Retail PCs can reach customers without latest patches

Tom Krazit   Today’s Top Stories    or  Other Security Stories  

Why SaaS is Vital to Email and Web Security Avoiding the Latest Phishing Attacks Safeguarding Critical Data Intercept Spam & Viruses Web Security SaaS: The Next Generation of Web Security Spam Spikes: A Real Risk to Your Business Sign up to receive Security Resource Alerts

June 16, 2004 (IDG News Service) -- The excitement home buyers feel when taking a new PC out of its box can be short-lived if the machine is vulnerable to the swarm of viruses and worms on the Internet.

One senior administrator at a major research university recently endured a prolonged setup procedure with his new laptop. The administrator, who asked not to be identified due to the visibility of his position, purchased a laptop in May after encountering delays in obtaining the notebook, which was first introduced last March along with Intel Corp.'s Centrino technology.

After connecting the notebook to the Internet over a dial-up connection, the machine started crashing repeatedly in a sequence that looked eerily familiar to the administrator's experiences with the Blaster worm last August. Sure enough, a Google search quickly confirmed his diagnosis, setting the stage for a two-hour marathon download of Windows Update patches and the Blaster Worm Removal Tool from Symantec Corp.

Current PC users are constantly reminded about the need to download patches and operating system updates as soon as they are made available. But those users may not realize that a "new" PC might have been sitting in a warehouse for several months, and might lack the most recent patches required to keep it safe from viruses and worms.

To meet delivery deadlines, PCs bound for the retail market must have their operating systems frozen about three to four weeks prior to the date on which they are made available, said Jim Kahler, manager of consumer support for Hewlett-Packard Co.'s consumer PCs. With Microsoft Corp. releasing new security updates almost every month, there's no simple way to ensure that when a PC finally makes it to the user, that PC contains the latest updates required to secure the system, he said.

HP advises all buyers to activate the built-in firewall that comes with Windows XP prior to connecting the machine to the Internet, Kahler said. The next major update to the Windows operating system, Windows XP Service Pack 2, will help improve security by turning on the firewall as the default option on future releases of the operating system.

Toshiba Corp. ships every PC with documentation that urges customers to immediately visit the Windows Update Web site and download and install any software patches that the site identifies as missing on that PC, said Carl Pinto, director of product development.

Most of IBM's PC customers are businesses that have an IT staff member who makes sure each PC contains the necessary updates before passing it along to the user, said Clain Anderson, director of marketing for IBM's wireless and security solutions.

IBM can also set up a system that monitors the patch status of an enterprise's network of PCs, automatically downloading updates as they are provided by Microsoft, Anderson said.

Representatives from Dell Inc. didn't respond to requests for comment. However, Dell doesn't sell its PCs through retail stores, which means it carries only four days of inventory at any one time, according to its financial results presented last month.

The Windows Update feature is only one line of defense against fast-moving worms and viruses. Just about every PC company ships a free trial version of an antivirus product such as Symantec's Norton Antivirus that will help detect viruses and worms.

Besides those two defenses, there's not much the PC industry can do to protect users against worms and viruses other than pleading with them to install Windows Update patches and regularly update their virus definitions, said Stephen Baker, director of industry analysis with NPD Techworld in Reston, Va.

Unlike other electronic devices that consumers are used to owning, such as televisions, PCs require regular maintenance and a willingness to cede control of the update process to a vendor, Baker said.

"You have a lot more responsibility as a PC owner to maintain and take care of your device than you do as a television owner," Baker said.

Virus-infected PCs aren't just problematic for their users. They are often used as spam relays or to launch other virus and worm attacks, making it essential that all PC users patch their systems, Baker said.

The university administrator eventually discovered a guide called "Windows XP: Surviving the first 24 hours" on the interesting-people.org mailing list maintained by Dave Farber of Carnegie Mellon University that would have provided tips such as turning on the firewall and manually checking for updates.

The episode turned out to be nothing more than an evening of aggravation, but it could have been avoided with clearer instructions on how to safely break in a new PC, the administrator said.

Reprinted with permission from

For more news from IDG visit IDG.net
Story copyright 2006 International Data Group. All rights reserved.

Print this Story

Send Us Feedback

E-mail this Story

Digg this Story

Slashdot this Story

"If you're controlling document transmission processes, don't overlook your multifunction printers, advises one vendor...." Read more... "Is it just me or is Twitter suddenly experiencing a much, much heavier spam deluge than usual? And how evil..." Read more... Read more Security posts or See all Blogs

DNS hole prompts synchronized patching effort by IT vendors Microsoft plugs nine holes in Windows, DNS, SQL Symantec warns of new Word attack More top stories...

