Dan’s laptop has been asking for a restart to update for a week. He keeps clicking “Later” because he has lots of tabs open. What’s the risk?

The hole the update closes is already public and being used against those who haven’t updated. Until the patch is installed, Dan is exposed to exactly what every attacker already knows about. The browser restores tabs after a restart.

Dan has an old phone that no longer gets updates. What’s the safest way to use it?

As a music player or alarm clock, with no bank, exchange or wallets. With no updates, every hole found in it stays open forever. So nothing valuable should live on it.

Which attacks are the most common?

Through known holes whose patches are already out. Zero-days are expensive and saved for big targets. Mass attacks hit those who never installed a long-available patch.

Updates: the boring superpower

Lesson 7 of 16 in the course “Cybersecurity from Scratch”. Free, with animations and a quiz.

The “Remind me tomorrow” button

On 14 March 2017 Microsoft released a Windows patch. On 12 May the WannaCry ransomware swept the world: it encrypted files and demanded a ransom in bitcoin. More than 200,000 computers in 150 countries were hit, including UK hospitals. The virus used the very hole that the March patch had closed. Whoever clicked “Update” instead of “Remind me tomorrow” was fine. Later the US and UK governments blamed North Korea.

Not just individuals

Companies step on the same rake. In 2017 the credit bureau Equifax lost the personal data of 147 million people. The bug in their web server software had been fixed by an update back in March. It wasn’t installed, and the breach began in May. Most attacks use not new secret vulnerabilities but old known ones whose patches came out long ago.

Why an update is protection

A brand-new unknown hole, called a zero-day vulnerability, is very expensive and saved for big targets. But as soon as the vendor ships a patch, the hole’s description becomes public, and it starts being used en masse against everyone who hasn’t updated. Every “later” is an open window that every attacker already knows about.

What to update

Your phone and laptop OS: turn on automatic updates and restart when asked. Your browser: you open the whole internet through it, keep it fresh. Bank, exchange and messenger apps. Your router: check its settings every couple of months. And importantly: if a phone or laptop no longer gets security updates, don’t keep your bank, exchange or wallets on it.

Check yourself

Dan’s laptop has been asking for a restart to update for a week. He keeps clicking “Later” because he has lots of tabs open. What’s the risk?
Correct answer: The hole the update closes is already public and being used against those who haven’t updated. Until the patch is installed, Dan is exposed to exactly what every attacker already knows about. The browser restores tabs after a restart.
Dan has an old phone that no longer gets updates. What’s the safest way to use it?
Correct answer: As a music player or alarm clock, with no bank, exchange or wallets. With no updates, every hole found in it stays open forever. So nothing valuable should live on it.
Which attacks are the most common?
Correct answer: Through known holes whose patches are already out. Zero-days are expensive and saved for big targets. Mass attacks hit those who never installed a long-available patch.

← Email and phone number: the master keys Your phone: lock, theft and apps →