11.5 Updating Software

Last updated
Save as PDF

Page ID: 91541

\( \newcommand{\vecs}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } \) \( \newcommand{\vecd}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash {#1}}} \)\(\newcommand{\id}{\mathrm{id}}\) \( \newcommand{\Span}{\mathrm{span}}\) \( \newcommand{\kernel}{\mathrm{null}\,}\) \( \newcommand{\range}{\mathrm{range}\,}\) \( \newcommand{\RealPart}{\mathrm{Re}}\) \( \newcommand{\ImaginaryPart}{\mathrm{Im}}\) \( \newcommand{\Argument}{\mathrm{Arg}}\) \( \newcommand{\norm}[1]{\| #1 \|}\) \( \newcommand{\inner}[2]{\langle #1, #2 \rangle}\) \( \newcommand{\Span}{\mathrm{span}}\) \(\newcommand{\id}{\mathrm{id}}\) \( \newcommand{\Span}{\mathrm{span}}\) \( \newcommand{\kernel}{\mathrm{null}\,}\) \( \newcommand{\range}{\mathrm{range}\,}\) \( \newcommand{\RealPart}{\mathrm{Re}}\) \( \newcommand{\ImaginaryPart}{\mathrm{Im}}\) \( \newcommand{\Argument}{\mathrm{Arg}}\) \( \newcommand{\norm}[1]{\| #1 \|}\) \( \newcommand{\inner}[2]{\langle #1, #2 \rangle}\) \( \newcommand{\Span}{\mathrm{span}}\)\(\newcommand{\AA}{\unicode[.8,0]{x212B}}\)

Software is constantly evolving. This has always held true; new features are added, bugs are fixed and security vulnerabilities are patched. Today it is quite common for software to update automatically. To wit, major operating systems such as Windows and MacOS will suggest updates but can ultimately force updates. The same holds true for most mobile phones, as well. This was not always the case! Older software did not have the means to auto-update as the infrastructure required includes a network (the Internet in most cases) and one or more servers to host the updated files. The Internet was terribly pervasive at the turn of the century and auto-updating software was only starting to enter the mainstream.

It Is On You!

It is on you, as a user, to be sure that you have everything up to date. This includes firmware for your hardware, operating systems and any installed applications. This can be a heavy lift for anyone involved in IT but even more so for someone who is not an IT expert. Perhaps this is one of the reasons that auto-updating software has become so popular.

WinRAR

WinRar has been one of the most popular archiving programs for nearly 20 years, weighing in at over one billion downloads.

Steve Gibson talks about a vulnerability in WinRAR back in 2019. Mr. Gibson correctly points out that the vulnerability permits attackers both persistence as well as code execution - and refers to the combination as the "the two golden things you want⁴⁴".

Compounding the issue is that there is no auto-update functionality, meaning that only users who actively update their install of WinRAR will receive the security patch.

Security Now! Transcript of Episode #708