DO NOT JUST BLAME USERS FOR RPC WORM!

  • Thread starter Thread starter kurttrail
  • Start date Start date
K

kurttrail

If MS didn't put out bad patches, like 811493, then more people might
keep up with MS's security patches!

MS is does share in the blame!

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.kurttrail.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
I agree. But...the only real people to blame is the virus creator
themselves. Ignorance on computer security is very common. "Holes" in
windows are common and are going to happen(with any os). The scumbags who
write the viruses are the prob. Just because you can exploit something or
someone does not mean you should. If these scums were dead, we wouldn't need
patches and av programs.
 
Come on, now -
If someone who doesn't belong there walks past barricades and signs saying
"Construction area, DO NOT ENTER" and "Hard hat area" and gets squashed by a
steel beam dropping on them, do you blame the construction company?

Or perhaps a bit closer - if a car company issues a notice to owners of
their new MZ-984 sedan that they should "See their authorized repair shop
for X repair - an issue has been found that, if not resolved, could result
in engine fire. The repair will be done at no cost to you." Someone ignores
it and a month later the car is destroyed by an engine fire - who's to
blame? Sure, the car company "should" have caught that earlier perhaps, but
they notified everyone AND made the repair free. The owner/user didn't do
what THEY should.

What? MS didn't notify anyone? Hmm... Start... Windows Update. And it's
free. And the fix has been out for... how long? Plus there's a free
firewall? Hmmm... yeah, really MS's fault that so many people DON'T PATCH OR
SECURE THEIR SYSTEMS.

Me, since (a) I'm behind a firewall and (b) fully patched... I can sit here
and smile.
 
purplehaz, after spending 3 minutes figuring out which end of the pen to use,
wrote:

I agree. But...the only real people to blame is the virus creator
themselves. Ignorance on computer security is very common. "Holes" in
windows are common and are going to happen(with any os). The scumbags who
write the viruses are the prob. Just because you can exploit something or
someone does not mean you should. If these scums were dead, we wouldn't need
patches and av programs.
Click to expand...

They serve a pretty good purpose actually...to try and get M$ to pull its head
out, and start to do things better than they are. With untold numbers of *paid*
programmers, they should be able to do *much* better with the OS, unless of
course M$ makes sure they *don't*, so that the pyramid scheme won't be lost.

John
--
Find the MS programmers you need at: <http://www.newtechusa.com/PPI/main.asp>

If the Matrix was run by WindowsXP: http://www.matrix-xp.com/index2.php?lang=eng
(download the movie to find out!)

http://microscum.kurttrail.com/mmpafaq/mmpafaq.htm
 
purplehaz said:
I agree. But...the only real people to blame is the virus creator
themselves. Ignorance on computer security is very common. "Holes" in
windows are common and are going to happen(with any os). The scumbags
who write the viruses are the prob. Just because you can exploit
something or someone does not mean you should. If these scums were
dead, we wouldn't need patches and av programs.
Click to expand...

BLASTER seems to me to be a social statement. Deliberately showing
itself with bad code, and doing no serious permanent damage. I can
understand the why in this case but don't agree with it being unleashed,
and not everybody writing exploits is doing it for nefarious reasons,
but there will always be scumbags, and when caught should be prosecuted
to the full extent of the law, plus monetary damages!

And this particular buffer overrun has been in Windows since NT4, and
was also released with Windows Server 2003, so MS's 'Trustworthy
Computing' was of absolutely no help! Combined this with the recent bad
critical update, MS and especially it's minions here should be a lot
more understanding that neophyte End Users have been caught up in this
RPC/Blaster flood! I know I've been waiting at least a couple of weeks
after a patched is released before I even attempt to test it out on the
computers I take care of at work.

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.kurttrail.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
Ben said:
And if the Auto Update was even semi-functional this
could have been headed off. I'm faced with the decision
of setting everyone up as an Administrator (and God knows
what vulnerabilities I open with that) so they can get
automatic updates, or leaving them as standard users and
having to walk around from computer to computer to get
the updates.
Click to expand...

Your the admin? Why have'nt you looked into the systems update server?
There is NO reason to walk around to each machine OR set them
up as admins. The SUS is absolutly free and takes all of a half hour to
setup.
You run the SUS on one of your servers, it downloads all the critical
updates, you tell it which ones you want to be distributed, and the clients
download and install them automatically.
I did not have to install any patches on any of our servers or workstations
and we are doing just fine.
Not a single infection or RPC problem. Do yourself a favor and go to
Micrsoft's site and take a look at SUS. For a business it's a godsend.
 
