Slashdot Mirror
Survival Time for Unpatched Systems Cut by Half
UnderAttack writes "The Internet Storm Center published a graph
showing historic trends for the "Survival Time" of unpatched, unprotected (windows) computers connected to the internet.
Turns out, this number dropped from about 40 minutes last year, to 20 minutes this year.
The survival time is calculated as the average time between reports for an average target IP address. If you are assuming that most of these reports are generated by worms that attempt to propagate, an unpatched system would be infected by such a probe.
The data is collected from a large number of networks with different types of upstream protection. So if you are on an unprotected cable/DSL line, you may see probes much more frequently. Either way, 20 minutes is not long
enough to download patches.
The Honeynet Project did publish a paper
with some stats back in 2001."
Install the Windows XP off a CD that includes SP2 slipstreamed in, and your survival time online 'unpatched' goes up dramatically. Something about a reasonably good firewall that is turned on by the default installation...
They do. At least in europe retailers are giving out 'Microsoft Windows Security Update CD's. Works on any windows version, but sadly is not quite up to date on XP patches anymore. Next edition is coming soon (called 'Windows XP Service Pack 2 CD') - I fully expect MS to hand out those for free via retailers as well. You can already order one via MS webpage.
err...they do. Free. Not as continuously up to date as it might be, but they do have them.
hmm...or rather, they did.
This is why the average broadband connection should be behind at least a consumer router, even if it's the only machine connected. Routers are too cheap and easy to skip.
chances are you will get infected before the install is finished then
:
the trick is easy tho
1) unplug network
2) install xp
3) install firewall or activate build-in FW
4) plug and config network
5) patch the system
there 5 easy steps for a "safe" install
42
Did you ever learn anything about computer security? On a machine that you do not want to be compromised, absolutely do not connect it to the network/internet. have all relevant patches available on removeable media - that has been verified authentic - and install sans network.
Then once you are certain that everything is hunky dory, plug it into the network or internet with a firewall (for both incoming and outgoing).
And this isn't an issue with Windows or Linux or FreeBSD for all the fanboys out there. This applies to all OS's. Windows is targeted more because there are more people using it. There are plenty of exploitable vulnerabilities in any OS. It's a matter of work / payoff ratio.
Read the bottom of that page...
" If you prefer to use a different Web browser, updates to Windows may be downloaded from the Microsoft Download Center."
With a link within the text "Microsoft Download Center." I'm guessing you can at least get some necessary patches from there (SP's, some critical patches) before letting your machine full-bore on the 'net without a firewall.
I know there are some home users out there that still aren't natting or using some sort of stateful firewall, but come on - you have 2 linux boxes there and can't get a nat to work? Hell, I'll buy you a linksys, they're getting darn cheap after rebates nowadays.
Karnal
Figure out what the latest service pack for the OS is, and apply that. That should let you get on long enough to use windows update to scan and get a list of the other KB-patches you need. Disconnect, patch, rescan. Repeat. If you want to learn how to use QChain, it can be faster, but that doesn't work on Win 98/ME.
For the truly paranoid, keep a list of what order you need to apply the patches in. Then wipe and reinstall the OS from scratch, and apply the needed patches in order without connecting to the net first.
However, it's a lot easier to use the Update CDs. It would be nice if there was a reliable torrent of the ISO somewhere....
//Information does not want to be free; it wants to breed.
My first recommendation is that you get a router with a hardware firewall--for the price, there's really no reason not to. And any ISP who discourages the use of routers is just plain irresponsible.
If you don't have a router, have the free version of ZoneAlarm handy, and a list of the services you can shut down on Windows (everything you don't need that uses ports or acts as a server.) Shut down these services and install ZoneAlarm before you plug the machine back into the internet. When you do connect to the web, no one will even know you're there.
Between my router, ZoneAlarm, Ad-Aware, and some good anti-virus software, I haven't been touched by anthing out there for 10 years, even when installing and patching.
Also, it's trivial to download a better firewall on another computer, smack it onto USB drive/CD and install that. Unlike downloading all the patches, which is not trivial at all.
im in ur
To verify: Start -> Control Panel -> Internet and Network
Connections -> Network Connection -> select your network
connection
verify using the same dialog as 'Client for Microsoft
Networks'
same dialog as 'Client for Microsoft Networks'. Select
'Advanced' tab.
Connect Network
Start -> Control Panel -> Windows Update -> Scan for
Updates
PS: If I remember correctly turning on the firewall (Pre SP2) will prevent you from communicating with other computers on your LAN. But you definitely want to turn it on until you get patched or download/buy another firewall.