Slashdot Mirror
Stop Christmas-Gift PCs From Feeding Worms
An Anonymous Reader writes "If you recently set up a new PC with Windows XP,
or if you had the pleasure to do a 'reinstall from scratch,' you probably found that many XP systems as they are shipped today are not patched against common issues like Blaster. Given that these worms are still going strong, it doesn't take long for a new system to be infected. In particular, if you have to connect it to the Internet to download all the patches.
Well, help is in sight. The SANS Institute released a paper entitled Windows XP: Surviving the First Day." (Read on below.) Update: 12/24 17:59 GMT by T : Thanks for reader Bill Curnow for the updated link. Update: 12/24 19:15 GMT by T : Besides the workaround suggested below, Roblimo has a good suggestion on avoiding the first-day-of-Windows altogether.
"With many screen shots, it will walk you through the procedure to enable the XP firewall and downloading the patches without getting infected while doing so. This could be the (free) stocking stuffer that may save Christmas for your folks ;-). Given that its probably to late now to start downloading your favorite Linux distro."
But if you do have the time and bandwidth, and you're stuck on Windows, a nice live-CD distro like Knoppix or Mepis means you can download patches without racing the worms, and install your patches while offline. (And if you have time to download 50MB, you have time to grab Damn Small Linux.)
Check those links, people.
Click Start > Network and Dial up connections
Right click on your internet connection, choose "Properties"
Click "Advanced"
Click the box to turn on the firewall
Voila. You are safe from Blaster.
As an added precaution, deselect "Client for Microsoft Networks" from all interfaces except any you really need it on.
Our Server: Surviving the Slashdotting
Sig (appended to the end of comments you post, 120 chars)
Try this instead.
http://www.sans.org/rr/papers/index.php?id=1298
There's been a lot of "Slashdot posts ever anti-Windows article that exists", but this article debunks that.
I usually recommend a hardware firewall, in particular the little blue Linksys firewalls. Home users can hook up their ADSL connection, plug in the firewall, and then their PC. Then as long as they don't download email until their system is patched and anti-virus is updated, they're relatively safe from most malware.
This year I've also begun recommending anti-spyware as well. It's amazing how ubiquitous that stuff's become over the past year.
Ruby on Rails Screencast
I figure if you're reading this on slashdot you don't need screenshots to find your way around a monitor...
Obviously, this should be done before you plug the machine into any kind of internet connection.
-Go to Start and then Control Panel.
-Once in Control Panel, choose Network Connections
-Right click on your connection of choice (if there's more than one, do it for all of them) and choose Properties.
-Go to the advanced tab and check the Firewall check box.
If you want to know more about how to configure it and modify the settings, click the link below that checkbox for directions.
-
Click Start > Network and Dial up connections Right click on your internet connection, choose "DISABLE" Voila! The proper config for any Windows Box!
I had just plugged my joystick into the USB port when it started wildly moving in my hand! Worms infected it I swear!
It's a classic catch-22 when you need to download the patches, but the act of downloading them makes you vulnerable ... I have just bought my parents a new PC (with XP, they're not up to Linux just yet ...) and I never thought twice about doing the windows-update thing... OTOH, they are behind a decent firewall (that does run Linux :-) so the risk is pretty minimal.
:-)
Perhaps all these DSL/WiFi combo boxes will be a blessing in disguise because they all come with a firewall (on by default, with Cisco's Linksys ones
Simon
Physicists get Hadrons!
Some might argue that WinXP comes with the Best Before date already expired, but there's a lot of CDs for many OSs out there with "open security". (The main problem with standard XP is the stupid requirement to phone home to register before downloading the patches to make it safe to be on the net in the first place.)
One line blog. I hear that they're called Twitters now.
People should return non-patched systems that are shipped from the manufacturer, and return systems where the install CDs don't put them to the same patch level they are shipped with.
while this isn't a cure-all solution to the patch mania that is necessary, but will go a long way to help bring up the baseline security of all these end-user hosts on the internet.
Try first ten minutes.
Due to some oddities in the purchasing orders for new hardware this year, it ended up that some of us unix guys were tasked with hauling new windows boxes around the workplace for people. We weren't expected to set them up, just unpack, plug em in, and turn em on. Ignorant of how vulnerable windows boxen are, we did just that, doing the silly clicky crap that any OEM relase makes you do, and walked off.
Within ten minutes, the traffic sniffers the security team has up were getting alarms caused by the machines we had set up and their ports got blackholed in about 15 minutes. One of the machines was already being used as a spam relay, the rest all had whatever viruses are still floating around.
