Slashdot Mirror
Survival Time for Unpatched Systems Cut by Half
UnderAttack writes "The Internet Storm Center published a graph
showing historic trends for the "Survival Time" of unpatched, unprotected (windows) computers connected to the internet.
Turns out, this number dropped from about 40 minutes last year, to 20 minutes this year.
The survival time is calculated as the average time between reports for an average target IP address. If you are assuming that most of these reports are generated by worms that attempt to propagate, an unpatched system would be infected by such a probe.
The data is collected from a large number of networks with different types of upstream protection. So if you are on an unprotected cable/DSL line, you may see probes much more frequently. Either way, 20 minutes is not long
enough to download patches.
The Honeynet Project did publish a paper
with some stats back in 2001."
Microsoft should make Patch CD ISOs available. You could swing by a friend's house and get one, drop into your local computer store and have them burn you one for a few bucks, or pick up a Microsoft produced copy at your local gas station, like AOL CDs.
That what was all this school was for... to teach us how to solve our own problems. -- janeowit
Install the Windows XP off a CD that includes SP2 slipstreamed in, and your survival time online 'unpatched' goes up dramatically. Something about a reasonably good firewall that is turned on by the default installation...
No, not joking. At work, somewhere, there is an infected computer and while rebuilding a computer I plugged it in to run the updates for 2K and antivirus. Less than a minute after pluging it in, I was crashing and burning.
Had to go to a patched computer, download the needed updates and burn them to CD and update the computer that way first before plugging it onto the network.
REALLY anoying.. and when I find the user with the infected computer.. well, lets say I'll have a new storage location for this dead notebnook hard drive...
...not suprised at all? This isn't intended to be a troll, but back when blaster was "new" and I was formatting, I was hit three times within two minutes of booting, which gave me a whopping 3 minutes to download (not an issue) and install (BIG issue) the corresponding patch.
In the end I had to swap some CD burners around, download+burn the patch, and then unplug the box from the internet while booting.
The name "survival time" suggests that it's the average amount of time an unpatched system would last before being compromised. That assumes that every single worm targets every single unpatched system, and is always successful. That's not exactly realistic - many worms target specific programs which may well not be on the unpatched system, or target specific operating system versions.
It would be much more interesting to see average compromise times for a vanilla install of various different OS versions (with no ISP protection, of course). In the mean time, the name should be changed, in my view.
Microsoft should have an auto-update during install feature. (If you have broadband). During the install process it could run the windows update, blah blah blah once your nic was initialized for the first time and IP granted etc.
I boycott signatures
Put an old red-hat system up and see how long it takes before you're r00t3d!
Or watch an OS-9 system crash!
Best Buy can have you arrested
What do they mean by survival time?
Time before worm infection?
Time before the computer is brought down?
I'm learning python
Seems like cable and DSL modems need auto(ugh - scary)-updating firmware with firewall enabled by default. Stuff that will update without being plugged into a computer. I hate things that don't let you choose. This scenario sounds like you walk into a clinic for innoculations, but deadly disease agents are everywhere in the air. Try holding your breath while waiting...
Busy aligning my non-linear thoughts.
the important thing to note here is that that this ISN'T the time from an announced exploitable hole (and patch), it's the time an exploit actually takes once it starts propagating.
the time it takes for an exploit to be crafted has usually been sufficient to allow sysadmins to patch- 1 to 2 months usually.
doesn't mean it happens, obviously. and the time it takes for an exploit to be created is shrinking, too.
at this point, the clue should be received: firewalls. updates. secure systems.
(and microsoft, please fix your stuff pro-actively.)
stored on computers from birth to the grave
I had a a similar problem (albeit with a home box) under XP. The worst of it is that you can't just download the update installer and unplug the 'net connection because the installer itself does downloading. Since the other two boxes in my house run Gentoo and Redhat I couldn't download the patches from there (Does this look familiar?) and had to just race against time for 5 or 6 attempts before it worked.
They mean "average time between reports for an average target IP address".
Which means they assume all of those are from worms, and all worms are successful, etc.
It's still a bloody short time, though.
