Updates: Who Needs 'Em?

I'd check the expiration on that can of Java.

Don't you just love updating Javascript Runtime Environment? Or better yet, have you ever not seen that little yellow shield icon down in the system tray?

The programs on your computer are always asking to be updated, and it can quickly go from annoying to borderline intrusive. Why do these programs need so many updates?

Generally, these updates fall under one of three categories: functionality updates, bug fixes, and the ever-pervasive "security update." I find that home and small business users tend to ignore the last kind, probably because a) they're the most common and, thus, the most annoying, and b) many users don't really understand what a "security update" is.

Well, if you learn only one thing today, it's that you shouldn't ignore them.

Risk

Online criminals have a myriad of reasons to try to gain access to your computer, whether it's to steal your personal information or to turn your computer into a remotely-controlled zombie. This is most commonly achieved through computer viruses and other malicious code, but that's why you have antivirus software, right?

Well, yes, but online criminals do everything they can to try and 'hide' their bad code from your virus scanner. It doesn't always work, but they generally try to accomplish this by tricking another program on your computer into letting the bad code in (unbeknownst to your antivirus software). To this end, and in an effort to infect as many computers as possible, they focus on finding 'holes' in software that many people have installed already: Windows, Internet Explorer, Adobe Reader, Flash, Java, etc.

Of course, companies like Microsoft and Adobe are aware that their software is being leveraged to deliver malicious code, so they develop patches to fix known vulnerabilities and send them out to their users as security updates. Unfortunately, these are the same users for whom closing a dialog box asking to install updates is like a reflex. These updates are stopped dead in their tracks, leaving their associated security vulnerabilities unpatched.

Facts

Inconvenient or not, this kind of behavior is a mistake. Online criminals all but rely on the fact that users never install security updates, and design their attacks accordingly. That's right: computer viruses generally take advantage of security holes for which patches already exist. According to Orange, CA-based M86 Security, this is a trend that turns up consistently in their research. In the second half of 2010, the 15 most commonly exploited vulnerabilities had already been patched, meaning that basic software updates could have stopped all of them. Their most recent Internet security report concludes:

We continue to see the most popular exploits targeting older vulnerabilities that have already been patched, with Adobe Reader/Acrobat and Internet Explorer remaining a consistent choice for attackers. Our research suggested that Java-based vulnerabilities would increase significantly, and they did. We continue to caution users that the best way to avoid becoming a victim is to ensure that all of their applications are updated to the most recent versions.

Following up on this recommendation, they go on to say:

Stay up to date. Keep Web browsers, add-ons/extensions, and desktop applications up to date with their latest versions. We have seen time and again that [internet] attacks target vulnerabilities found in old versions of Web browsers or applications. Organizations are not blocking the latest spam and Web threats simply because their products are not up to date.

What to Do

I'll admit that keeping so many programs up to date can be daunting, and to many it will seem like a significant drain on (waste of) their time. Fortunately, the most vulnerable programs all have automatic update features (automatic inasmuch as you will be notified whenever updates are available). Of the programs that ask, you absolutely should oblige the following:

• Windows (via Windows Update), OS X (via Software Update)
• Internet Explorer, Firefox, Chrome, Safari (any web browser, really)
• Browser Plugins (especially for Firefox)
• Microsoft Office
• Adobe Reader
• Adobe Flash
• Java

It's hard to narrow down the list any more than that. Hackers are always on the move, and constantly target different platforms to keep computer users guessing. Early last summer, nearly 50% of all web-based attacks targeted Adobe Reader (via malicious PDFs), yet by October the Java platform had grown to become the most-exploited. The lesson here? Hackers target all common software packages, and your best bet is to keep all of them, not just some of them, up to date.

To find out which of your applications need to be updated, check out Secunia Online Software Inspector (Windows users only). Once you run the scan, you'll get a list of which programs are out of date, along with links to download the latest versions. The links you get, though, are to the software vendor's individual websites, which will generally require a complete (re)install of each program. I'd recommend using the update features of the individual programs instead, as they'll do a better job of getting you exactly what you need.

You know, those update prompts you've been ignoring?

;-)


011110010111010101101101

Untangling Your Computer

Illustration by Yevgeniya Mikhailik - www.yevgeniyadraws.com

Believe it or not, computers always do exactly what they're told.

You may not ever see the faulty piece of code that brings your productivity to a grinding halt, but this doesn't herald a breakdown of the laws of cause-and-effect. If something goes wrong, the computer was probably just following orders, whether from you or some unknown program running in the background.

This idea is helpful, even in the abstract, because it illustrates the fact that computers, as complex as they are, can actually make sense too. You really don't need to know much to solve basic problems on your own, because once you learn a few things, even the things you don't fully understand will begin to make more sense.

My plan is to empower you with the basic knowledge that every computer user should have so that the most common problems you face will leave you with a sense of empowerment rather than a sense of helplessness. With the right mindset, you can use your computer as the productivity tool it is, rather than some unruly machine to be coaxed into behaving desirably.

Computers were designed by people to be used by people. They shouldn't be alienating. My goal is to break down these barriers, not with the intent of making you into a computer expert, but simply to bring you and your computer closer together.

<3