Was quite an eye opener, I'd thought those viruses were over and done with and weren't a cause for concern anymore. Made me wonder how much bandwidth is being wasted that we don't even acknowledge. Spam is easy because it generates email.. but there's this underlying background noise sucking up bandwidth that you don't even see.
Course us "unix guys" had a good laugh over it, patting ourselves on the back in true bigot fashion over how secure unices are. But later that afternoon the nfs server that serves our home directories puked it's guts up so it put us in our place pretty quick.
My systems are behind a Hardware Proxy and a software firewall. I feel safe and have not been compromised... yet.
Those poor home users who are not technically savvy are pretty screwed. They won't be able to figure out *nix and don't want to pay the bucks for Apple.
Microsoft should offer (no not MSN) a method for new Windows machines to dial direct for patches before connecting to the Internet.
This method should be over ridable for the safer crowd.
www.thejulingtoncreekplantaion.com
click start -> shutdown
Gyrate Dot Org - "Where high-tech meets low-life"
We received a couple of new machines from Dell last week. They were missing just a few patches... actually a few *months* worth of patches. Inexcusable on the vendor's part- how hard is it for them to keep their base install/image up to date??? I had a CD ready to go with the relevant patches etc. & got all of the critical stuff installed before ever connecting to the internet. No wonder that so many home machines are unpatched, people incorrectly (but justifiably) assume that the new PC they just purchased will be reasonablt current as far as security patches goes. That and getting the plethora of XP patches, service packs etc. over a dial-up is very nearly impossible...
No, the proper technique is called a "reach around". You reach around behind the box, unplug the network cable or phone line (I caught a worm over dialup once, that was the most hilarious thing ever), and consider yourself lucky.
Or you can just do what I did & get your Mom an iMac....
Jaysyn
There is a war going on for your mind.
I believe that we should start trying to make Linux CDs available for checkout at the local public library.
No enough people have the broadband or fast enough download capabilities to handle file sets that above a few megabytes.
Having the inexpensive CD-R sets available for checkout at the local public library would go a long way to solving the distribution problem of the general public.
Plus the local Linux group could keep the circulating distributions current and the latest patches available.
I think that there was a discussion about this on Slashdot recently, but I don't recall.
Odds are, your parents never will be. The only way you'll get the majority of the population to linux is to bring linux down to them.
c'mon, we live in a society where people can't figure out how to set the time on a VCR. You think they're going to take the time to 'learn' an OS? Most people are happy with a 4 year old system that lets them check their e-mail, save the pictures people send them, view web pages, and maybe word processing and a spreadsheet.
Now, to keep this from being completely off topic -- you're probably doing more harm than good by putting them behind a home brew firewall, unless you're going to be keeping it updated for them. I'd recommend for general consumer use sticking with ZoneAlarm, along with AdAware and some virus protection software, and maybe some anti-spam service.
Build it, and they will come^Hplain.
I recentally had to install xp from scratch (because my roomate downloaded some virus). After I get xp running again, and get all my programs installed again. I went and bought Nortin Anti-Virus. After the first scan a few hours after I re-insalled everything I already had the blaster worm and some other type of worm! I guess that is what I get for not installing the patches the moment I install xp...
Steve B and Bill G install a new Windows PC, without any help, or special privileges, or special help lines.
Now, that is what I call a reality show.
I do DSL tech support for a large telco with a three letter name starting with "S" and ending with "C" and I have to bite my lip every time these poor, dumb people call in connecting their brand new Dells and Compaqs to the DSL with no firewall and not a clue as to what Windows Update is and why they need it. The reason I bite my lip is that Windows Update and firewalls are outside my scope of support and I was already told by my team lead not to waste time helping people with that stuff. Even worse, offical training tells us to leave the Windows firewall off when configuring a PPPoE connection - I am not making that up!
It's sad and irresponsible to let these people wander onto the Internet with their unprotected Windows computers like dogs wandering onto the freeway.
It took me five tries to get the PDF, so here is a mirror if anyone needs it.
xpsurvivalguide.pdf
A friend of my Dad gave him XP Pro as a gift a month ago. He installed it then connected to the net. It took 4 minutes until he was hit by blaster.
He finally had to resort to getting the guy that gave him XP to make a CD up of the patches so he could actually use XP on the net.
Personally I just have to say thanks to my linux firewall.
Most worms are either email, script faults or RPC/fileshare.
So don't read email, visit non-update sites or open your ports below say 1000 to the outside world.
Wow I'm a fucking genius. Since most homes have multiple computers anyways you will want a cheapo 100$ router anyways.
Praise me!
Someday, I'll have a real sig.
Your ISP shouldnt have to filter out random ports because someone somewhere wrote some crap software which is now easily explotaible over those ports . .