Every time I read about computer security compromises resulting from failure to patch/setup firewalls/etc, I can't help but think there's a better way to educate the public than to wait for them to be victims. With all the MS tutorials and "helpers" (stupid paperclip...how I hate you!), it never ceases to surprise me that when you first start up a new MS-based computer, you don't get a security tutorial. Really, how hard would it be to take users through the basics of computer maintenance (and scare them into compliance) when they go to set up a broadband connection, etc?
Live free or die
1. As previously noted (I think on /.) the one thing you do not do with an unpatched WinXP system is to go onto the 'Net. Indeed, ISO's with patches or prepatched install CD's might be a solution but I think that the virus/worm/malware writers can also get these and patch their wares. Given MS's track record it'll be weeks at least before the problem is recognized or solved. It might be better to not take any WinXP system onto an open network.
2. I note that despite increased awareness and MS's increased focus on security the average survival time shows a downward trend, with slight peaks shortly after high profile worm events. How come? Is the average user slacking off? Or are the worms/viruses/trojans/whathaveyou getting smarter? Or are there ever more on the loose, resulting in an ever increasing number of probes? Looking at my firewall, the number of probes I receive remains more or less constant (although I had a few more than usual on port 8000 today) so maybe that is not a good explanation (for the Netherlands at least). Anyone?
----- One learns to itch where one can scratch.
This is why the average broadband connection should be behind at least a consumer router, even if it's the only machine connected. Routers are too cheap and easy to skip.
Microsoft Replies: In light of this new data, we would like to announce a new, more secure operating system. It is based on our Windows ME technology. By simply accelerating the timer for the essential bluescreen feature we feel confident that NO hacker will be able to make use of a corrupted machine.
Further, we are offended by all the FUD spread about our products by the open source community. Our security features include and expanded install size, which severly limits the space available on disk available to anyone who co-opts your computer for use as an illicit server.
Also, the times recorded by this survey are non-relevant and obviously flawed. They claim that their machines were only compromised after more than 15 minutes of CONTINUOUS uptime. This simply does not occur on our new ME+ varient. We cannot accept responsibility for those who remove our essential security features by removing 'buggy' components, or running a 'stable' GUI.
End Sarcasm;
The record shortest survival time, last time I checked, at the University of Alberta is four seconds. That's from the time they plugged in an unprotected Windows XP machine until the time it was compromised.
That's not enough time to engage your software firewall pre-SP2. I'm not sure of the condition post-SP2.
Oceania has always been at war with Eastasia.
Ive personally seen XP machines get infected with Blaster, Sasser, etc, during the install of Windows. These days, if you install Windows with an active connection to the internet, or to a network of infected machines, your nuts.
I generally install Windows with the box disconnected from the network, install all the latest updates of a CD, then attempt to connect to the network. Most of the time, that works...
I do all my machine builds and initial updates with the box sitting behind a netgear router, fully NATted and with no port forwarding - i.e. the box is invisible to the net. I've merrily built and updated many machines in this way and have never been compromised (and my last step is to virus, spyware, and trojan scan with several of each type of tool).
If you just throw a cheap hardware router/NAT/firewall in front of your box when you build, this isn't really big deal I've found.
Please Rate my comment (and help support Fre
Perhaps a "TURN THE GODDAMN FIREWALL ON BEFORE YOU CONNECT TO THE NETWORK!" notice somewhere on the front page would get the point across? I've done exactly two Windows installs in my life and I know how how to safely set up a new XP system.
What I'm listening to now on Pandora...
I work for a Fortune 5 company and we've had to alter our standard load server procedure to go offline and apply some patches because we have estimated that one in six unpatched computers that we work with will get the Sasser worm (that annoying reboot prompted by LSASS).
If this happens in an enterprise environment, I pity all those clueless web users.
Honestly, isn't it obvious by now that if you put a old machine on the net it's going to get exploited? That's the case with Windows and Linux, put a Redhat 5 box up on a cable line and see how long before it's serving up the warez...
I'm guessing here, but time between when machine is first brought online and when it's first discovered/probed/found alive by a worm or hax0r scanners - in other words, time before worm infection or other kind of intrusion, because after it dawns to the world that there's an unpatched system right before their noses, there sure isn't much time left before that system is owned.
