security model over the toy 95-line. As a sysadmin, you should know that the NT line is a true 32-bit, multit...

[ more ] [ reply ]

Interesting, vitriolic response... 2004-02-05
Unca Xitron

Hmmmm... did I touch a nerve, there?

First, note the handle. Unca Xitron. Not Anonymous. You might try at least using a handle so your rants could be responded to more accurately instead of standing behind Anonymous.

As for the rest, I've been a SysAdmin since 1993. I spend most of my tim...

[ more ] [ reply ]

Great article 2004-02-03
Anonymous

I run XP on my home network. Guess what, I didn't get MyDoomed. Why not? I use the latest software from Uncle Bill. Further, I can't understand why others have trouble. It might be that, like many of the Linux crowd, I spent money to secure myself. Yes, sports fans that was one of the points o...

[ more ] [ reply ]

Build a better OS, and I will buy it... 2004-02-03
Anonymous

I'm with Unca on this one. I'm sorry Tim that you're not able to secure a Windows 98 machine as it's incredibly easy to do (from external threats). I've 100 PC Win98 network here with no virus infection since Nimda (which was my wake up call). A few simple steps, like not using MS email clients (...

[ more ] [ reply ]

Build a better OS, and I will buy it... 2004-02-03
Anonymous (1 replies)

Dear Unca X,

If you feel that Windows 98 was the "peak" then you just stick with your Linux desktop.

If you're interested in this century, you should look at what the problems are with every OS:
-Patching
-Malware
-Firewall
-Defaults

-Patching: People hate patching. When last I instal...

[ more ] [ reply ]

Build a better OS, and I will buy it... 2004-02-05
Echox

...,
> -Patching: People hate patching. When last
> I installed Red Hat, it tried to pull down
> over 100 patches on a default install.
> Windows XP will now download patches all by
> itself. It took 5 hours.
I installed Gentoo. The Installation lasted over 2 1/2 hours with configuration.
...

[ more ] [ reply ]

Build a better OS, and I will buy it... 2004-02-03
Anonymous (1 replies)

I second you sysadmin.. Like my mom who uses the computer to just see the e-mail and do her accounts.. she doesnt need a bloated Windows XP.

Also, you can't make her realize its bad to keep a Windows 95.. her point is, when it is working dont throw it.. I like somebody else idea in this post.. ...

[ more ] [ reply ]

Education is the key 2004-02-05
Dan (1 replies)

In response to the last...well, response I just wanted to say that "mom and pops" don't need a simplified version of windows.

If people just want to use a computer for email and solitaire (as many do) then microsoft should inform (within windows) about email tact. Simply delete email if you don't...

[ more ] [ reply ]

Education is NOT the key 2004-02-13
Anonymous

Users are sheepishly stupid (as in dilbert), They dont want to learn!

The only way is to force security and have some kind of SMTP proxy that deny older POS mail clients to deliver their mail; Telling them:

"I will NOT accept/deliver for you destination till you upgrade from that old crap you ...

[ more ] [ reply ]

Faith No More 2004-02-02
Anonymous (1 replies)

Good idea to make them upgrade. Here's a suggestion: like with arms in warzones, allow people to trade in their old softmare for money (so they can decide what to do with it) or give them (right, give !) a fully-equipped new box with the up-to-date software and hardware that is required to run it.
...

[ more ] [ reply ]

Faith No More 2004-02-03
Andres Alla

Exactly, I was going to write something like Anonymous on Feb 2 2004 11:25PM. Good to see that there are other people feeling alike. That would be the solution....

[ more ] [ reply ]

Faith No More 2004-02-02
Anonymous (3 replies)

Mullen's arguments are pretty misguided. The problem isn't old software. I'm sure there are PLENTY of windows xp users who got this virus. I would bet that most of them were. This virus wasn't MS's fault (mostly), but old software has nothing to do with it. Why can't people just buy computers and no...

[ more ] [ reply ]

Faith No More 2004-02-03
Anonymous

Quote - " suffer from the inaction of those who choose to stay behind "

Not everyone in the world has the luxury of choice especially when it comes down to spending money fixing something, that to them, is working just fine.

Surely you aren't that ignorant?

