Microsoft Security Patch Rummors

I was wondering if anyone could clarify this for me or give me a for sure answer. I have been told by a few people (some computer techs for my internet cafe I have in the Philippines, when I was living there) NOT to download and install the security patches off the microsoft website, cause it makes your computers more vulnerable, and I have been told by other people (again, some of them computer techs) that Yes, you should download and install the security patches when microsoft puts them out. Can anyone give me a for sure answer to this?

ALWAYS keep it updated. Not updating it is like finding out that the lock on your house has a vuln where someone can simply use a key they found in their car to unlock your house, and all you have to do to fix it basically shove something onto it. Most worms propagate due to unpatched systems. If you have a firewall, it lessens this risk, but not enough considering how easy patching is to home /personal computers. Patches rarely cause problems that are major for home/personal users.

I gotta agree with Grunt. Keeping your machine patched and up-to-date is probably one of the best, if not the best, thing you can do to keep your computer safe. The only other thing that might be more protective is AV, but, as they say "better safe than sorry". Prevention is alot easier than restoration. Firewalling also goes a very long way to keep you box safe. I don't see why anyone would advise someone not to update.

get linux:)

Quote:

---

Originally posted here by karmine
get linux:)

---

Like that helps any. Gotta update most major distros just as much as Windows, if not more, depending on how much stuff you think you need.

Also, perhaps you miss understood your friend ? If Microsoft send you out an email with a patch attached, then it is not legit. It should NOT be downloaded. Microsoft will never send you a patch via email, only via automatic updates and their website....

the way i look at it, linux is less prone to virii, script kiddies, and the lot. even if script kiddies could compromise your security, what could they do....sit on your box for an hour reading their "linux for dummies" book while you sit there knowing youve been broken into wait for the next move?

There's a whole lot more rootkits for *nix than for windows. It all depends on the admin and how much attn they pay to their system. I would notice just as quickly as someone on *nix if my system was hacked.

You should apply all security patches unless they are so major that they have known incompatibility issues that apply to YOU. Similarly, if they relate to something you do not have, there is no point.

Quote:

---

I have been told by a few people (some computer techs for my internet cafe I have in the Philippines, when I was living there) NOT to download and install the security patches off the microsoft website, cause it makes your computers more vulnerable

---

So where else will you get them?.............or are they suggesting that you leave the systems unpatched?

I have Trend Micro security suite 7 running on this machine......it combines AV and firewall. The AV will update daily, and in the 30 seconds or so that it switches itself off to apply the update, my "little man" who runs quietly in the background, will block maybe one or two hits............that is the environment that we are living in.

On the other hand, I am talking about a licenced software environment, maybe those guys are not?

My thoughts :)

Quote:

---

Originally posted here by karmine
the way i look at it, linux is less prone to virii, script kiddies, and the lot. even if script kiddies could compromise your security, what could they do....sit on your box for an hour reading their "linux for dummies" book while you sit there knowing youve been broken into wait for the next move?

---

http://en.wikipedia.org/wiki/Security_through_obscurity

Just because linux is "indie" doesn't make secure, you still have to update it like everyone else. This discussion would still apply regardless of the OS.

Back on track...
Get your patches from the official source, in your case the windows update site. You can't get it a more trustworthy way unless they mail you an update CD.

Quote:

---

Originally posted here by Soda_Popinsky
http://en.wikipedia.org/wiki/Security_through_obscurity

Just because linux is "indie" doesn't make secure, you still have to update it like everyone else. This discussion would still apply regardless of the OS.

Back on track...
Get your patches from the official source, in your case the windows update site. You can't get it a more trustworthy way unless they mail you an update CD.

---

Hey Hey,

I'm sick of the 'install Linux' **** just like everyone else... and I definately agree that you should deal with a valid source and a trustworthy one such as Windows Update... but being mailed a CD isn't really any better than email... the CD could come from anywhere.... and just be made up to look realistic... Actually it's not a bad idea for a scam... and it's one I'm surprised we haven't seen yet.

As far as updates go.... It depends on what you're dealing with... If you have a bunch of large mission critical servers, you're going to want to test some of the more major patches in R&D before installing them in production.... the same goes for the service pack... it's also true that it's not a bad idea to hold off on the service packs for a little while.... they tend to be flaky for a while.. but then updates are released for them and it's nice to have it all installed and stable at the same time.

That's my two cents anyways.

Peace,
HT

I should have been more specific, of course you would request a CD, and I would trust a requested CD through the mail more than the Windows Update server. Your risk doesn't depend on the server's integrity, as well as internet risks such as MITM's, among other things. I don't know how the post office verify's a sender, but you could go to the PO and pick up a MS shipment if you really needed to verify the integrity of a update CD, such as in a corporate enviroment... or whatever you know what I mean. :D

Mailing out fake update cd's... now thats aggressive, and expensive! ;) I doubt there will be mass mailings of something like that, but I'd try it during a pen-test.

