Re: Windows Update: A single point of failure for the world's economy?

From: Barry Fitzgerald (bkfsec_at_sdf.lonestar.org)
Date: 09/04/03

  • Next message: nologin: "DoS - affecting _both_ ZA and W98"
    Date: Thu, 04 Sep 2003 10:57:37 -0400
    To: Paul Schmehl <pauls@utdallas.edu>
    
    

    Paul Schmehl wrote:

    > --On Sunday, August 31, 2003 09:01:49 PM +0200 Stefano Zanero
    > <stefano.zanero@ieee.org> wrote:
    >
    >>
    >> Enabling a world-wide auto-update feature does indeed seem much of a
    >> security risk to me.
    >>
    > More of a risk than up2date for RedHat or emerge -u system for
    > Gentoo? Or cvsup for *BSD?
    >

    I don't think that it's the existance of the autoupdate feature in the
    first place that is the problem, but the fact that they're thinking
    about making it impossible to turn off. Mandating patches and removing
    the control to stop them from being applied - either from the end user
    or the administrator - is a seriously bad thing. Having methods of
    easily updating your system, on the other hand, is a good thing.

    And I'll be the first to say that any existing mature package management
    system (by this I mean RPM's and DEB files) for *nix systems is far more
    "fault tolerant" than MS Windows' patching methodology. That's not to
    say that I haven't installed RPMs in the past that have caused me
    trouble - I have. But, rather, that the issues have been fewer and
    easier to resolve, in my experience. Try remotely diagnosing an issue
    with RPM roll-out versus an issue with an MS patch roll-out and you'll
    see the difference - it's as clear as day.

    And I'm not just talking about patches which make a system
    non-bootable. To limit "problems with patches" to mean "making a
    system non-bootable" is to only consider one of the worst possible
    results of patching. Patching can have other problematic results that
    don't show up immediately. That's the problem with having mixed DLLs
    and other files on the system. Diagnosing problems like this stemming
    from Microsoft released patches can be really troublesome sometimes.
    But, that's just the difference between the way that MS Windows is
    engineered and the way that GNU/Linux is engineered.

    So, yes, I do consider patching MS Windows systems to be more of a risk
    than patching RedHat or Gentoo systems - and by extension an autoupdater
    is also more of a risk. That's just my experience.

    Having said that, I don't allow any of my systems to automatically
    update. I prefer to have more control than that.

                 -Barry


  • Next message: nologin: "DoS - affecting _both_ ZA and W98"

    Relevant Pages

    • Re: [Full-disclosure] Getting Off the Patch
      ... patch a piece of software. ... patching is just a small part of the solution. ... One of the things with patches is, that people have an urge to apply them. ... who want audit verification of how vulnerabilities are being mitigated. ...
      (Full-Disclosure)
    • RE: Should webservers, eg. IIS 6 have anti--virus installed on them?
      ... the patches, the code, the firewall, it's configuration and patches and ... Do I want A/V as another onion layer skin? ... You either choose to accept the risk of pushing out defs ... >the resources to put the same testbed energy into a/v sig updates as ...
      (Focus-Microsoft)
    • Re: [Full-disclosure] Getting Off the Patch
      ... There are something like 800 heterogeneous servers where I work. ... As for having to spend a lot of cycles testing patches, ... engineer who has been playing this patching game for 20 years. ... who want audit verification of how vulnerabilities are being mitigated. ...
      (Full-Disclosure)
    • Re: Thank You - 12 Companies 1 Server
      ... Patches should only be necessary in EXTREEM cases - you make it sound ... and we didn't have good sources for patching information. ... For servers, I'm aware of the updates because of SUS, and I ... > Saturday - maybe an hour per month at most to patch the SBS and two other ...
      (microsoft.public.windows.server.sbs)
    • Re: exploit to vulnerability
      ... risk of the vulnerability. ... Testing patches to ensure a working system.. ... If a patch doesn't do it's job...it's pretty quickly that it's discussed ... >Microsoft to protect our machine anyway? ...
      (Focus-Microsoft)