Why installing software updates makes us WannaCry

File 20170515 7005 1kosynyPeople don’t want to be interrupted to update their software.
irin73bal via Shutterstock.com

Elissa Redmiles, University of Maryland

The global ransomware attack called “WannaCry,” which began last week and continues today, could have been avoided, or at least made much less serious, if people (and companies) kept their computer software up to date. The attack’s spread demonstrates how hundreds of thousands of computers in more than 150 countries are running outdated software that leaves them vulnerable. The victims include Britain’s National Health Service, logistics giant FedEx, Spanish telecom powerhouse Telefonica and even the Russian Interior Ministry. The Conversation

The security flaw that allowed the attack to occur was fixed by Microsoft in March. But only people who keep their computers updated were protected. Details of the flaw were revealed to the public in April by the Shadow Brokers, a group of hackers who said they had stolen the information from the U.S. National Security Agency.

Attackers got into computers through that weakness and encrypted users’ data, demanding a ransom from anyone who wanted the data made usable again. But they didn’t win the race to exploit the flaw as much as people and computer companies collectively lost it. Our human tendencies and corporate policies worked against us. Research, including my own, tells us why, and offers some suggestions for how to fix it before the inevitable next attack.

Updating is a pain

All people had to do to stay safe from WannaCry was update their software. But people often don’t, for a number of specific reasons. In 2016, researchers from the University of Edinburgh and Indiana University asked 307 people to discuss their experiences of installing software updates.

Nearly half of them said they had been frustrated updating software; just 21 percent had a positive story to tell. Researchers highlighted the response of one participant who noted that Windows updates are available frequently – always the second Tuesday of every month, and occasionally in between those regular changes. The updates can take a long time. But even short updates can interrupt people’s regular workflow, so that study participant – and doubtless many others – avoids installing updates for “as long as possible.”

Some people may also be concerned that updating software could cause problems with programs they rely on regularly. This is a particular concern for companies with large numbers of computers running specialized software.

Adrienne Porter Felt Tweet

Is it necessary?

It can also be very hard to tell whether a new update is truly necessary. The software that fixed the WannaCry vulnerability came out in a regular second-Tuesday update, which may have made it seem more routine. Research tells us that people ignore repeated security warning messages. Consequently, these monthly updates may be especially easy to ignore.

The companies putting out the updates don’t always help much, either. Of the 18 updates Microsoft released on March 14, including the WannaCry fix, half were rated “critical,” and the rest were labeled “important.” That leaves users with little information they could use to prioritize their own updates. If, for example, it was clear that skipping a particular update would leave users vulnerable to a dangerous ransomware attack, people might agree to interrupt their work to protect themselves.

Even security experts struggle to prioritize. The day the fix was released, Microsoft watcher Chris Goettel suggested prioritizing four of the 18 updates – but not the one fixing WannaCry. Security company Qualys also failed to include that specific update in its list of the most important March updates.

Security pros, and everyone else

https://datawrapper.dwcdn.net/76Jwt

The most common recommendation is to update everything immediately. People just don’t do that, though. A 2015 survey by Google found that more than one-third of security professionals don’t keep their systems current. Only 64 percent of security experts update their software automatically or immediately upon being notified a new version is available. Even fewer – just 38 percent – of regular users do the same.

Another research project analyzed software-update records from 8.4 million computers and found that people with some expertise in computer science tend to update more quickly than nonexperts. But it’s still slow: From the time an update is released, it takes an average of 24 days before half of the computers belonging to software engineers are updated. Regular users took nearly twice as long, with 45 days passing before half of them had completed the same update.

Making updates easier

Experts might be quicker at updating because they understand better the potential vulnerabilities updates might fix. Therefore, they might be more willing to suffer the annoyances of interrupted work and multiple restarts.

Software companies are working on making updates more seamless and less disruptive. Google’s Chrome web browser, for example, installs updates silently and automatically – downloading new information in the background and making the changes when a user quits and then reopens the program. The goal is for the user not to know an update even happened.

That’s not the right choice for all kinds of updates, though. For example, the Windows update needed to protect against the WannaCry attack requires the computer to restart. Users won’t tolerate their computers shutting down and restarting with no warning.

Getting the message out

So computer companies must try to convince us – and we must convince ourselves – that updates are important. My own research focuses on doing just this, by producing and evaluating entertaining and informative videos about computer security.

An entertainment-education video about software updating produced by researchers at the University of Maryland.

In our first experiment evaluating the video, we conducted a month-long study to compare our video with an article of advice from security firm McAfee. The video was effective for more of our participants than the McAfee article was. Our video was also equally or more effective, overall, at improving people’s updating practices. Trying new approaches to teaching security behaviors such as our edutainment video, or even security comics, may be a first step toward helping us stay safer online.

Elissa Redmiles, Ph.D. Student in Computer Science, University of Maryland

This article was originally published on The Conversation. Read the original article.

Why a fractured nation needs to remember King Jr.’s message of love

Martin Luther King Jr.‘s message of love matters today. Tami Chappell/Reuters
Martin Luther King Jr.‘s message of love matters today. Tami Chappell/Reuters

Joshua F.J. Inwood, Pennsylvania State University

The 2016 election campaign was arguably the most divisive in a generation. And even after Donald Trump’s victory, people are struggling to understand what his presidency will mean for the country. This is especially true for many minority groups who were singled out during the election campaign and have since experienced discrimination and threats of violence.

