by Paul Thurrott, News Editor,
[email protected]
Last week, the MSBlaster (LovSan) worm rocked the IT world. The worm
took down more than 385,000 Windows-based computers, according to
antivirus vendor Symantec, and forced Microsoft to redirect its
Windows Update Web site to prevent a scheduled August 16 Distributed
Denial of Service (DDoS) attack. Windows & .NET Magazine UPDATE warned
readers about the security vulnerability that paved the way for the
MSBlaster worm in the July 22 issue ("Windows Server 2003 Gets Its
First Major Security Vulnerability,"
http://www.winnetmag.com/windowsserver2003/index.cfm?articleid=39649 ),
and of course our other publications also provided ample warning
that IT administrators should seriously consider applying the patch
that Microsoft first supplied on July 15, 2003. Furthermore, the US
Department of Homeland Security (DHS) twice warned the public that
this security vulnerability could cause problems if users didn't
install the patch; print and TV media around the globe covered this
news.
Despite these and other warnings, the MSBlaster worm, which
launched a month after Microsoft patched the affected vulnerability,
took down computers in companies large and small. Individuals,
including a friend of mine, saw their computers spontaneously reboot
because of this problem, which made downloading the patch impossible.
My friend had plugged in a new computer, navigated to Windows Update
to download all the available critical security updates, and was
infected immediately before the download was able to finish. That's
incredible.
Last week, I wrote a somewhat controversial opinion piece for
WinInfo Daily UPDATE titled "Windows Worm Should Never Have Been a
Problem"
( http://www.wininformant.com/articles/index.cfm?articleid=39849 ), in
which I noted that we expend a lot of energy blasting Microsoft, often
rightfully so, for its security problems. These vulnerabilities have
cost IT administrators countless hours of frustration, testing time,
and downtime, and the flood of updates that these problems necessitate
probably isn't going to end soon. But with the MSBlaster worm, I have
to wonder if we're not taking the blame game a little too far. We'd
been warned adequately that this worm was coming, and I honestly feel
that many people simply weren't being responsible and doing their
jobs: This worm shouldn't have been so disruptive.
In the matter of full disclosure, yes, I live in the proverbial
ivory tower. Yes, the infrastructure I manage is
sub-small-business-small. And yes, it has been years since I worked in
the field, being responsible for production machines at a real
company. Just the same, blaming Microsoft for everything is easy,
isn't it? After all, the company is a convenient target and, not
coincidentally, often at fault. My point isn't that administrators are
solely responsible for the devastating effects of MSBlaster, but
they're part of the problem--a part that could have done more to fix
things proactively. I know your jobs are hard, and I know you're not
appreciated as much as you should be; but as systems administrators,
you're personally responsible for protecting your network, computers,
and users. We can blame Microsoft for not creating a more secure
system, but we must also accept the blame for not working with the
tools we do have to ensure that this worm was contained. This worm was
an embarrassment for both the Windows IT community and Microsoft.