Secure your computer by running updates frequently!

[sgt_zim]

If I haven't mentioned it before now...

I'm in the IT security biz. I mostly defend my employer, but I also engage in attacking (called "red teaming").

Without any question at all, the very best thing you can do to secure your computer is to run updates as frequently as they are available - for the operating system as well as non-OS applications like Firefox, Chrome, Notepad++, Adobe Acrobat, and a host of others.

When I run scans against a potential victim, I love nothing better than seeing outdated software. And the older, the better for me because it means I don't usually have to spend time working on a custom payload.

Mac OS users, this applies to you as well. Malware crafted for OSX exclusively is up by over 1000% in the last 3 years, and probably even higher than that. In fact, I'd say that running updates is even more important for you since there really aren't any good anti-virus products for Mac.

Between running updates and having "good" anti-virus, running updates is more important to your security than AV, and by a very wide margin.

As an FYI, official Microsoft support for Windows 7 ends on 15 Jan 20. After that, no more security updates for that operating system. Whatever security vulnerabilities exist at midnight on that date will exist forever. And make no mistake, more vulnerabilities will be discovered in Win 7 after that date.

 

[AfricaHunting.com]

Much appreciate you sharing this info with everyone here!

 

[sestoppelman]

I usually avoid updating when possible because it almost always makes my Del with Windows 8 run like crap. Thanks for the post Sgt.

 

[thi9elsp]

A good reminder. I retired from I.T. Though I was not a security expert, my last client was a retailer. As soon as we moved their new website to production we started getting hit from China and Russia. We had all of the proper pieces in place but the traffic they sent blew me away.

 

[Mr. Zorg]

Thanks Zim!

I was a victim of identity theft / credit card fraud in 1998 and although we were not held liable for any fraudulent charges, it took 9 months and a lot of hassle to get the CC company straightened out on which charges were and were not legitimate (it was eye-opening how financial sector employees assigned such duties were unable to simply perform a financial reconciliation much less comprehend the simplest concepts of Algebra). The fradulent charges were in the neighborhood of $10K 1998 dollars. I hate to think what could happen from a successful hack or phishing (or spear-phishing) attack might cause today.

My wife's smart phone is used for both her employer's business and some of our personal business and she gets a set reimbursement every paycheck from her employer. I worry more about a sucessful attack on her employer's systems worming its way into our personal business at some point but I'm not sure what we can do other than keep our systems as up-to-date as possible.

A number of South Texas municipalities had their systems frozen up via ransomware attacks recently. These are in no way high monetary value targets so I suspect they were an alpha test case for something yet to come.

 

[Witold Krzyżanowski]

Thanks for sharing.

 

[CAustin]

Thank you for sharing this.

 

[BRICKBURN]

I usually avoid updating when possible because it almost always makes my Del with Windows 8 run like crap. Thanks for the post Sgt.

Just put this on your back.

 

[rinehart0050]

You make a great point on the need to update programs and OS.

A perfect case in point is Baltimore. Many of their city computers are tangled up in a ransomware attack. The attack may have used an exploit that's been public since 2017... and that was patched in 2017. If the city had, at any point over the last two years, conducted even a single update, they would have been protected.

Heres an article with the details:
https://www.google.com/amp/s/fortun...ransowmare-microsoft-windows-eternalblue/amp/

 

[rinehart0050]

Also, thanks to Jerome & Co. For running a safe site here.

I was recently living in Korea and was unable to access the site except via a VPN. While a bit of a hassle for me, it was the website protecting itself and us as users from all the malicious attacks coming from that region of the world.

 

[sgt_zim]

You make a great point on the need to update programs and OS.

A perfect case in point is Baltimore. Many of their city computers are tangled up in a ransomware attack. The attack may have used an exploit that's been public since 2017... and that was patched in 2017. If the city had, at any point over the last two years, conducted even a single update, they would have been protected.

Heres an article with the details:
https://www.google.com/amp/s/fortun...ransowmare-microsoft-windows-eternalblue/amp/

I didn't even have to see the 'eternalblue' in the URI to know what the attack was. Not only was Baltimore not patching, their firewalls were horribly misconfigured to even expose the vulnerability in the first place. Wannacry (the payload that rides on eternalblue) takes advantage of the service used for file sharing within Windows - it's called Server Message Block (SMB for short). SMB should NEVER, EVER be exposed to the internet. There is zero reason to expose Microsoft sharing service across the internet. There are better and more secure-able services to use than SMB which can require real and secure authentication. The FW fix is actually pretty easy - deny any TCP requests to port 445. Their IT department is either incredibly incompetent, or incredibly lazy, or both.

