Stop pressing "later"
Understand why updates are the cheapest protection you have, set your devices to update themselves, and tell a real update from a fake one that installs malware.
THE RACE
An update starts a race
All software has mistakes, and some of them let an attacker in. When the maker finds one, it ships a fix in an update. Attackers study those fixes to learn exactly what was broken, then look for devices that haven't installed it yet. From the day a fix comes out, every day you wait is a day you're on the list.
Two phones, same model. One updated the week the fix came out. The other is still waiting. The same attack only works on the second one.
Zero-day
A flaw that attackers use before the maker has a fix, so the maker has had "zero days" to respond. Zero-days get the headlines, but they're rare and valuable, so they're usually saved for high-value targets. Everyday attacks on ordinary people mostly use old flaws that already have a fix.
You can't do much about a zero-day. You can do everything about a flaw that was fixed three months ago: install the update.
Check yourself
Babak's phone has shown a system update notice for three weeks. His rule is "if it works, don't touch it". What should he do?
- Wait a few months until friends confirm the update caused no problems
- Back up his photos, then install it tonight on charge
- Install only updates that add features he wants, and skip the others
- Turn off update notices, since the phone clearly works fine without them
Show the answer
Back up his photos, then install it tonight on charge
Right. His phone "working" says nothing about the holes the update closes. A quick backup first makes the rare bad update a small problem.
Set it once, then forget it
- Phone and computer system
In settings, turn on automatic updates and allow them to install overnight.
- Apps
In the store you installed them from, turn on automatic app updates, at least on Wi-Fi.
- Browser
Browsers update themselves but often finish only after a restart. If it says "restart to update", do it.
- Restart now and then
A device that is never restarted can have updates sitting downloaded but not active.
Check yourself
Real update, or a trick to install something?
- Your phone's Settings shows a new system version
- A website pop-up says your phone is infected and offers an "update" file
- Your app store lists an update for your bank's app
- An SMS says "update your bank app from this link"
- A channel in a messenger posts a "new version" of a popular app as a file
- Your browser's own menu says "restart to update"
Show the answer
Real update: Your phone's Settings shows a new system version, Your app store lists an update for your bank's app, Your browser's own menu says "restart to update"
Fake: don't install: A website pop-up says your phone is infected and offers an "update" file, An SMS says "update your bank app from this link", A channel in a messenger posts a "new version" of a popular app as a file
WHERE UPDATES COME FROM
Updates come from inside, never from a pop-up
A real update arrives through your device's settings, the store you installed the app from, or the software's own menu. A website can't scan your phone for viruses or missing updates, and an update link in an SMS is exactly what scammers send. An "update" that reaches you any other way is how a lot of malware gets installed.
Update your bank app the way you installed it: open that store and look. If there's nothing there, there's nothing to update.
END OF SUPPORT
Old devices stop getting fixes
Every phone, tablet and computer gets security updates for a limited number of years, depending on the maker and model. After that, new holes are found and never fixed. The device still turns on and looks fine. You can check the date of the last security update in its settings.
An old tablet with no updates for years is fine for reading recipes or watching videos. It's a bad place to log into your bank or your main email.
Check yourself
Sepideh's tablet had its last security update in 2021. It still runs her banking app smoothly, so for banking it's as safe as a phone that is updated every month.
Show the answer
False
False. Running smoothly and being safe are different things. Every flaw found since 2021 is still open on her tablet. She can keep it for videos and reading, and move banking to a device that still gets updates.
Check yourself
Match each thing to where its real updates come from
Show the answer
- Your phone's system → The system update page in Settings
- An app you installed → The same store you installed it from
- Your web browser → Its own menu, finished by a restart
- Your home router → The firmware section of its admin page
Lesson recap
- Updates close holes attackers already know about; waiting keeps you on their list.
- Turn on automatic updates for your system, apps and browser, and restart when asked.
- Real updates come from settings, the store you used, or the software's own menu. Never from a pop-up or an SMS link.
- Devices that no longer get security updates shouldn't hold your bank or main email.