How much of that can be attributed to faster technologies ? Greater CPU speed, Connection Speed etc?
Nick...
Electronic Music Made Using Linux http://soundcloud.com/polyp
That's not true at all.
I have a bone-stock winXP system here, and have been running online for almost an hou*(&^@ SD#&7*$^)_*( #$%@#&*() #
NO CARRIER
Breathe in, breathe out. This can be overcome!
1. Unplug your network connection before you install the OS.
2. Install the OS
3. Before you connect to the network, shut down every service you can shut down and make sure they don't start automatically.
4. Connect the computer to the network.
5. Run windows update until you're fully patched
6. Set up the firewall
7. Start enabling any service you might want to run.
This approach will hopefully keep you safe from harm - and it will definitely reduce your exposure!
Stop the brainwash
Did you ever learn anything about computer security? On a machine that you do not want to be compromised, absolutely do not connect it to the network/internet. have all relevant patches available on removeable media - that has been verified authentic - and install sans network.
Then once you are certain that everything is hunky dory, plug it into the network or internet with a firewall (for both incoming and outgoing).
And this isn't an issue with Windows or Linux or FreeBSD for all the fanboys out there. This applies to all OS's. Windows is targeted more because there are more people using it. There are plenty of exploitable vulnerabilities in any OS. It's a matter of work / payoff ratio.
I'd be interested to know the average survival rates for a whole bunch of unpatched operating systems. I'd start with:
- Win95/98/Me
- WinNT4/2K/XP
- Win3.1 (with Trumpet Winsock)
- Mac OS (whatever the first version with a TCP/IP stack)
- Linux (various distros)
ALL unpatched.
Paradoxically, I reckon the newer Windows systems would go first (more services open to the world), along with older Linux distros (same problem).
I recently reinstalled winXP on my 'puter (shame on me) to be able to use the NetMD software. Well, I knew what was going to happen as soon as I plugged the ethernet in. So, as usual, I installed winblows, then McAfee Antivirus 7 + firewall, then plugged the cord to get the updates. 20 seconds later, mcafee stopped functionning. I received tons of windows messages about earning college degrees online, a couple porn ones and whatnot. Ok, so far, nothing (too) surprising. So, I take my courage with both hands, open up IE to go to windows update. BIG mistake. Instead of windows update, I ended up on some obscure casino website with so many popups I thought my system was going to jam. A few hundred clicks later, I finally see the new windows update page. Then, I start downloading the updates, like everybody else does. Of course, in the meanwhile I left a total security black hole open for every hacker in Beijing to try and read the lack of data on my drive. I can understand how some people overcome the integrated winXP firewall. But HOW in the world did they hack McAfee's to stop working? I had to download updates manually, and McAfee, just like windows update, REQUIRES IE, for some obscure non-standard non documented function. So... is M$ the only one at fault here? probably not, though I'm willing to bet it's because of winXP security failures that McAfee was disabled. Sometimes I think of WinXP of a sponge. So many many many holes... And they have to be filled one by one. No wonder winblows will never be secure. But, the reason lots of people use it, as my gf says: sponges are nicer, you don't wanna use a rock unless it's to crack heads. So, moral of the story? It's the opensource world's role to crack the big fat happy M$ head.
---- I am certain of only one thing : I know nothing else.
Figure out what the latest service pack for the OS is, and apply that. That should let you get on long enough to use windows update to scan and get a list of the other KB-patches you need. Disconnect, patch, rescan. Repeat. If you want to learn how to use QChain, it can be faster, but that doesn't work on Win 98/ME.
For the truly paranoid, keep a list of what order you need to apply the patches in. Then wipe and reinstall the OS from scratch, and apply the needed patches in order without connecting to the net first.
However, it's a lot easier to use the Update CDs. It would be nice if there was a reliable torrent of the ISO somewhere....
//Information does not want to be free; it wants to breed.
That's all there is to it, I've installed my fair share of XP machines and never ever had any problems with getting patched before getting pwned.
I am NaN
A few weeks ago, I installed Win2k. I then proceeded to Windows Update and started the patching process.