I enjoyed the column, but your...

[ more ] [ reply ]

Faith No More 2004-02-03
Anonymous (1 replies)

You may be "sure" that many XP users got the virus, but you don't really know. Personally, I really doubt it, but that doesn't matter. I think the biggest point made is that you say most people you know are still running 98. Yes they may be fine with that and enjoy it, but the point of the articl...

[ more ] [ reply ]

try again 2004-02-03
OOOoook

/sarcasm mode on
Good plan, You and Tim both... M$ put out software that is not secure, so they should stop supporting it.

But why should M$ stop w/ just: w95, w98, NT, 2K, XP, 03? NONE of them were released secure. And by Tim's logic we are all wealthy, so lets just spend more for the next i...

[ more ] [ reply ]

PEBKAS 2004-02-03
Anonymous

Problem Exists Between Keyboard And Seat.
This is so much a user problem and not a software problem.
Though of course we should not forget those who obediently upgraded, only to be infected as soon as they hooked up to the Net. No user intervention required.
...

[ more ] [ reply ]

Faith No More 2004-02-03
Who is clueless?!? (1 replies)

Last year the Microsoft reps proposed my company an upgrade of our NT infrastructure, across the board, for approx. 1500 clients, for a "mere" $800,000 ("bla,bla,bla assurance" they called it). Taking into account the "successes" continuously recorded by Microsoft in making their systems more robust...

[ more ] [ reply ]

Faith No More 2004-02-03
Jeff

I hate to tell you, but migrating 1500 clients from a Windows to *nix base will not be cheap. If you go Mac, you need different hardware. If you go some variety of *nix, you need to reinstall EVERYTHING. Either way, you need to retrain your entire support staff. Users might need a little retrain...

[ more ] [ reply ]

Faith No More 2004-02-03
Paul

I think this article has it all sidewards. The problem is not *old* software, it's *badly designed* software and operating environments.

Given current operating systems' lack of serious protection mechanisms -- although Unix-style "user ids" and "chroot" help a lot (and Java's sandboxing help...

[ more ] [ reply ]

Faith No More 2004-02-03
Ant

There are still many people getting run over by cars everyday. That should not stop us from educating them on crossing the roads safely, educating the drivers to drive more safely.

Education must not stop, and neither should we rely solely on manufacturers alone to make the products safer.
...

[ more ] [ reply ]

Well done in securing bigger profits for MS 2004-02-03
Anonymous

So let me get this straight. You're advocating that Microsoft totally drop support for slightly older (Outlook 2000, for example, which is not exactly Word 2.0 here) software to solve a user education issue.

User education issue, not security issue.

Let me paint a picture of Microsoft sharehol...

[ more ] [ reply ]

Faith No More 2004-02-03
Kevin

Taking the "out-of-sight, out-of-mind" view isn't going to help the poor innocents, those who have their machines patched to the hilt, but still end up getting flooded with virally loaded mail.

I agree with one of the other posters, that M$ could give away free upgrades to WinXp or whatever, I do...

[ more ] [ reply ]

Faith No More 2004-02-03
Anonymous

Tim's whole argument for getting people to shell out "time and money" (his own words) to upgrade both their hardware and their software is so they get the Outlook feature which prevents them from executing attachments (as another reader has pointed out, the Novarg virus circumvented this very featur...

[ more ] [ reply ]

Hell yeah!!! 2004-02-03
Anonymous

Well said....

[ more ] [ reply ]

Faith No More 2004-02-03
Peter (1 replies)

True enough, there is multum of win95 and98 machines with users who are happy with it. Many happy clueless chaps who don know how to update windows and don't care as long as they favourite app/game runs fine. The thought of installing new operating system gives them creeps and they are lost like a b...

[ more ] [ reply ]

Faith No More 2004-02-04
Anonymous

I strongly disagree with Peter's statement. I would have long since upgraded from Win98SE to Win2K if it was able support two of my crucial utilities: the Norton Navigator file manager, which is far superior to Windows Explorer, and DATMAN, which turns a DAT tape drive into a WORM file system. Sin...

