# Auto Update a Source of Mischief? **URL:** \ **Category:** Great Debates\ **Created:** [December 9, 2003, 1:03pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900 "2003-12-09T13:03:23Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![spingears](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@spingears](https://boards.straightdope.com/u/spingears)\ **Post date:** [December 9, 2003, 1:03pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/1 "2003-12-09T13:03:23Z")
Is the automatic update feature in Win. XP-Home a potential source of mischief for hackers and other ill intentioned types? It seems to me that some unscrupulus character(s) could use this as a way to wreak havoc on computers having this feature. ---
**Author:** ![MyOld85MG](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@MyOld85MG](https://boards.straightdope.com/u/MyOld85MG)\ **Post date:** [December 9, 2003, 4:31pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/2 "2003-12-09T16:31:07Z")
I recall hearing a while back that some hacker had [“spoofed” the Microsoft Windows Update site](http://www.sanjuanislander.com/technology/problems/f-secure.shtml). But that would only be a problem if you had responded to an e-mail that appeared to be from Microsoft. Actually, Microsoft doesn’t send out unsolicited security alerts. You should never respond to such a thing if you see one. But I have used Windows (Automatic) Update faithfully for the past 2 years, with Windows 98, Windows NT, Windows 2000, and Windows XP Professional. I had a problem with one update that locked up a machine, but it rebooted and then worked fine. I’d say that’s a great record, since they issue security patches fairly often (2-4 times per month, I’d guess). The short answer is, yes, I’m sure someone can figure out a way to crack the system, but IMHO you’re at much greater risk if you don’t apply the security patches from Windows Update right away. What you should do is set up the Automatic Update so that it prompts you to download and install, rather than doing it purely automatically. If you’re concerned about that, just put it on your calendar to check the Windows Update site manually every week or so, and good luck if you miss a patch! 🆒 ---
**Author:** ![Armilla](https://avatars.discourse-cdn.com/v4/letter/a/e19b73/32.png) [@Armilla](https://boards.straightdope.com/u/Armilla)\ **Post date:** [December 9, 2003, 5:03pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/3 "2003-12-09T17:03:32Z")
By and large, no, it’s not a source of mischief. To be able to take advantage of it a hacker would have to be able to spoof the internet domain registration system to redirect traffic to his own server(s) rather than Microsoft’s. This is a major undertaking. Then the hacker would still be faced with the problem of constructing a working patch that would carry out a nefarious purpose. It’s a lot of effort when you consider that an awful lot of people will just run any old executable you send to them. There have been a couple of cases where patches have caused trouble with some people’s machines. This was caused by a lack of testing at MS - it’s a difficult balance when you have to ensure it’ll work on an arbitrarily large number of hardware configurations _and_ get it out quickly. Usually though there’s no problem. I generally set up a system to download patches in the background and then notify me when they’re ready for installation. I then opt in/out as I see fit. ---
**Author:** ![Shalmanese](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@Shalmanese](https://boards.straightdope.com/u/Shalmanese)\ **Post date:** [December 9, 2003, 5:19pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/4 "2003-12-09T17:19:17Z")
Why can’t they set a spyware program that pretends to be Windows update but allows a hole for much larger trojans to pass through? ---
**Author:** ![MyOld85MG](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@MyOld85MG](https://boards.straightdope.com/u/MyOld85MG)\ **Post date:** [December 9, 2003, 5:54pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/5 "2003-12-09T17:54:46Z")
> [@](#): > > \*Originally posted by Shalmanese \* > \*\*Why can’t they set a spyware program that pretends to be Windows update but allows a hole for much larger trojans to pass through? \*\* Hey, it’s possible, I suppose. But why couldn’t they pretend to be anything - like Adobe or RealOne or any other “trusted” software that pops those “Update now?” prompts? Not using Windows Update would be worse than a useless strategy. The only solution is to have up-to-date Windows, up-to-date AV, and up-to-date firewalls. And then you’re not perfectly safe. :rolleyes: ---
**Author:** ![SmackFu](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@SmackFu](https://boards.straightdope.com/u/SmackFu)\ **Post date:** [December 9, 2003, 5:58pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/6 "2003-12-09T17:58:13Z")
The gain is greater than the risk. ---
**Author:** ![Voyager](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/voyager/32/133_2.png) [@Voyager](https://boards.straightdope.com/u/Voyager)\ **Post date:** [December 9, 2003, 6:09pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/7 "2003-12-09T18:09:48Z")
Not a risk for the scenario you propose. However, Computerworld reports that IT managers don’t trust all the updates coming from Microsoft, since they can’t be backed out and have been know to be buggy. This is a smaller risk for a home machine, and must be balanced with not getting around to doing a really important update. ---
