Nobody Is Checking Whether Your Software Needs Updating — So Craig Wrote the Software

Craig explains how attacks used to work, because the change is the story. A flaw gets found. The bad guys write code aimed at that one specific hole — say, a version of Microsoft Excel. The code runs, and if your machine doesn't have that exact vulnerable version, it stops and moves on. That took six months to a year to build, and that year was your slack.

What's different now is that the attack doesn't target one hole. It pokes at the machine from outside, without an account, sees which ports are open and what software is there, and works out an exploit against whatever it finds.

Which lands on the part most people get wrong. Ask anyone about patching and they'll tell you it's turned on. What that means is Windows patches most of Microsoft's own software — not all of it, and nothing else. The dozens of other programs on the machine are untouched. Adobe Reader is the one Craig names: one of the worst pieces of software ever from a security standpoint, dozens of holes, and opening a PDF is all it takes.

So he wrote the tool himself, because nobody else is examining everything on your computer to see what needs updating. His stronger claim: software makers that ship known-bad code without auto-updating should be liable, because the average person was never going to keep up with this.

Also in this segment:

• Federal agencies must now patch a zero-day within one to three weeks — a standard no household or small business meets
• CMMC, the cybersecurity standard for federal contractors, and the move to relieve Department of War vendors of it
• The 220 million voter records taken, and what that means in states where it includes your Social Security number

Free newsletter and Insider Sessions: CraigPeterson.com