[ more ] [ reply ]

hilarious 2004-02-03
Anonymous

Bravo, this is one of the funniest articles i've read today. It has sarcasm dripping off each paragraph...

[ more ] [ reply ]

Faith No More 2004-02-03
Anonymous

We in the Linux comunity would happy embrace these users you would like to shun. Problem being for Microsoft is that their monopoly would loose a very large portion. Bill and Steve know this, they are not stupid, they are keeping market share....

[ more ] [ reply ]

Imagination 2004-02-03
Anonymous

Come on, use a little imagination.

How do you force a few million clueless Win9x users to install a newer system?

Well, have the next virus wipe and repartition their harddisk. They are too stupid to install an OS anyway, and use whatever they use because "it came with the 'puter".

Wipe the...

[ more ] [ reply ]

Good enough? 2004-02-03
Anonymous

This situation is a consequence of the growth of the use of computers. Computers are not seen as something to be "maintained" or "upgraded." They're seen as a tool. Therefore, they should just work. From this point of view, it's a valid question to ask why a consumer should be expected to buy a ...

[ more ] [ reply ]

Faith No More - Common Sense Isn't Common 2004-02-03
Anonymous (1 replies)

When you explain to people that if they take a gun, put bullets in it, cock the hammer, point it at their foot, and pull the trigger, it will blow their foot off. They won't believe you, until they have 2 bloody stumps at the end of their legs.
Unfortunately for us, some people will only learn the...

[ more ] [ reply ]

Faith No More - Common Sense Isn't Common 2004-02-04
Anonymous

Forgot to add my last point...
What someone uses isn't as important as how they use it.
If they don't shoot a gun at their foot it won't get blown off, regardless of whether it's a .44 magnum, shotgun, or .22
...

[ more ] [ reply ]

Faith No More 2004-02-03
Anonymous

Please help. I'm having trouble finding the patches for my Win3.1 machine....

[ more ] [ reply ]

Faith No More (MS should be held accountable) 2004-02-03
Anonymous (2 replies)

Look the real reason why the vendor, MS, will not fix their SW is MONEY. The real reason why people don't upgrade their software is MONEY again. Note the inifite loop. When MS goes from a greedy monopolist to an open benevolent org with pragmatic good ethics then and only then will this situation ...

[ more ] [ reply ]

Faith No More (MS should be held accountable) 2004-02-04
Anonymous

Beg to differ again. The reason I have not upgraded from 98SE is not money, it is incompatibility with crucial software (plus the fact that 10% of the new features are ones I actively *don't* want). ...

[ more ] [ reply ]

Faith No More (MS "IS" accountable) 2004-02-04
Jeff

Last I checked, the idea of "patches" and "service packs" was that MS distributes FIXES to problems that people find FREE OF CHARGE! No money necessary.

Granted, this is a limited time offer. NT 4.0 came out in what - 1996? Windows 98 in, um.. 1998? It's 2004 now. Who on earth expects to nev...

[ more ] [ reply ]

Faith No More 2004-02-03
Anonymous

LOL,

Thats pretty funny... old software is the problem.. hmmm lets see, how long was win2003 out before its first crack? about as long as XP and 2000 before it from memory, and each time its been touted as microsoft security like never before.

heck I don't mind at all, I've been happily inst...

[ more ] [ reply ]

Faith? Blind anyhow 2004-02-03
Techie

The viruses Tim mentions affect ALL versions of Windows (Outlook problem, not OS problem) I dont think Tim solution is related to the problem.

If M$ would:
1) quit changing the interface everytime they issued an upgrade,
2) Issued software that actualy functioned as advertised.
3) were even cl...

[ more ] [ reply ]

Clueless Commentator 2004-02-03
Anonymous

Sorry Tim, but you are clueless on this one. Many users that opened that e-mail didn't simply click on a link, they had to unzip it, then open it. Those same users could have been told to save it to disk, unzip it, and launch it...and they would have.

If they had to su to root to launch it on...

[ more ] [ reply ]

Faith No More 2004-02-03
Anonymous

As if upgrading would help.

These problems will continue until OS files are such that only an administrator can write on them - that goes for any OS, not just Windows (yes some OSes are already that way). Users must not log in as an administrator to do non-admin work, and must not have ownershi...