Yet, as geography teaches us, this is not the first time America has faced such a crisis – this divisiveness has a much longer history. I study the civil rights movement and the field of peace geographies. We faced similar crises related to the broader civil rights struggles in the 1960s.

So, what can be draw from the past that is relevant to the present? Specifically, how can we heal a nation that is divided along race, class and political lines?

As outlined by Martin Luther King Jr., the role of love, in engaging individuals and communities in conflict, is crucial today. By recalling King’s vision, I believe, we can have opportunities to build a more inclusive and just community that does not retreat from diversity but draws strength from it.

King’s vision

King spent his public career working towards ending segregation and fighting racial discrimination. For many people the pinnacle of this work occurred in Washington, DC when he delivered his famous “I have a dream speech.”

Less well known and often ignored is his later work on ending poverty and his fight on behalf of poor people. In fact when King was assassinated in Memphis he was in the midst of building towards a national march on Washington DC that would have brought tens of thousands of economically disenfranchised people to advocate for policies that would ameliorate poverty. This effort – known as the “Poor Peoples Campaign” –– aimed to dramatically shift national priorities to the health and welfare of working peoples.

Martin Luther King, Jr. speaking at interfaith civil rights rally, San Francisco Cow Palace, June 30, 1964.
George Conklin, CC BY-NC-ND

Scholars such as Derek Alderman, Paul Kingsbury, and Owen Dwyer have emphasized King’s work on behalf of civil rights in a twenty-first century context. They argue the Civil Rights Movement in general, and King’s work specifically holds lessons for social justice organizing and classroom pedagogy in that it helps students and the broader public see how the struggle for civil rights continues.

These arguments build on sociologist Michael Eric Dyson who also argues we need to reevaluate King’s work as it reveals the possibility to build a 21st Century social movement that can address continued inequality and poverty through direct action and social protest.

Idea of love

King focused on the role of love as key to building healthy communities and the ways in which love can and should be at the center of our social interactions.

King’s final book, Where do we go From Here: Chaos or Community? published in the year before his assassination, provides us with his most expansive vision of an inclusive, diverse and economically equitable US nation. For King, love is a key part of creating communities that work for everyone and not just the few at the expense of the many.

Love was not a mushy or easily dismissed emotion, but was central to the kind of community he envisioned. King made distinctions between three forms of love which are key to the human experience.

The three forms of love are “Eros,” “Philia” and most importantly “Agape.” For King, Eros is a form of love that is most closely associated with desire while Philia is often the love that is experienced between very good friends or family. These visions are different from Agape.

Agape, which was at the center of the movement he was building, was the moral imperative to engage with one’s oppressor in a way that showed the oppressor the ways their actions dehumanize and detract from society. He said,

“In speaking of love we are not referring to some sentimental emotion. It would be nonsense to urge men to love their oppressors in an affectionate sense[…] When we speak of loving those who oppose us we speak of a love which is expressed in the Greek word Agape. Agape means nothing sentimental or affectionate; it means understanding, redeeming goodwill for all [sic] men, an overflowing love which seeks nothing in return. ”

King further defined agape when he argued at the University of California at Berkeley that the concept of agape “stands at the center of the movement we are to carry on in the Southland.” It was a love that demanded that one stand up for oneself and tells those who oppress that what they were doing was wrong.

Why this matters now

In the face of violence directed at minority communities and in a deepening political divisions in the country, King’s words and philosophy are perhaps more critical for us today than at any point in the recent past.

King’s vision can help bring communities together.
Noah Berger/Reuters

As King noted all persons exist in an interrelated community and all are dependent on each other. By connecting love to community, King argued there were opportunities to build a more just and economically sustainable society which respected difference. As he said,

“Agape is a willingness to go to any length to restore community… Therefore if I respond to hate with a reciprocal hate I do nothing but intensify the cleavages of a broken community.”

King outlined a vision in which we are compelled to work towards making our communities inclusive. They reflect the broad values of equality and democracy. Through an engagement with one another as its foundation, agape provides opportunities to work towards common goals.

Building a community today

At a time, when the nation feels so divided, there is a need to bring back King’s vision of agape-fueled community building. That would move us past simply seeing the other side as being wholly motivated by hate. The reality is that economic changes since the Great Recession have wrought tremendous pain and suffering in many quarters of the United States. Many Trump supporters were motivated by a desperate need to change the system.

However, simply dismissing the concerns voiced by many that Trump’s election has empowered racists and misogynists would be wrong as well.

These cleavages that we see will most likely intensify as Donald Trump prepares to take the oath of office as the 45th President of the United States.

To bridge these divisions is to begin a difficult conversation about where we are as a nation and where we want to go. Engaging in a conversation through agape signals a willingness to restore broken communities and to approach difference with an open mind.

It also exposes and rejects those that are using race and racism and fears of the “other” to advance a political agenda that intensifies the divisions in our nation.

The Conversation

Joshua F.J. Inwood, Associate Professor of Geography Senior Research Associate in the Rock Ethics Institute, Pennsylvania State University

This article was originally published on The Conversation. Read the original article.