Quote:

---

Originally posted here by Soda_Popinsky
I should have been more specific, of course you would request a CD, and I would trust a requested CD through the mail more than the Windows Update server. Your risk doesn't depend on the server's integrity, as well as internet risks such as MITM's, among other things. I don't know how the post office verify's a sender, but you could go to the PO and pick up a MS shipment if you really needed to verify the integrity of a update CD, such as in a corporate enviroment... or whatever you know what I mean. :D

Mailing out fake update cd's... now thats aggressive, and expensive! ;) I doubt there will be mass mailings of something like that, but I'd try it during a pen-test.

---

Hey Hey,

While mailing out a shitload of Windows Update CDs in a similar fashion to AOL CDs may be a little costly... there is potential for a large return depending on the malware contained on the disk and it's purpose. It'd be interesting to see the results of such an attempt and how successful they were.

I'm sorry for bringing this thread off topic... but I find this to be a much more interesting idea than whether or not updates should be installed (which has already been answered... so if that's what you're looking for you should have stopped reading several post ago)... anyways...

Your comments have intrigued me even further Soda... It's amusing that today we're much more security conscious than we were 20 years (then again... 20 years ago I was almost 3).. yet we still miss the basics.. That's what always catches us... The majority of the user of this site are familiar with Man-in-the-Middle (MITM) attacks.... but why must this be technology related? MITM is an interception of data for the most part... this could quite easily be pulled off with the snail mail system. It could involve technology... I, as a disgruntled employee, or someone who has already compromised the corporate infrastructure, could learn of a request for an update CD and easily forge a CD and mail it out... listing the address as Microsoft... Printers capable of printing directly to CDs would make the spoof even easier to pull off. I could also intercept the mail returning to you... Believe it or not... the post office doesn't require a lot of information to release a parcel... Sometimes just a name and other times photo ID... how many teenagers do you know going to the bar with fake ID... I know a place in downtown Toronto where I can buy ID for any state or province for $30 CDN. I pick up your mail... (or just take it from your mailbox... depending on the circumstances)... open the envelope (the MS Update CDs come in a brown manilla envelope... or mine did anyways) take the content, replace the cd and seal all the content in a new envelope... mailing it back out to you with Microsofts return address in the corner.

Anyways.... just some random ramblings @ 3:30AM...

Peace,
HT

PS... I'm 7 days away from my 2 year AO Anniversary... I prefer cash gifts. :P

Quote:

---

PS... I'm 7 days away from my 2 year AO Anniversary... I prefer cash gifts. :P

---

Well I hope nobody intercepts the check that I sent you and replaces it with monopoly money. :)

Outer_Heaven:
I wonder if they are trying to convey to you that you shouldn't use it update un-licensed software that has been obtained via...questionable methods? A little paranoia on their part?

Most of the Senior AO members responses have been right on...keep your system up to date with the latest patches, from a TRUSTED source. The ONLY trusted source I know of for M$ updates is Microsoft itself. As for Linux...that's a whole different story.

Although you could hijack CD's through the mail, I think it would be much more effective another way. Instead of imitating MS cd's, grab a high school directory and send out fake video game demo CD's for some fake (or real) magazine and have it say it includes demos for games (pick good ones :P). It would be much easier to pull off.

But if you really needed to mess with a certain target, then yeah you could feasibly hijack a update CD.

But when it comes to what I would choose for my updates, I would choose the post office instead of the 12 hops between myself and MS. At least I can point my finger at the post office or have them begin an investigation... or something. :D

Yea but by the time you get the CD in the mail the patches need patched :)

Quote:

---

Outer_Heaven:
I wonder if they are trying to convey to you that you shouldn't use it update un-licensed software that has been obtained via...questionable methods? A little paranoia on their part?

---

Hmmmm, that could very well be. It is UNBELIEVABLE how much pirated crap is flying around there in the Philippines, everywhere you go and look all you see is pirated video games, dvd's and software, so that could very well be it. But why would they be concerned about it, cause it was my computers, so I would be the one to take the hit. But they pretty much told me not to download the security patches off the microsoft website cause they said it will make your computers more vulnerable and open to attack. They said that they had software, cd's, that we should use to install the patches. But now that I think of it, the cd's they had would probably be pirated, too, or, what my wife was thinking, cause we would have them service our computers every week or so, but she was thinking that maybe they were just saying that so we would have to call them to install the patches when they came out so they could make money. But she has got a bachelors in CS though, and she would get on me, too when I would check the computers for updates and install them from the microsoft website.

So, I myself, have always been a firm believer in downloading and installing them off the microsoft website, and would always do so anyway, it was just other people telling me I shouldn't. But I was talking to my father yesterday, about this similar topic, but for the wireless laptop we got, and he said that at his work they too use the MS website to download and install patches, but, he did say that they did find a problem with one of the security patches they put out recently, I think he said security patch 2 or something? He wasn't exactly sure himself, so don't quoate me on this, but he said there was a problem with ONE of the patches they put out recently. But he said that's how his company gets their updates, too

Service pack 2 did have some problems when it was first released but the majority of the problems with it stemed from the computer not being properly prepared. Such as spyware removed etc etc.