[ more ] [ reply ]

Hilarious ! 2004-02-03
Jake

All three users that we had infected were running Windows XP Pro SP1 and Office XP. Allegedly all 50-odd Windows systems were up-to-date on patches. Two desktop systems are still on W2K, all others are XP. Yes, that's correct, not a single NT4 or W9X box in the company.

Yep, obviously the faul...

[ more ] [ reply ]

Faith No More 2004-02-03
Anonymous

Users are stupid because no knowledge is needed to use a MSFT program.
User use old software on old hardware, because most people who actually have to pay money for it and can't download it with emule just don't have the money (or don't see any reason) to upgrade every 24-36 months.
Sure, I'd like...

[ more ] [ reply ]

Written by a child? Or paid advert from MS? 2004-02-03
Mike Healan (1 replies)

I thought I was reading a serious article with serious ideas about security. I didn't realize this was a press release from Redmond exhorting people to buy newer products. How much did this advertisement cost?

Stupid users? I am using Windows 2000, which is about 5 years old now. This makes me st...

[ more ] [ reply ]

Written by a child? Or paid advert from MS? 2004-02-05
Anonymous (2 replies)

Perhaps you might care to discuss the technical issues at hand rather than resorting to name calling. That would be a refreshing change from you, Mike Healan. ...

[ more ] [ reply ]

Written by a child? Or paid advert from MS? 2004-02-06
Jon G.

Exactly what technical issues are you referring to? There are no real issues discussed in this article. Everyone must upgrade or die?! What is that about?

I consult in the home user sector and I can tell you that it does not matter what version of software people are running, they are bound and d...

[ more ] [ reply ]

Written by a child? Or paid advert from MS? 2004-02-08
Anonymous

ok, that's allfine and good Anonymous.
However, I use 98SE and would flatly NEVER upgrade to XP (I want my stability, thankyou).
I have never gotten any kind of a virus in the 3 years I've been on the net.
Now, lets recap about some famous worms:
Klez, MyDoom, CodeRed, ILoveYou, Melissa
They al...

[ more ] [ reply ]

Nothing but Microsoft FUD here... Move along 2004-02-03
John the Kiwi (3 replies)

Hi Tim

I don't want to be insulting, but there's a few things I feel I need to point out here.

Today you went a little too far with your ?Faith no More? article. Sure, you're right (in a sense), if Microsoft stops supporting it's older software then there would be perhaps a few less viruses in...

[ more ] [ reply ]

Can't agree more... 2004-02-04
Anonymous

Very well thought refute....

[ more ] [ reply ]

Nothing but Microsoft FUD here... Move along 2004-02-04
Anonymous (1 replies)

Linux/Unix isn't the whole answer, either.

The first Internet worms crossed the Internet on Unix machines - have you forgotten the Morris "finger" worm?

*nix machines are vulnerable, too, left unpatched and with poor security practices.

Linux is terrific, I use it at home, but I wouldn't ex...

[ more ] [ reply ]

Flawed Facts + Flawed Logic = Flawed Conclusion 2004-02-05
Anonymous

Tim's basic article never stood a chance, it was flawed from the beginning.

Flawed facts + flawed logic = flawed conclusion.

The first and biggest flaw was putting the words Microsoft and....no, I just can't do it. The word security NEVER belongs in the same sentence!

By using his logic, ...

[ more ] [ reply ]

Nothing but Microsoft FUD here... Move along 2004-02-05
Anonymous

Mullen is and always has been nothing more than a shill for Microsoft. It's no surprise that he thinks that the wave after wave of MS-specific worms/virii/exploits that sweep through the internet with monotonous regularity are the fault of end-users for not spending (too much) dough on MS's latest ...

[ more ] [ reply ]

Why was mydoom so sucsessful? 2004-02-03
Anonymous (4 replies)

btw why was mydoom so sucessful? all of the other "please click me" viruses either go unnoticed, or die out after a day.

somehow mydoom manages to convince users to click it.

i'm not a psychologist, so could somebody tell me why it is better at convincing users?...