If I were CISO where I work, I'd happily slash our enormous security tool budget in half in order to double or even triple the budget for aggressive patching.

If I had a much lower ethical bar, I'd already be retired with at least 8 figures in various banks around the world. This stuff really isn't hard once you understand some things. If you passed a couple calculus classes in college, you have the gray matter to do this.

 

[sgt_zim]

Thanks Zim!

I was a victim of identity theft / credit card fraud in 1998 and although we were not held liable for any fraudulent charges, it took 9 months and a lot of hassle to get the CC company straightened out on which charges were and were not legitimate (it was eye-opening how financial sector employees assigned such duties were unable to simply perform a financial reconciliation much less comprehend the simplest concepts of Algebra). The fradulent charges were in the neighborhood of $10K 1998 dollars. I hate to think what could happen from a successful hack or phishing (or spear-phishing) attack might cause today.

My wife's smart phone is used for both her employer's business and some of our personal business and she gets a set reimbursement every paycheck from her employer. I worry more about a sucessful attack on her employer's systems worming its way into our personal business at some point but I'm not sure what we can do other than keep our systems as up-to-date as possible.

A number of South Texas municipalities had their systems frozen up via ransomware attacks recently. These are in no way high monetary value targets so I suspect they were an alpha test case for something yet to come.

State, county, and municipal governments mostly have non-existent security.

The digital security for many public water systems would be analogous to a screen door protecting the gold in Ft Knox (if there were actually any gold left at Ft. Knox).

At the risk of sounding like a tin-foil-hat-kook, there's a reason I keep a couple months worth of food and water/water-filtration supplies in my house. I don't know how many of you recall the wide-spread blackout in the mid-Atlantic and northeast in 2003, but that outage was not an accident. I don't know who did it [for certain], but it was done intentionally.

 

[Nyati]

Thanks for the info Sarge, and please do keep us up to date as much as possible

 

[sgt_zim]

I usually avoid updating when possible because it almost always makes my Del with Windows 8 run like crap. Thanks for the post Sgt.

Extended support (bug fixes, security patches, etc) are good through 2023. I'd switch to W10 and a new laptop before then.

Set updates to run and install automatically.

 

[Mr. Zorg]

State, county, and municipal governments mostly have non-existent security.

The digital security for many public water systems would be analogous to a screen door protecting the gold in Ft Knox (if there were actually any gold left at Ft. Knox).

At the risk of sounding like a tin-foil-hat-kook, there's a reason I keep a couple months worth of food and water/water-filtration supplies in my house. I don't know how many of you recall the wide-spread blackout in the mid-Atlantic and northeast in 2003, but that outage was not an accident. I don't know who did it [for certain], but it was done intentionally.

My wife & I were working at what is now the MPC refunery in Canton, OH at the time of that outage. Our residence and that refinery were on the AEP side of the grid and had no upsets. Many other employees were on the Edison (? can't really remember now) side of the grid, as well as the MPC Detroit refinery which was sevrely disrupted, experienced processing equipment damage (one large steam boiler system sticks in my mind) on top of their electrical infrastructure. Out top EE at Canton was sent on loan to the Detroit facility for months to assist them. IIRC there was an inspection of one of the nuclear reactors at Edison's nuclear power plant in Toledo where molten salts had severely corroded one of the nuclear reactor heads (a close near miss - the rate of corrosion would have led to containment failure of the teactor head quickly if it hadn't been inspected and found when it was), leading to unexpected significant generating capacity being off line for an extended period for repairs / modification which certainly didn't help matters.

With all the frenzy on Y2K (I worked in a refinery's electronic control system group at that time), Y2K was a non-event physically but a nightmare of bureaucracy and records formatting consuming many more labor hours than the actual field work. But a short time later, there's this huge regional disruption across multiple states. I certainly didn't buy that event in 2003 was without outside influence.

 

[sestoppelman]

Extended support (bug fixes, security patches, etc) are good through 2023. I'd switch to W10 and a new laptop before then.

Set updates to run and install automatically.

Whats a latptop?

 

[tigris115]

Another tip is to trim the preverbial fat. Look at programs you don't need and uninstall them.