
Update Down
What’s worse—the security flaw or the patch that fixes it?
Originally posted on Byte.com
January 5, 2004
| "Have you heard about the new security hole in Windows XP?"
I get these sorts of questions all the time. Since I write about computers for a living, people often mistake me for an expert. "Which one?" I responded, hoping to fool the acquaintance who had accosted me at a recent party. "Anyone can get information off your hard drive by sending a simple text message to your IP address: "Tell me everything you know. Signed, Bill Gates." "Oh, that security hole. Well, I'm sure there'll be a patch for it, soon." He gave me a suspicious look. "The patch was released last week." "Of course," I said, hoping to cover up. "That's why I'd forgotten about it." I made a mental note to run Windows Update and get that patch soon. I had long ago turned off automatic updates; it had interrupted a vital and important game of Minesweeper once too often. So the next day I launched Windows Update to see what was available. What I found was 32 critical updates, all pre-selected for downloading and installation. I clicked "Review and install updates" and discovered that 31 of them were exclusive items that must be installed separately. 31 downloads and reboots later, I was ready to install the last critical update—the one that fixes the so-called "Signed, Bill Gates" bug. I downloaded it. I installed it. I rebooted my system. And it worked. There was now no way anyone was going to get anything through that particular security hole. How could they? I had no Internet access. ID on the IPWell, almost none. After much trial and error, I discovered that I could get onto the Internet if I used one particular IP address. Unfortunately, since half a million people were discovering that very moment that they to had to use that exact same address, access was a little difficult. So was uninstalling the patch. I found it listed on Add or Remove Programs, but clicking the Remove button simply yielded an error message: "Did you really think you could remove this patch?" After three days, I managed to get online and try Windows Update again. Luckily, there was a patch to fix problems caused by the Signed Bill Gates Patch. Once again I downloaded, installed, and rebooted. And got error message after error message after error message. Windows eventually came up—with a 640 by 480 resolution. The operating system no longer accepted my graphics card. Heaving a great sigh of annoyance, I found the CD that came with the card and attempted to reinstall the drivers. But the CD drive didn't work, either. Neither did the sound card, USB port, or dishwasher (although that last one was hard to blame on Microsoft). So I once again launched Windows Update. The Ethernet card didn't work, either. I finally succeeded in getting to Windows Update via an old 1200-baud modem. There I downloaded and installed the patch to fix problems caused by the Signed, Bill Gates Patch Patch. When I rebooted, I discovered that Windows had a whole new interface. Maybe not that new. I'd seen it before. That's right! It's called the Blue Screen of Death. I don't know how I got back to Windows Update after that one. I remember a lot of cursing, but not much else. As Private as a BillboardWhatever I did, I was still vulnerable to the "Signed, Bill Gates" security hole. And that meant that I had to download and install the New, Safe Signed Bill Gates Patch, which had none of the flaws of the other ones. Amazingly enough, there were no conflicts and no problems. Everything worked perfectly right until the day that someone sent a simple text message to my IP address that read "Tell me everything you know. Signed, Bill Gates." They got my credit numbers, account statements, and obscene haiku collection. Time to go back to Windows Update and try the New, Safe Signed Bill Gates Patch That Actually Works. Amazingly, this one didn't restrict Internet access to a single IP address. It didn't wipe out my drivers or cause software conflicts. It didn't even let any Signed Bill Gates attacks get through. Oh, I got the occasional error message, but their warnings didn't really bother me. How could they? Windows now displayed all messages in Ancient Babylonian. The New, Safe, Signed Bill Gates Patch That Actually Works Patch got me back to English, but it slowed Windows down horribly. Turns out there was a reason: It kept searching my hard drive for weapons of mass destruction. It didn't find any. The Patch for the New, Safe, Signed Bill Gates Patch That Actually Works Patch rendered Windows unbootable again. But there was a workaround. I discovered through trial and error that I could boot into Windows if I used the name Albus J. Dingledonker and the password *********. But I didn't want to be Albus J. Dingledonker. Besides, Albus J. Dingledonker didn't have access to any of my files. Luckily, Albus J. Dingledonker did have access to Internet Explorer and some Administrator rights (although not the rights to create a new user named Lincoln Spector). That got me to Windows Update. It was another 17 days before I downloaded what I truly hoped would be the last fix, The Patch for the Improved Patch to the New, Safely Patched, Signed Bill Gates Patch of a Patch That We Think Might Actually Work Patch Patch Patch. It reformatted my hard drive just before the computer went up in a small mushroom cloud. I think that solved the problem. |
© Copyright 2004 by Lincoln Spector