[ more ] [ reply ]

Why was mydoom so sucsessful? 2004-02-04
Anonymous

MyDoom was so successfull because it came in a .zip archive and it passed over most of the filters...

most of the admins have blocked .scr, .bat, .pif, .exe and other dangerous attachements at firewall or mail antivirus level... but you cannot block .zip, or it's way more difficult... and also th...

[ more ] [ reply ]

Why was mydoom so sucsessful? 2004-02-04
Anonymous (3 replies)

It doesn't convince you to click it. Outlook 2000 even patched with the supposed blocking feature will still trigger the virus when you click on it to delete it. Same with versions up to 2003. That's why you have to layer on realtime virus protection. Sure, try and tell me my Outlook clients are mis...

[ more ] [ reply ]

Why was mydoom so sucsessful? 2004-02-04
John the Kiwi

Try disabling the preview pane, that's the first thing I tell all of my customers that still run any form of Outlook. If the preview pane is enabled then HTML is being executed....

[ more ] [ reply ]

Why was mydoom so sucsessful? 2004-02-05
Anonymous

> It doesn't convince you to click it.

it does - the code doesn't execute just by viewing the email, it requires an idiot to perform multiple actions.

what i wanted to know is what particular features make these idiots click on one attachment more frequently than another.

to put it another...

[ more ] [ reply ]

Why was mydoom so sucsessful? 2004-02-05
Anonymous (1 replies)

Real time antivirus software saved my company from MyDoom. We filter/block ALL extensions that represent risk, including .zip which is still a "binary" extension and conceals other "risky" extensions. Zip files are allowed to filter thru only after the system decompresses them real-time, sees that t...

[ more ] [ reply ]

Multi Layers is the Key 2004-02-06
Mato Lek

"See, never trust one layer of security, 3-4 of them will do wonders."

-Bingo! You hit the nail on the head. If one lives in a dangergous neighborhood, one does not lock their door at night with just one lock.

Using up to date software is just ONE of those layers and will never be an end all ...

[ more ] [ reply ]

Why was mydoom so sucsessful? 2004-02-05
Frank B.

You didn't need to click on any link or even opened the attachment to get infected. MyDoom executes automatically when the email is opened or previewed thanks to the MS content-type declarations.

Content-type: application/octet-stream; name=data.scr

One simple work around that gave me good re...

[ more ] [ reply ]

SPAM, that's why 2004-02-05
Anonymous

MyDoom was successful because it was seeded extensively by it's creators--a russian SPAM ring. Many similar virii have been created and failed because the time it takes to reach a "critical mass" of infected machines is longer than it takes for the security field to identify and patch the virii.
...

[ more ] [ reply ]

Old OS's/software stink, but... 2004-02-04
Anonymous

I agree with you in spirit.

Reality, however, is completely different, no matter how much we wish otherwise.

I say this as a net admin/tech/cheief-cook-and-bottle-washer for various k-12 school systems. While the corporate world may (*may*) have the resources to keep systems up to where they ...

[ more ] [ reply ]

Faith No More 2004-02-04
User point of view (?)

I spend an hour a day at work keepping systems running smoothly, updated with the lastest MS security patch, virus definition updates, cleaning files, backups ...

But, I can't be bother to spend just a couple of minutes at home doing that.

Most of "users" just don't care, don't know or can't d...

[ more ] [ reply ]

Faith No More 2004-02-04
Smiorgan

I won't bother pointing out that (according to my security updates) many new viruses just go for the NT family and tend to miss Win9x machines entirely.

I won't mention the expense of upgrading for the home user is rarely just the software. But a single mother who needs a PC for her kid's homewo...

[ more ] [ reply ]

When did MS start paying you?? 2004-02-04
Anonymous

Go visit 95isaliveDOTcom and see how unworkable older tech is....

[ more ] [ reply ]

Clearly ending support is the best way to get users that don't care to upgrade! 2004-02-04
Anonymous

Ending support is not going to cure ignorance... especially ignorance of the support itself. You're assuming that taking away what the user never knew they had or cared about will persuade them to upgrade.

Probably not. You know since they never knew they had or cared about it. As long as the ...

