Keeping Your System Secure with Windows Update in C#

Painting UPC-A Supplement 2 in C# Keeping Your System Secure with Windows Update

10

Microsoft Update Catalog (http://www.vista-io.com/1018) is a website that offers stand-alone installable versions of each update for Windows. Microsoft Update Catalog offers updates for all currently supported versions of Windows, which means you can also use this service to find updates for computers on your network that are not running Windows Vista. You can search for updates based on operating system, language, date posted, content, and type of update. After you find the updates of interest, download them once and store them in a shared network folder, where they can be installed from any computer. Administrators of large networks can use Windows Server Update Services (WSUS) to manage and deploy updates throughout an organization. The WSUS

server, which runs on a computer running Windows Server 2003 or Windows Server Longhorn, manages downloading updates from Microsoft; computers on the network then obtain updates from the WSUS server instead directly from Microsoft s update servers. For details about WSUS, visit http://www.vista-io.com/1017.

A virus is a computer program that replicates by attaching itself to another object. Viruses can infect program files, documents (in the form of macro viruses), or low-level disk and file-system structures such as the boot sector and partition table. Viruses can run when an infected program file runs; they can also reside in memory and infect files as the user opens, saves, or creates the files. A worm is a stand-alone program that replicates by copying itself from one computer to another, usually over a network or through e-mail attachments. The distinction between viruses and worms can be blurry, and for practical purposes, is unimportant. Historically, the most common source of widespread computer virus outbreaks is the class of hostile software that replicates by sending itself to other potential victims as an attachment to an e-mail message. The accompanying message often uses social engineering techniques designed to lure inattentive or gullible users into opening the infected attachment. Several variants of the Mydoom virus, which spread like wildfire throughout 2004, arrived as attachments that mimicked delivery failure reports from an e-mail server administrator. The attachment, in .zip format, ostensibly included details of the failed message but actually contained the virus payload.

These days, most mail servers reject all incoming messages with executable files attached; even if the server doesn t stop such messages, modern e-mail clients make it difficult or impossible to run executable attachments . That simple measure completely stops most viruses written before 2003 . To work around the blockade, attachment-based viruses now typically send their payloads using the standard .zip format for compressed files . If the user opens the attachment, the contents of the compressed file appear in Windows Explorer or in the third-party utility assigned to handle .zip files . Double-clicking the executable file within the compressed archive sets the virus in motion . Virus writers use a variety of tricks with .zip files . In some cases, they include a bogus extension in the file name and then append a large number of spaces before the real file name extension, so that the actual file type doesn t appear in the window that displays archived files . Some viruses even encrypt the .zip attachment and include the password as part of the message . That allows the infected attachment to slip past some virus scanners . Most real-time scanners will detect a virus in a .zip file, either when it arrives or when the user tries to extract the file . The moral Be wary of all attachments, even when they appear to be innocent .

10

10

Although viruses that spread through e-mail attachments have been to blame for the majority of attacks in recent years, some security experts believe that other modes of transmission represent a far greater threat and will become more prevalent in the future. By their nature, attachments (as well as files transferred with an instant messenger program, a more recent attack vector) require some cooperation from an unwitting or distracted user; that requirement dramatically limits their potential to spread unchecked. As a result, authors of hostile software are always on the lookout for techniques they can use to spread infections automatically. One popular mechanism is the use of scripts, written in languages such as JavaScript, JScript, or Microsoft Visual Basic Scripting Edition (often abbreviated as VBScript or VBS), that automatically take actions on the intended victim s computer when he or she visits a webpage or views an HTML-formatted e-mail message. Protected Mode in Internet Explorer is one defense against this type of intrusion.

For details about Protected Mode and other defensive measures in Internet Explorer, see 27, Advanced Internet Explorer Security and Administration .

Viruses and worms are not necessarily, by their very nature, dangerous. Most are, however why else would a programmer need to resort to such sneaky techniques and you don t want them on your computer. Besides replicating itself, a virus can be programmed to do just about anything that the current user account is allowed to do, such as erase files, make registry changes, and send information over the internet. An important layer in a basic PC protection strategy, therefore, is to use up-to-date antivirus software. Windows Vista does not include any antivirus software, but it s readily available from Microsoft and many other vendors.