The fault is all the users who didnt patch there systems
I dont know about you but when my ISP starts port filtering I get pissed off , that my decision to make not theres (stupid monkies blocked of port 20 through 25 . I had to run ssh on a different port!)
I finally had to give in and purchase a new computer with xp. 2 things that frustrated me right off the bat was the fact that this new computer was way behind on patches, secondly...just how big the patches were I had to download. Even though I'm on highspeed dsl it still took a good 15-20 minutes to download and install all critical updates.
:)
I can just imagine how inexperienced people getting new computers for Christmas will feel, especially on dial up connections. When your excited about a new machine, who wants to spend the first couple of hours just trying to secure the machine before you can even browse to your first website?!
Vendors should be forced to ensure that any computers they sell are already up to date. While we're at it, Microsoft should be forced to ensure that there products aren't so insecure before sales either
Computers don't get viruses, users do.
Yawn.
When installing any operating system, you need to be protected before you open your machine to the depravatoins of the internet.
Although Windows users incur a higher risk due to the ubiquity of the product. all operating systems are vulnerable to oen degree or another.
Personally, I am unable to install Windows and download the updates without being infected with at least one virus. When I need to install Windows, the first thing I do is to disconnect the machine from the internet. After the install, I set up my internet connection, enable the Windows firewall, and reboot. Then I download the minimim number of updates needed to install the current version of the Norton antivirus/firewall product. Then I disable the Windows firewall and install Norton.
The first widespread Linux virus will do damage to the OS' reputation beyond any reasomable limits. Consumer Linux distributions should disable all servers and activate a simple firewall by default. Give the user the option to turn it , not on.
-- Slashdot: When Public Access TV Says "No"
Compare that to a godawful dialup VNC session on a home shopping network XP box where I needed to fix blaster and the person didn't know how to get to system settings.
I sold a mac that day with "Guess what, buy a mac and you will never have to deal with this again."
(and I won't either, to myself) That's why it is the best Christmas present you can give yourself, if you are the designated "computer-guy". Not having to deal with other people's XP is worth its weight in Half-Life Gold, Al Franken, and Myth II: Soulblighter.
I'll probably be marked as a troll for this, but Roblimo is just wrong wrong wrong.
Roblimo has a good suggestion on avoiding the first-day-of-Windows altogether.[link to article]
Right, until his daughter/granny buys a webcam from the store and wants to hook it up and use it, etc. Or she wants to use x program that only runs on Windows. Grannies and relatives buy lots of this stuff off shelves at the store. The Sims, nearly another other quality game on the planet? Probably isn't going to run on Linux, is it?
She does websites for pay... what happens when she decides she needs something like Dreamweaver, or Frontpage (gag, but a lot of people still use it) or Photoshop, in those rare cases when the (superior, IMHO) The Gimp won't fulfill her needs?
Sure, you could use VMWare or some other such deal, but then you'll require a copy of Windows and you'll have spent more time and money than if you had just put Windows on the machine in the first place.
What a load of narrow-minded horseshit, Roblimo. Your job as a self-appointed Linux advocate should be telling it to the people straight, and you aren't. They'll listen to you and get burned, and won't trust you or any other Linux person, next time.
I'm glad to hear that the user on linux.com is happy with her copy of Mandrake, but I can't help but think that a Mac would be much, much better so long as a given person can afford it (remember, you don't need a dual G5, just an eMac or iBook).
The reason would be the support network for when you do need support. Not everyone is or can afford to drop by, and saying "go check Ars Technica" isn't really helpful. IF they ever need professional support, it would be better to have actual phone and store support for the product.
Not to mention that you can actually expect to find common peripherals which will work out of the box, or at least have company-supported drivers that you can install.
Not everyone can justify the cost when you can get a new Linux box for half the price, but I wouldn't want someone spending extra on tech support (or downtime) just to save some money on the initial purchase.
I understand wanting to advocate alternatives at all times, but come on now Rob.
There is no way in HELL that I'd consider giving a linux machine to a friend or relative who is light on technical ability.
I am already on call to fix the computers of my friends and family, my girlfriend, my girlfriend's best friend, my girlfriend's sister, and my girfriend's sister's girlfriend.
I'd easily double the amount of free support that I've have to give if I gave someone a linux machine. Even if most of the calls ended up being "No, I can't help you install 'Barbie goes to the beach' because the version that you have is for Windows", that is still crap that I don't want to deal with.
I'd rather burn a disk with Ad Aware and Spybot Search & Destroy and give it to people than to have to educate people on a system that they know nothing about.
