Microsoft periodically sends out OS updates. XP machines (and I assume Win7 and 8 as well) are able to detect when MSFT wants to contact a computer to apply updates (I assume this is via the update module (? WUAU????) loaded at start-up).
My Dell XP-SP3 machine is able to detect these updates even when it is in stand-by mode, i.e. "active", but with the HD shut off.
if MSFT is able to contact and update machines automatically, doesn't that mean that a clever hacker could do something similar?
If not, why not?
You have it backwards. Microsoft is not contacting your machine. Your machine is configured to periodically check the Windows Update site for updates, and if any are found, to update your machine.
So a hacker cannot use Windows Update to hack into your machine.
My Dell XP-SP3 machine is able to detect these updates even when it is in stand-by mode, i.e. "active", but with the HD shut off.
No its not. It may seem that way, but that is not happening. It only takes a couple seconds to check to see if updates are available. So it may appear the updates are happening when the system is in standby, but they aren't - or your system is not really in standby mode.
Don't be embarrassed. You are talking about security. I think you demonstrated wisdom by being concerned enough to ask questions about something you were unsure of!
Of course, I should add you still need to make sure YOU (the user and always the weakest link in security) keep your system patched and updated, protected behind a good (and updated) anti-malware solution and decent firewall, AND you avoid risky behavior like illegal filesharing via torrents and P2P sites to ensure your system is not otherwise compromised, and commandeered by a badguy.