[ more ] [ reply ]

Forced Patches 2004-02-04
Anonymous

"This seems natural to me. I like this a lot better, force patches. I don't think many will complain if their system is kept up to date"

Wrong forced patches are evil. Microsoft hot fixes and patches from time to time break software or cause brand new problems on
top of the one Microsoft tries ...

[ more ] [ reply ]

Crappy Code 2004-02-04
Anonymous

"Many will be quick to point out that it is Microsoft's "crappy code" that allows people to open attachments in the first place"

HTML is enabled by default in outlook
(stupid move) most people don't know keeping this enabled is dangerous or they won't turn it off they don't have to open anyth...

[ more ] [ reply ]

Who's responsibility is security? 2004-02-04
Answer Within...

Here is yet another rant from Tim Mullen, doing his best cyber-cynic impersonation. He rants about "stupid users" clicking e-mail attachments and blames Microsoft for allowing people from the shallow end of the gene pool to still behave that way (as if Tim believes you can engineer stupidity of out...

[ more ] [ reply ]

Faith No More 2004-02-04
<mtrahara@rcn.com>

First, I'm not a "Clueless user.
Second, I run Win 98SE and I have NO plans to upgrade to any Microsoft software that forces me to phone them for permission to install software I BOUGHT AND PAID FOR and which then randomly connects to my computer to check on me or my software.

Third, Tim, I don'...

[ more ] [ reply ]

Tim Works for Microsoft....it even says so right here... 2004-02-04
Anonymous

SecurityFocus columnist Timothy M. Mullen is CIO and Chief Software Architect for AnchorIS.Com, a developer of secure, enterprise-based accounting software. AnchorIS.Com also provides security consulting services for a variety of companies, including Microsoft Corporation.

That should provide en...

[ more ] [ reply ]

Faith No More 2004-02-05
Anonymous

And what about those of us running home networks comprised of older and newer machines and OSes? Are we stupid for doing so? Should we just trash thousands of dollars of still-serviceable hardware just so Microsoft can add a few more bucks to their coffers? I have computers running DOS, Windows 3...

[ more ] [ reply ]

Faith No More 2004-02-05
Anonymous

Tom Mullen is the clueless one. I am a computer professional, have been for 21 years now. I use Windows 98 on my primary computer. Why? Because I don't feel like shelling out a bunch of money on a newer OS that is NO more secure than the one I have and that has just as many, if not more, bugs th...

[ more ] [ reply ]

Faith No More 2004-02-05
Anonymous

Now THAT'S a pretty good ad for MS!!.....
Bet you don't pay for upgrades....ever!...

[ more ] [ reply ]

Spelling Error! 2004-02-05
Robert

"costumers" should have been "customers"...

[ more ] [ reply ]

Faith No More 2004-02-05
Anonymous

This rant is utterly bogus. MyDoom does not require the usually-blocked extensions, it can arrive as a .zip attachment. Outlook XP and 2003 do block .zip files. While the latest software might have slowed it, it wouldn't have stopped it and the net number of infections wouldn't have been reduced...

[ more ] [ reply ]

Faith No More 2004-02-05
Thilo

I often have to read or hear that the main reason to refuse upgrading old Win9x systems, is that people are avaricious and simply want to safe money. That they are just ignorant to security, bla bla ..... That may be true in some cases. Why touch a system that gets its job done?

But I think a lo...

[ more ] [ reply ]

Faith No More 2004-02-05
AICS

The real (both real world and real effective) fix to luser education will come when somebody makes a MyDoom or Nimbda that is 100% destructive.

All those people who don't know today will finally figure out that something is wrong when their C:\ gets formatted to RAW.

...

[ more ] [ reply ]

Faith No More 2004-02-05
Mark Brabson

Wow. And to think I used to, on balance, take you seriously.

You and Microsoft really deserve each other. And I don't deserve either one of you.

...

[ more ] [ reply ]

What 's you're problem!? 2004-02-05
Anonymous

Ok, so you're telling me that i'm 'stupid' because I use Windows 2000 (it's about 4 years old) and this makes me stupid?! What's going on in that little head of yours? I mean, who are you? A spoiled child sitting in a schoolyard? What you said is just...well...stupid!...