I went for the big updates first (like Service Packs and IE upgrades) - but most of those require that they be installed alone with no other updates until the machine is rebooted. So you have this long drawn out process of download a single patch, reboot, download another single patch, reboot, download another patch, reboot, repeat ad-nauseaum and finally download all the straglers. I not sure how many reboot cycles I had to go through, but the whole install and patch process (including partitioning and formating) took over an hour. And that was attended.
My point here is that during the patch process with the constant reboots, it would be easy for somebody to walk away from a machine while it is downloading or rebooting and thereby leave it open to attack while it is idling. Of course, you ought to download all the patches on a secure machine and then patch-up you new box while inside your own secure net before exposing the box, but most people (like me) are going to connect direct to the internet to get "windows update". Luckily, I am behind a firewall, but you can easily imagine how ugly it could get if somebody were doing this outside a firewall. The single downloads and constant reboots are not going to help.
We're talking about people who want to install from the absolute latest Windows CD, and they have to take severe steps to avoid getting 0wned.
With the amount of worms and viruses out there, even a clean format/install won't last more than a minute. I put a system up without a firewall and it got pounded by the Sasser Worm immediately. Even with Windows Update auto resume download it took me twelve tries, each time before forced to reboot by the worm, to get just that one small patch installed. After that patch, I patched like crazy, because there's so much more out there.
Guys, you are so lame. All you have to do is to deactivate File and Printer sharing and some other crap, such es described here http://www.cablecom.ch/en/internet/hispeed/hispeed _products_support/support_themen/internet_support_ themen_sicherheit/internet_support_themen_sicherhe it_protect_pc-einstellungen.htm
You can do this with a disconnected network cable. After you do this, the worms propagating through this service (such as Blaster or Sasser, and also future worms exploiting future bugs), won't be able to infect you by network even if you don't have the updates installed.
This only shows how:
- even experienced Windows users are lame when it comes to security
- Microsoft has done very little to protect them (the most exploited service turned on by default without obvious hints to the users that this is dangerous)
- antivirus and firewall companies are lame as well. Installing a firewall while keeping the service running is extra lame, akin to hiring a doorkeeper while there is still a Homer Simpson inside your house shouting lout "I am vulnerable! I am vulnerable!" out of the window.
- Windows isn't suitable for normal home users, because it is non-trivial for them to keep themselves protected.
Usually when I install a fresh copy of Windows I disconnect the ethernet cable before I've at least installed a firewall (if the computer isn't already behind a router/firewall) and done any updates.
The other day I was at my sister's house and installed her a fresh copy of w2k. For some reason I completely forgot to disconnect the network connection and not two minutes after Windows initially started, the machine had become infected with Nimda.
First of all, if you buy a new machine with the OS pre-installed, it will probably be patched almost up to date out of the box.
Second of all, if you're installing your own OS, you're taking on the responsibility to do things in a minimally competent way. That might mean a NAT router, a slipstream installed CD, or just a CD with the service pack burned on it, so you can install it before you plug into the net.
Third of all, you should be using a hardware firewall anyway.
So how exactly does someone like me who is getting ADSL (1mb) in a month and nice new shiney PC to play doom 3 on at the same time handle this?
I can't DL 250 mb patchs on dial up and stay sane and I can't get online without them..
I plan for a router, firewall and all the likes built in and sitting at the connection point but if I have these security holes should I just give up and stick to this fully patch win 98 machine running like a tin can instead?
I like muppets.
Firewall
Firewall
Firewall
XP has a built in firewall, did you know this? When it it turned on, even an unpatched system is protected from attempts at remote intrusion. You are still vulnerable to IE exploits, but if you're using IE on an unpatched system you need to be smacked. Actually if you're using IE at all you deserve to be smacked, just not as hard.
So, the next time you do a clean install of XP and need to download patches, turn on the firewall BEFORE you connect it to the network. Then immediately begin installing patches from windows update. Each time you need to reboot during this process, yank the network cable until the system has finished booting. The reason is that an unpatched and partially-patched Windows system is vulnerable during boot-up. It seems that the windows firewall is one of the last things to be turned on during boot up instead of the first, which creates a window of opportunity for attacks to succeed.