At least in the US I blame the users 95%.
This has been in the papers, on television, even the government has
told people to go and get the patches from MS because they have been
EXPECTING an attack!
The patches have been out long enough that if there where any problems with
them we all would have known by now.
 
SunSpot said:
At least in the US I blame the users 95%.
This has been in the papers, on television, even the government has
told people to go and get the patches from MS because they have been
EXPECTING an attack!
Click to expand...

The government also told us that there was some immenent threat from
Iraqi WMD's!
The patches have been out long enough that if there where any
problems with them we all would have known by now.
Click to expand...

Probably, but people still delete the jdbgmgr.exe, and that hoax has
been known about for over a year! This problem has been in ever NT OS
since NT4 all the way thru Windows Server 2003!

"Trustworthy Computing" - Trust that MS will wait until someone forces
them to patch up their code!

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.kurttrail.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
David said:
One word, firewall.

Anyone with a configured firewall is safe from Internet-
based attacks by this worm. If people won't use the
tools available, it doesn't matter what OS they run.

If Microsoft changed the OS so that all connections are
firewalled no matter what, people would yell. If they
leave it as a default option, people yell. If it's not
on, people yell. What should they do then?

At some level, people have to use the tools available, no
matter what the OS is.
Click to expand...
Hopefully I'm "protected"...I keep Norton Anti-Virus updated once a
day(automatically), running the free "ZoneAlarm"(looking into getting
"Pro" soon), AND downloaded the Microsoft "security patch"!....
 
David said:
One word, firewall.

Anyone with a configured firewall is safe from Internet-
based attacks by this worm. If people won't use the
tools available, it doesn't matter what OS they run.

If Microsoft changed the OS so that all connections are
firewalled no matter what, people would yell. If they
leave it as a default option, people yell. If it's not
on, people yell. What should they do then?

At some level, people have to use the tools available, no
matter what the OS is.
Click to expand...

Constructive criticism is one thing. Some around here are showing their
frustration a little too much, and they just need to chill!

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.kurttrail.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
On 12/8/2003 10:44, kurttrail wrote:

BLASTER seems to me to be a social statement. Deliberately showing
itself with bad code, and doing no serious permanent damage.
Click to expand...

I'm not sure I entirely agree with that statement. See
http://news.com.com/2100-1002_3-5062655.html.

It may, indeed, do some serious and semi-permanent damage.

I'm not going to discuss this further; as I wrote, I'm really not sure
that I either agree nor disagree, I'm mainly bringing the above-cited
article to people's attention.
 
EGMcCann said:
Come on, now -
If someone who doesn't belong there walks past barricades and signs saying
"Construction area, DO NOT ENTER" and "Hard hat area" and gets squashed by a
steel beam dropping on them, do you blame the construction company?
Click to expand...

Depends if the signs were prominent enough, what if the person was partially
sighted and could not see them? The company should take all reasonable steps
to not only warn, but prevent accidental access by those who do not
understand there warning.
Or perhaps a bit closer - if a car company issues a notice to owners of
their new MZ-984 sedan that they should "See their authorized repair shop
for X repair - an issue has been found that, if not resolved, could result
in engine fire. The repair will be done at no cost to you." Someone ignores
it and a month later the car is destroyed by an engine fire - who's to
blame? Sure, the car company "should" have caught that earlier perhaps, but
they notified everyone AND made the repair free. The owner/user didn't do
what THEY should.
Click to expand...

In this scenario the car manufacturer would need to write to you as an
individual. If you then chose not to take their advice then its your fault.
Advertising the problem on TV or in Papers people have the right to chose
not to view or read is not adequate. Of course its the car manufacturers
fault.

I am not effected by this worm as I was already fully patched and behind a
firewall, but that is because I am fairly computer literate. I also
registered my copy of windows XP so they know my address. Did I get a
letter? No. because MS would rather try to make out it would be my fault if
I did not keep up to date. I say it would not be. MS are the cause of the
security hole - full stop.
 
EGMcCann said:
Perhaps, but we were talking about MICROSOFT. Come on, Microsoft?


Strange, they did have a patch available before this... hmmm. Seems
more like "Wait 'til someone FORCES the end user to APPLY the
available patch!" (And you can probably add "... that's been sitting
in the system tray saying "Ready to install" for the last month" to
that.)

No, for the most part, I don't believe in MS's "trustworthy
computing," and like it less and less. Yet in this case, it's like
someone coming up with a pill that will actually prevent cancer. Only
have to take it once.

