Is the automatic update feature in Win. XP-Home a potential source of mischief for hackers and other ill intentioned types?
It seems to me that some unscrupulus character(s) could use this as a way to wreak havoc on computers having this feature.
I recall hearing a while back that some hacker had “spoofed” the Microsoft Windows Update site.
But that would only be a problem if you had responded to an e-mail that appeared to be from Microsoft.
Actually, Microsoft doesn’t send out unsolicited security alerts. You should never respond to such a thing if you see one.
But I have used Windows (Automatic) Update faithfully for the past 2 years, with Windows 98, Windows NT, Windows 2000, and Windows XP Professional. I had a problem with one update that locked up a machine, but it rebooted and then worked fine.
I’d say that’s a great record, since they issue security patches fairly often (2-4 times per month, I’d guess).
The short answer is, yes, I’m sure someone can figure out a way to crack the system, but IMHO you’re at much greater risk if you don’t apply the security patches from Windows Update right away.
What you should do is set up the Automatic Update so that it prompts you to download and install, rather than doing it purely automatically.
If you’re concerned about that, just put it on your calendar to check the Windows Update site manually every week or so, and good luck if you miss a patch!
By and large, no, it’s not a source of mischief. To be able to take advantage of it a hacker would have to be able to spoof the internet domain registration system to redirect traffic to his own server(s) rather than Microsoft’s. This is a major undertaking. Then the hacker would still be faced with the problem of constructing a working patch that would carry out a nefarious purpose.
It’s a lot of effort when you consider that an awful lot of people will just run any old executable you send to them.
There have been a couple of cases where patches have caused trouble with some people’s machines. This was caused by a lack of testing at MS - it’s a difficult balance when you have to ensure it’ll work on an arbitrarily large number of hardware configurations and get it out quickly. Usually though there’s no problem.
I generally set up a system to download patches in the background and then notify me when they’re ready for installation. I then opt in/out as I see fit.
Why can’t they set a spyware program that pretends to be Windows update but allows a hole for much larger trojans to pass through?
Hey, it’s possible, I suppose.
But why couldn’t they pretend to be anything - like Adobe or RealOne or any other “trusted” software that pops those “Update now?” prompts?
Not using Windows Update would be worse than a useless strategy.
The only solution is to have up-to-date Windows, up-to-date AV, and up-to-date firewalls.
And then you’re not perfectly safe. :rolleyes:
The gain is greater than the risk.
Not a risk for the scenario you propose. However, Computerworld reports that IT managers don’t trust all the updates coming from Microsoft, since they can’t be backed out and have been know to be buggy. This is a smaller risk for a home machine, and must be balanced with not getting around to doing a really important update.
From my experience, some of the updates can’t be backed out and a few have been buggy.
As I said, I’ve had trouble only with one update on one machine, after installing probably over 100.
I can’t say off the top of my head what percentage can’t be uninstalled, but it’s probably in the range of 30-70%.
Never wanted to back one out, myself.
Well we definatley did, about 2 years ago we had one that screwed up our company e-mail completely.
Not only did we have to remove it but we had to make sure not to accidently re-install it everytime we updated
Was this a Windows Update or Office Update? (I wonder if it was an update to Outlook?)
Just curious.
The ones I’ve learned to be careful about are the driver updates. I’ve had a couple of those leave me with a non-working machine, and my configuration is pretty plain-vanilla. One display driver update produced a desktop that can only be described as German Expressionist, with a dash of psychotic. Happily, a safe mode boot got me to a place where I could actually see what I was doing, so I could retreat to a system restore point. Now, I just make sure I create a system restore point before accepting a driver update.
Yeah, I never even tried to do a driver update. I instinctively didn’t trust them.
Good advice.
I don’t know about the hacking angle.
However, I once did a windows update on my windows 2000 machine at work. I went to the Microsoft web page and dowloaded and ran the update. Upon restart I got a blue screen. My windows kernel was gone and my machine needed to be totally re-imaged.
I know, I know. Every PC person I have talked to says this is impossible. Everyone seems to think that doing the updates is the safer thing to do.
But, it can happen. It did to me.
Debaser, I feel your pain. You make a good point.
Really, any time you update your system, whether it’s Windows Update, installing new hardware, or installing/upgrading other software, you’re taking a chance.
I’ve gotten so comfortable with Windows Update that I don’t really bother making special backups or restore points before using it any more.
But I do have periodic whole-system backups from which I can completely restore my system (including Windows) in case I have to. And I keep more frequent backups of any important data (like documents, spreadsheets, whatever).
Then, if the Blue Screen of Death arrives, I don’t lose very much beyond the time to restore.
I’m backing up my files right now. My timestamp is showing the last time I backed up was in July. D’oh!
Backing up now? Are you still recovering from the Venison fest? (Inside joke.)
I’m personally a believer in updates, but as Debaser has mentioned (and lamented to me personally) they can go wrong.
I see it like the seatbelt bit, I’d rather have it than not, </sarcasm> even though “everyone I know” would have died if they had been wearing it in “fill in blank” accident. </sarcasm>
-Butler
Still lurking, eh?
54 posts since Nov 2001. I think you need to pick it up a notch.
But, I buy your theory on updates like seatbelts. Like I said, even though I’ve been burned once I still do them.
People that know more than I do about PC’s (like you) say so.