Update All the Things

Modern AI is being used to find and fix hundreds of critical software bugs. But you can’t benefit from a fix you never install.

Take a look at the image above. Microsoft’s most recent software update included fixes for over 600 vulnerabilities. (Microsoft releases fixes on the second Tuesday of every month, which has become known as Patch Tuesday.) Google’s Chrome recently shipped an update containing 429 security fixes, and Adobe patched 123 vulnerabilities in a single month. Is that because all software suddenly developed horrible quality problems? No. Those bugs were probably lurking there for months or years – but with modern AI tools, the software makers were finally able to find them.

Software companies are finding and fixing vulnerabilities at an unprecedented rate, thanks in large part to AI-assisted code analysis and security tools. That’s fantastic news. What’s even better news is that these same companies are using these tools to find and fix bugs before the software ships in the first place.

What’s Good for the Goose…

Of course, the bad guys are using these same tools to find and exploit bugs. AI is just a tool – it can be used for good and evil. The amount of time between identifying and exploiting a software vulnerability has dropped from months or weeks to days or even hours. We have a term for a bug exploited in existing software by bad guys before a fix is available: a Zero-Day bug. That is, the software maker has zero days notice before it’s exploited. Cybersecurity experts are starting to refer to this as Zero-Hour.

AI tools are also being used to very quickly reverse engineer published fixes. When Microsoft issues a patch for Windows, bad guys can analyze the updated code, see what was changed, and craft exploits that target unpatched systems – all in a matter of hours. But aren’t they too late, at that point? No… because it’s going to take time for everyone to download and install the patched version of the software.

Update Your Software

The upshot here is that for us to benefit from the Herculean effort by software makers to fix all these AI-found bugs, we need to install those fixes before the bad guys can use the same AI tools to reverse engineer the fix and exploit unpatched systems in the wild.

It’s always been important to update your devices’ software, but in this new AI era, the urgency has grown significantly. I would go so far as to say that software updates are the single most important thing you can do right now. You need to make time for this.

Key items to update:

• Home router (ASUS, TP-Link, Netgear).
• Computers (macOS, Windows)
• Smartphones (Apple, Google)
• IoT devices. This is tricky because there are so many. Some devices have a web admin page; others require using a smartphone app from the manufacturer to administer the device. These two sites have general help: FTC, Wired.

While You’re There

While you’re doing this, look for any opportunity to enable automatic software updates. This is an important feature particularly for home routers. If your router doesn’t have this capability, you might want to upgrade for this reason alone. Also, if your router has been EOL’d (end-of-life) and is no longer receiving firmware updates, you should also seriously consider upgrading. Finally, if you’re using a router provided by your internet service provider (ISP), you should consider buying your own router for both security and privacy reasons. You don’t need a super-expensive one. Most people can get by with something in the $100-150 range. I like the GL.iNet Flint routers because they use open source firmware.

If you find that your device is so old that it can no longer run the latest software, or if you can’t find any way to update your device’s firmware, you should either take it off the internet completely or replace it. If you can at least figure out the version of software it’s running, you can search the internet to find out if this version is out of date and/or has known vulnerabilities.

Finally, compromised devices usually perform normally. Bad guys don’t want to draw attention. If you can’t update the firmware, reboot it (unplug the device, wait 15-30 seconds, and plug it back in). That will wipe malware off many IoT devices. However, it will not fix the vulnerability that allowed it to be compromised in the first place. Rebooting your devices periodically is just good hygiene, though.

You Can Leverage AI, Too

The benefits of AI chatbots aren’t just for software makers and cyber-criminals. You can benefit from them, too. You may have heard about “hallucinations” like putting glue on pizza. They still make mistakes, but they’ve improved dramatically over the last couple of years. They contain a massive wealth of useful information and most of the time get it right now. If you have trouble with any of the above, try asking a free AI chatbot for help. I prefer Proton’s private Lumo chatbot or DuckDuckGo’s Duck.ai.

If you haven’t used an AI chatbot recently (or ever), I strongly encourage you to try using them here – even if you think you know what you’re doing, just to see how they explain things and retain context for long back-and-forth conversations. Tell them what the make and model of your router is. Then ask how you figure out what version of software it’s running and how to update it. Ask it how to enable the best privacy and security settings, and ask it to explain how each setting works. Ask it to explain firewalls, NAT, WiFi, UPnP, WPA… whatever you’re curious about. Feel free to add qualifiers like “explain this to me like I know nothing about technology”. Really… try it.

Use AI as a knowledgeable guide, not an unquestionable authority. If something doesn’t match what you see on your device, ask it to help you find the manufacturer’s official instructions.

Collaborate With Me

For those of you who read last week’s article, all of the above tasks qualify for Phase 1 of my 500th podcast project! I want to know how difficult these tasks were so I can improve my instructions for future phases, as well as the next edition of my book.