Some people take it.

The doctor says it's free.

A few others take it.

The doctor *DRIVES TO EVERYONES HOUSE,* puts it in their mouths, and
says "All you have to do is swallow," and people don't take it - then
want to blame the doctor when they get cancer.

Sorry, the fact this is spreading is NOT MS's fault.
Click to expand...

What I meant was that MS doesn't go looking for flaws, just waits till
others find them first, otherwise Windows Server 2003 wouldn't have need
to be patched for this too!

Apologize for MS, if that rocks your boat, but this buffer overrun has
been in Windows since NT4, and was released in MS's first OS that was
released under the banner of "Trustworthy Computing!"

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.kurttrail.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
Lester Horwinkle said:
Yep, we all want to spend more time fixing our computers than using them.
Click to expand...


Hmm. Auto-update downloads patches and tells you when they're ready.

You double click.

Yep. Lot of time spent fixing that....
 
Lester Horwinkle said:
Yep, we all want to spend more time fixing our computers than using them.
Click to expand...

Since it takes less then 5 minutes at most to click the "install now" link,
you must not use your machine very much.
 
Constructive criticism is one thing. Some around here
are showing their
frustration a little too much, and they just need to
Click to expand...
chill!

I don't agree with you a lot of things, but on that, I do
100% agree.
 
"kurttrail" wrote:
Constructive criticism is one thing. Some around here are showing their
frustration a little too much, and they just need to chill!


The big frustration I feel right now is not with the masses of people who
don't or haven't or can't update and secure their computers. It the hordes
of people who now are crying out on this and similar forums for help,
without taking one single minute to look at the messages already posted
describing the same problem they have and detailing solutions. They only
exacerbate the bandwidth choking that the worm itself is causing.

In the military, we have a saying, "RTFM". Here I would say "RTFP" - Read
the freaking posts. The noise level is so high, anyone expecting to get a
direct answer back is bound to be disappointed, unless he reads the answer
to the post just above or below his own.

Those folks that have been diligently trying to help, posting and reposting
the needed info and links, are to be commended.

Val
 
VManes said:
"kurttrail" wrote:
Constructive criticism is one thing. Some around here are showing
their frustration a little too much, and they just need to chill!


The big frustration I feel right now is not with the masses of people
who don't or haven't or can't update and secure their computers. It
the hordes of people who now are crying out on this and similar
forums for help, without taking one single minute to look at the
messages already posted describing the same problem they have and
detailing solutions. They only exacerbate the bandwidth choking that
the worm itself is causing.

In the military, we have a saying, "RTFM". Here I would say "RTFP" -
Read the freaking posts. The noise level is so high, anyone
expecting to get a direct answer back is bound to be disappointed,
unless he reads the answer to the post just above or below his own.

Those folks that have been diligently trying to help, posting and
reposting the needed info and links, are to be commended.
Click to expand...

I'm not saying I don't understand the frustration, but you have to put
yourself in the computer neophytes shoes. Theyre in a virtual
minefield, and aren't sure which way to turn. Sure some people stay
cool under pressure, and calm down and take a little time to think
before reacting, but most people aren't like that. By now a google
search would get most an answer to this problem, and would be a logical
starting point, but when you only got a few minutes to find your answer
until your computer reboots again . . . .

It's a matter of perspective & understanding, and those who want to help
out around here, should try walking in the moccasins of those posting
their problems, before venting their frustration.

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.kurttrail.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
The problem with "Securing" a computer is the knowledge
gap for the average user. Most users are unaware of the
risks with a PC connected to the Internet. Try and explain
Cookies, Spyware, Open Ports, Firewalls, etc to a person
with limited Technical-IT skills.

Every time, I explain security risks to clients and recommend
Firewall & Anti-Virus software, 100% of them will buy and
install the programs. I've yet to have someone balk and refuse
once they "understand" what is needed. (Even the nortoriously
cheap ones)

On the issue of Microsoft and their "Flawed" software, that is
a wrong perspective. Many of the underlying structures found
in Windows are based on industry standards. (Protocols, etc).
Remember Windows has evolved and carried forward older
code with it. (XP is Windows 2000 is Windows NT4.....)
Debugging millions of lines of source code is akin to listening
for a message from ET, out of a billion stars.

There are many groups (CERT) that test and locate faults in
software. Once identified, Microsoft usually has a fix in place
to address the issue & Yes, occassionally the fix itself will
break something else.
 
Back
Top