Microsoft sets XP SP3 automatic download for Thursday Don't give Google a free pass on data collection, privacy advocates say after YouTube ruling XP SP3 to reach most users 'shortly,' says Microsoft

This old laptop: Revitalizing an aging notebook on the cheap All it takes is a couple hours and about $125 to breathe new life into an old laptop. Here's how. Bill Gates moves on Is Microsoft's Golden Age over? What are Gates' most memorable quotes? Find out in Computerworld's complete coverage of the end of the Bill Gates era at Microsoft. Five things you should never tell your boss There are some things your CIO definitely doesn't want to hear. Also don't miss the flipside, Five things you should always tell your boss. Hands-On: Firefox 3 fixes what's broke and keeps what's right With its latest version, Mozilla's browser continues to raise the bar for what Web browsers should be. Windows Vista A to Z Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS. More Continuing Coverage After 9/11: Homeland SecurityAsk a Premier 100 IT LeaderBlackBerry Legal BattleData Security BreachesElectronic VotingFirefoxH-1B VisasHP's Boardroom ScandalHandheld DevicesHurricane Katrina AftermathMicrosoft Legal IssuesMicrosoft's VistaOpen SourceRFID TechnologySCO's Linux FightSarbanes-Oxley ActSpamVoice Over IPWi-FiWindows Meta File VulnerabilityWindows XP Service Pack 3 IT Careers 2010 Four years from now, the IT field will be a vastly different place. Will you be ready? More Special Reports Premier 100 IT Leaders 2007 Best in Class2006 Computerworld Horizon Awards2006 Premier 100 IT Leaders2006 Salary Survey2007 Best Places to Work in IT2007 IT Forecast2007 Premier 100 IT Leaders40 Years of ComputerworldASPs, Take TwoBest Places to Work in IT 2003Best Places to Work in IT 2004Best Places to Work in IT 2005Best Places to Work in IT 2006Business Intelligence Home RunsBusiness Intelligence: Smarter BIBusiness Intelligence: The Future of BICRM Goes VerticalCRM: Sober CRMCareer Planning Guide 2005Careers: IT Profession 2010Computerworld Horizon Awards 2005Data Management: Mining for GemsData Management: Taming Data ChaosDevelopment: Hard-Workin' Web SitesDevelopment: New Tools New ChoicesDevelopment: The New World of Application DevelopmentDevelopment: The Web Services TsunamiDevelopment: Web Services HurdlesDisaster Recovery: Preparing for the WorstE-commerce Grows UpE-mail/Groupware: Big DecisionsFaces of Mobile ITForecast 2006Global MobileHardware: Multiple Cores, Multiple ChallengesHardware: On-Demand Un-HypedHardware: The Shape of Things to ComeHorizon Awards: 10 Cool Cutting Edge TechnologiesIT Management: Guide to Managing VendorsIT Management: Navigating Global ITIT Management: Recovery AheadIT Management: The Future of ITIT Management: The Resourceful Project ManagerInnovative Technology Awards 2004Management: Reinventing ITMicrosoft in TransitionMobile/Wireless Leaders and LaggardsMobile/Wireless: The Untethered WorkerMobile/Wireless: Tiny Gadgets, Huge CostsNetwork Management: Taking ControlNetworking: Turbulence Ahead!Networking: VoIP Goes MainstreamOperating Systems: In the Slow LaneOperating Systems: Linux Goes GlobalOperating Systems: Should You Nix Unix?Outsourcing: Offshore Buyer's GuideOutsourcing: Outsourcing DangersPremier 100 IT Leaders 2004 Best in ClassPremier 100 IT Leaders 2005 Best in ClassROI: Do the Math!Salary Survey 2003Salary Survey 2004Salary Survey 2005Security Action PlanSecurity: Compliance HeadachesSecurity: Proactive SecuritySecurity: Risk and RewardSecurity: Tips From Security ProsSouped-up SecurityStorage: Battling ComplexityStorage: Cheap & Secure Data StoresStorage: Stretching Your Storage DollarsStorage: The Lean Storage MachineStorage: The New Rules of StorageStorage: The Ultimate Backup GuideSupply Chain: Missing LinksSupply Chain: RFID Reality CheckThe Business of SecurityWeb 2.0 SecurityWireless: Wireless At Work All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone See your link here

Why SaaS is Vital to Email and Web Security Why SaaS is Vital to Email and Web Security Download this webcast, free, compilments of Webroot Software Go to the webcast  Computerworld Executive Bulletin: Building a Robust Antivirus Defense Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. (Source: MessageLabs) Antivirus software alone isn't enough to prevent today's speedy, sophisticated virus attacks. Security managers should consider multitiered approaches that include behavior scanning, appliances that check e-mail for worms, and restricting user access to dangerous Web sites. Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs, to learn more. Download this executive briefing  Eliminate SPAM, Gain Productivity Get this white paper now! (Source: MessageLabs) Learn all about the dangers and the costs of spam in all its forms - from stock-touting to spreadsheet. Also, understand the drawbacks of traditional hardware- and software-based defenses - and the unique benefits of MessageLabs multi-layered, managed Anti-Spam solution; as illustrated by a real-world case study where MessageLabs stopped spam cold. Download this white paper  White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. Virtualization Analysis for VMware A Guide to Understanding Messaging Archiving Archiving Compliance with Sunbelt Exchange Archiver View more whitepapers

• DNS hole prompts synchronized patching effort by IT vendors
• Microsoft plugs nine holes in Windows, DNS, SQL
• Symantec warns of new Word attack
• More top stories 

Security Management Zone Security management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones

Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day. New baits

"Security Directions" virtual trade show 2008's Code-Red Security Issues for Protecting the Enterprise Webcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter

In Security Stripping away the trappings of applications, systems and networks, information is the core asset of most organizations. Our columnist describes how asserting the importance of information governance is crucial to making that asset tangible, addressable and protected. Click here to read the latest column by Jon Espenschied