[ more ] [ reply ]

Faith No More: Is this person serious? 2004-02-05
BoBH

Let's put this in a historical perspective. There was a time when a limited number of people drove the direction of IT. Features were added to programs only when fully justified (meaning a business reason existed and a reasonable return could be demonstrated). Yes, I'm harking all the way back to th...

[ more ] [ reply ]

Faith No More 2004-02-05
blacklight (1 replies)

To secure desktop clients, do this in the following order: (1) secure Internet Explorer; (2) secure Outlook; (2) secure the client OS. As for Microsoft client OSses, implement Windows 2000 Professional. This should take care of most of the headaches....

[ more ] [ reply ]

Faith No More 2004-02-06
`

NOPe, that not the solution...

First you have to stop using Micro$oft then you can start thinking about security and how to protect your users and your resources......

[ more ] [ reply ]

microsoft it to blaim: is too! 2004-02-06
hcs

Hi,

My dear old mother of 68 years old has bought her own laptop with windows 98 three/four years ago.
The mother-in-law of my brother, 72 year ago did the same this year. She has windows xp.

Both have the same problem: the antivirus updates are a problem over the phonelines they dial into. ...

[ more ] [ reply ]

Faith No More 2004-02-07
Anonymous

Complete disregard for people who cannot afford to spend the money to "follow the upgrade" frenzy like techno-junkies in a software crack alley...

...

[ more ] [ reply ]

I still use windows 98... 2004-02-08
Anonymous

and I've never been infected by a virus. But then I don't use Outlook and I never open attachments. Anyway, I don't think the answer is to make software more difficult to use i.e. make it hard for users to open attachments - they'll just circumvent any measures you put in place....

[ more ] [ reply ]

For all you wondering why Tim seems to have such controversial opinions 2004-02-09
Anonymous (1 replies)

Look at all the posts he generates. This is the reason he says such outragous things. Not because he believes them, but because they generate a lot of traffic. The crazier the things he says the more people post. ...

[ more ] [ reply ]

For all you wondering why Tim seems to have such controversial opinions 2004-02-12
Anonymous

We call someone who does that.......

......a "clown"....

[ more ] [ reply ]

Hardware requirements 2004-02-09
Anonymous

What really cracked me up when Microsoft released XP was their claim that it's faster than earlier versions of Windows. Really? If it's faster, why does it specify a faster CPU in the minimum requirements? If it were really faster, wouldn't it be able to run on slower CPUs?
...

[ more ] [ reply ]

Remarkable 2004-02-09
Jeff H (a different one from the previous Jeff)

It's crazy - it really is. If you read the responses to this article, most spend time either lauding Linux or bashing Windows. Why?

As one amazingly astute poster mentioned, the trick to dealing with viruses is to have an, erm, ... up-to-date anti-virus solution. Novel concept I know.

I freely...

[ more ] [ reply ]

YEAH UP GRADE YOU CHEAP BASTARDS 2004-02-11
Anonymous

so Eeye can find the next major catastrophic hole in the latest and greatest, newest, bestest secure products from Microsoft.

HAHAAHAHAHAHA...

[ more ] [ reply ]

This guy is MS lobbyist in disguise 2004-02-11
Anonymous

And his solution is ridiculous. Following his analogy of having unprotected sex etc., his solution for computer security might be compared to a solution to AIDS by ... surgical removal of genitals of all children at birth AND stopping production of syringes. An idiot who is using a computer will not...

[ more ] [ reply ]

Joe Sixpack: "Look, I paid $1500 for this thing..." 2004-02-11
Penguinisto

"...and spent n dollars on upgrades to the RAM, hard drive, etc etc. So until I get my money back out of it, why the hell should I run out and spend even MORE money on the hardware needed to make XP run!?"

...or something like that.

See Tim, folks at home don't have the kind of budget to just...

[ more ] [ reply ]

Once bitten, twice sny 2004-02-13
Art Marriott

A couple of days ago, upon learning of Microsoft's latest "showstopper" security bulletin, I dutifully applied the referenced hotfix to my Win2K desktop. Nothing seemed to be a problem, so the next day I applied the corresponding patch to several NT4 desktops belonging to one of my clients.

This...

[ more ] [ reply ]