**Author:** ![MyOld85MG](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@MyOld85MG](https://boards.straightdope.com/u/MyOld85MG)\ **Post date:** [December 9, 2003, 6:41pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/8 "2003-12-09T18:41:32Z")
> [@](#): > > \*Originally posted by Voyager \* > **… IT managers don’t trust all the updates coming from Microsoft, since they can’t be backed out and have been know to be buggy.** From my experience, **some** of the updates can’t be backed out and **a few** have been buggy. As I said, I’ve had trouble only with one update on one machine, after installing probably over 100. I can’t say off the top of my head what percentage can’t be uninstalled, but it’s probably in the range of 30-70%. Never wanted to back one out, myself. ---
**Author:** ![spanna](https://avatars.discourse-cdn.com/v4/letter/s/a6a055/32.png) [@spanna](https://boards.straightdope.com/u/spanna)\ **Post date:** [December 10, 2003, 3:14pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/9 "2003-12-10T15:14:57Z")
Well we definatley did, about 2 years ago we had one that screwed up our company e-mail completely. Not only did we have to remove it but we had to make sure not to accidently re-install it everytime we updated ---
**Author:** ![MyOld85MG](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@MyOld85MG](https://boards.straightdope.com/u/MyOld85MG)\ **Post date:** [December 10, 2003, 4:34pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/10 "2003-12-10T16:34:17Z")
> [@](#): > > \*Originally posted by spanna \* > **Well we definatley did, about 2 years ago we had one that screwed up our company e-mail completely.** Was this a Windows Update or Office Update? (I wonder if it was an update to Outlook?) Just curious. ---
**Author:** ![Early\_Out](https://avatars.discourse-cdn.com/v4/letter/e/6f9a4e/32.png) [@Early\_Out](https://boards.straightdope.com/u/Early_Out)\ **Post date:** [December 11, 2003, 7:41am UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/11 "2003-12-11T07:41:32Z")
The ones I’ve learned to be careful about are the driver updates. I’ve had a couple of those leave me with a non-working machine, and my configuration is pretty plain-vanilla. One display driver update produced a desktop that can only be described as German Expressionist, with a dash of psychotic. Happily, a safe mode boot got me to a place where I could actually see what I was doing, so I could retreat to a system restore point. Now, I just make sure I create a system restore point before accepting a driver update. ---
**Author:** ![MyOld85MG](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@MyOld85MG](https://boards.straightdope.com/u/MyOld85MG)\ **Post date:** [December 11, 2003, 3:00pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/12 "2003-12-11T15:00:01Z")
Yeah, I never even tried to do a driver update. I instinctively didn’t trust them. Good advice. ---
**Author:** ![Debaser](https://avatars.discourse-cdn.com/v4/letter/d/3da27b/32.png) [@Debaser](https://boards.straightdope.com/u/Debaser)\ **Post date:** [December 11, 2003, 3:22pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/13 "2003-12-11T15:22:19Z")
I don’t know about the hacking angle. However, I once did a windows update on my windows 2000 machine at work. I went to the Microsoft web page and dowloaded and ran the update. Upon restart I got a blue screen. My windows kernel was gone and my machine needed to be totally re-imaged. I know, I know. Every PC person I have talked to says this is impossible. Everyone seems to think that doing the updates is the safer thing to do. But, it can happen. It did to me. ---
**Author:** ![MyOld85MG](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@MyOld85MG](https://boards.straightdope.com/u/MyOld85MG)\ **Post date:** [December 11, 2003, 3:36pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/14 "2003-12-11T15:36:44Z")
**Debaser** , I feel your pain. You make a good point. Really, any time you update your system, whether it’s Windows Update, installing new hardware, or installing/upgrading other software, you’re taking a chance. I’ve gotten so comfortable with Windows Update that I don’t really bother making special backups or restore points before using it any more. But I **do** have periodic whole-system backups from which I can completely restore my system (including Windows) in case I have to. And I keep more frequent backups of any important data (like documents, spreadsheets, whatever). Then, if the Blue Screen of Death arrives, I don’t lose very much beyond the time to restore. ---
**Author:** ![Debaser](https://avatars.discourse-cdn.com/v4/letter/d/3da27b/32.png) [@Debaser](https://boards.straightdope.com/u/Debaser)\ **Post date:** [December 11, 2003, 5:36pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/15 "2003-12-11T17:36:19Z")
I’m backing up my files right now. My timestamp is showing the last time I backed up was in July. D’oh! ---
**Author:** ![butler1850](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@butler1850](https://boards.straightdope.com/u/butler1850)\ **Post date:** [December 11, 2003, 7:13pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/16 "2003-12-11T19:13:33Z")
Backing up now? Are you still recovering from the Venison fest? (Inside joke.) I’m personally a believer in updates, but as Debaser has mentioned (and lamented to me personally) they can go wrong. I see it like the seatbelt bit, I’d rather have it than not, \ even though “everyone I know” would have died if they had been wearing it in “fill in blank” accident. \ -Butler ---
**Author:** ![Debaser](https://avatars.discourse-cdn.com/v4/letter/d/3da27b/32.png) [@Debaser](https://boards.straightdope.com/u/Debaser)\ **Post date:** [December 11, 2003, 8:20pm UTC](https://boards.straightdope.com/t/auto-update-a-source-of-mischief/217900/17 "2003-12-11T20:20:02Z")
Still lurking, eh? 54 posts since Nov 2001. I think you need to pick it up a notch. But, I buy your theory on updates like seatbelts. Like I said, even though I’ve been burned once I still do them. People that know more than I do about PC’s (like you) say so.