So many people these days don't know a thing about DOS, so how can you expect them to take the time to learn bash? More times than I would like to remember, I had to use the console to fix a problem on one of my linux machines that just couldn't be done through X. Sometimes the problem was that I couldn't launch X.
Windows is the devil that most people know. As awful as the security is, as awful as Microsoft's business practices are, Windows is the top dog and most mundanes don't care about anything but being able to check the weather, get email, bring up a few web pages, and play some games. For most people, that is easier to do with Windows.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
No, the proper technique is called a "reach around". You reach around behind the box, unplug the network cable or phone line (I caught a worm over dialup once, that was the most hilarious thing ever), and consider yourself lucky.
;)
So what you're saying is, when your getting screwed by Microsoft, and they don't have the common courtesy to give you a reach around; I should go ahead and give myself one?
Seems like a great idea to me! Thanks
--
if the author of that guide seriously thinks that only enabling TCP/IP and activating microsoft's crappy internet connection firewall is going to protect your computer from malicious packets after connecting to the network, he's got another thing coming.
sure, that methodology is easy and at the very least will help, but it certainly wont ensure security.
at the very least he could say that if you have a good hardware or software firewall that you should install that before connecting to the network.
still, the safest way is to simply take use a secured machine (i.e. linux) to download the MS patches and burn them to a CD, then install them from the CD.
my 2 cents.
01100111 01100101 01110100 00100000 01101111 01110101 01110100 00100000 01101101 01101111 01110010 01100101 00101110
you won't get any spyware or data-mining cookies sneaked onto your computer
What, you're saying that not a single Linux web browser supports cookies? A "data-mining" cookie is just a cookie to track you as you browse the web - one set by an advertising site such as doubleclick. They work just as well whatever OS you're running.
6. Use your new shiny computer as you're pleased
Well, y'see, it pleases me to run games like Dungeon Siege, Postal 2, Warcraft 3, and a whole host of others that don't have native Linux versions (don't mention Wine, please). It also pleases me to write code in C# (again, forget mono, it's not nearly there yet). Until Linux provides me the means to do these things, it'll always be my secondary OS, Windows will be my primary, and "advice" to secure my PC by wiping Windows and installing Linux will be treated with the contempt that it deserves.
However, none of those bugs/holes will expose your PC to worms such as Blaster
You are of course aware that the first internet-borne worm utilised a buffer overflow in sendmail to infect computers? Don't go getting over-confident - true, I can't think of any Linux-targetting worms at the moment, but it's been done before, and it will be done again.
It's official. Most of you are morons.
"...Mods - mod as troll all you want. I am not trolling, though - these are the facts. Windows really sucks..."
Why do people make statements such as this? We all know that mods can be biased, the system is imperfect, and karma really doesn't matter. What does matter is having the ability to state one's opinions/beliefs and being able to defend them.
(tig)
Ignorance and prejudice and fear
Walk hand in hand
Well, the only way to ensure not being marked as a troll is to tell the mods to go ahead and mark them as troll.
Stop the Slashdot effect! Don't read the articles!
is called "TCP/IP port filtering". I have encountered this experience personally, on my dorm network. When I reinstalled WinXP, I didn't even have time to download SP1 before a virus made its way onto my computer and the IS dept shut off my port. However, I've found that if I leave my network cord unpliugged (card disabled, etc) until I have setup my TCP/IP filtering settings to allow only port 80, I can then download the necessary patches, update, and remove the filter. No problems yet!
The power of Christ compiles you.
A Random Blog
I recently upgraded a friends PC from ME to XP Home. She purchased XP, which came with a sticker proclaiming that it included SP1a.
Since this was a recent purchase and the after thought SP1a sticker was there, I mistakenly assumed that it would be safe against Blaster.
Regardless, I enabled the built in firewall on the external interface NIC before I connected to the internet via her ADSL.
I couldn't get it going. I was using the ISP PPPoE driver which was supposed to work, but the ISP suggested I use the built in XP PPPoE driver, which worked fine. The phone tech also said that I must disable any firewall due to the use of a heartbeat initiated at their end.
So, I reluctantly did...
Her PC had Blaster literally within a minute or two of connecting.
But here comes the funny part... to get around the 60 seconds to shutdown, I double clicked the time to set the year back to give me a chance to remove the virus and patch her system. Unfortunately, during this, I had to reboot. At this stage the 30 day registration period was still in effect because I had not registered. Upon reboot, the 30 day period was up, XP was demanding I register now without giving me the desktop! Luckily it seems that it automatically connected.
Next time I'll just set it back an hour!
This kind of crap just has not happened to me on my Apple. In the end, I enabled the firewall and she has not had a problem. It might not have happened if I knew XP better (first install), but then I gave up on Microsoft long ago.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?