Once the system has installed all of the patches that are available, LEAVE THE FIREWALL ON unless you have a very good reason not to and know what the fsck you are doing.
If you'll follow this simple proceedure, patching your windows system is safe and easy.
I'm sick and tired of reading slashdot headlines that claim there are all kinds of problems patching a windows system. Windows may suck, but that is no excuse for lying about it. Propaganda and FUD are best left to the professionals in Redmond.
Lee
Muslim community leaders warn of backlash from tomorrow morning's terrorist attack.
The bottom of the page says that I must be running windows. None of that browser shit =)
From the SANS inst - a PDF file giving step by step, detailed instructions (suitable for newbies!) on how to setup a brand new, un-patched XP box, connect to the I-net, get it all patched and updated *WITHOU* getting it all FUBAR'd in the process.
Good read and should be a mandatory inclusion with every Smith's Club, Wally-World, Shack de Radio, Dell, HP/Compaq, ET-ware, Gamer's Hack Shack or any other end user PC appliance sold.
http://www.sans.org/rr/papers/index.php?id=1298
SANS server is amazingly slow today - here's an alternate:
http://www.cablemodemhelp.com/xpsurvivalguide.pdf
Senior NCO in the fight against entropy. I've seen things, man. Things no one should have to see.....
Ummm... please tell me you're just a kid playing, and not really a server admin. Pretty, pretty please...
My blog. Good stuff (when I remember to update it). Read it.
... that the high-speed Cable internet installation CD instructs the user to turn off all anti-virus and fire-wall software during installation. Talk about a security flaw! It's like telling somebody to remove all contraceptives before ... you know ... for the first time.
Mathematics is not a crime.
My first recommendation is that you get a router with a hardware firewall--for the price, there's really no reason not to. And any ISP who discourages the use of routers is just plain irresponsible.
If you don't have a router, have the free version of ZoneAlarm handy, and a list of the services you can shut down on Windows (everything you don't need that uses ports or acts as a server.) Shut down these services and install ZoneAlarm before you plug the machine back into the internet. When you do connect to the web, no one will even know you're there.
Between my router, ZoneAlarm, Ad-Aware, and some good anti-virus software, I haven't been touched by anthing out there for 10 years, even when installing and patching.
In my case, when I reinstalled XP about a month ago, my computer was compromised 5 minutes after XP was running. That was not enough time to get SP1 downloaded (over a cable modem). Some mystery process was running that kept popping up dialogs.
To verify: Start -> Control Panel -> Internet and Network
Connections -> Network Connection -> select your network
connection
verify using the same dialog as 'Client for Microsoft
Networks'
same dialog as 'Client for Microsoft Networks'. Select
'Advanced' tab.
Connect Network
Start -> Control Panel -> Windows Update -> Scan for
Updates
PS: If I remember correctly turning on the firewall (Pre SP2) will prevent you from communicating with other computers on your LAN. But you definitely want to turn it on until you get patched or download/buy another firewall.
.::: So basically we now have a sort of 'Internet weather', which tells wether your computer can go play outside or not?
Nice, I can see the evening news getting an extra report then.
"In North America we have some nasty worms raging across the Net spreading all the way to Europe, better close up those ports. Asian PC's may want to wear an extra layer of firewall as we got some heavy probes coming in. South-Afrika meanwhile has some lovely patchy weather."
Is a country-by-country study of this kind. I say that, because I read lots of comments here and on similar sites about all the probes and other unwanted network activity that people see, and yet my machine is usually on every waking moment, and is connected to the net via ADSL, yet I see almost no activity. Once every few days my software firewall (Sygate Personal Firewall) will tell me that a small handful of ports have been scanned. For example, I've actually had the machine on and connected for almost 3 days now, and my firewall is showing no unusual activity.
Now, either I'm just not logging enough (entirely possible), or I'm sat on a very, very quiet part of the net. I have to wonder how much one's country of residence influences this sort of thing, given that I'm in the UK and I'm guessing most people here are in the US.
It's official. Most of you are morons.
I highly recommend building out a machine behind a NAT box, the price for a typical NAT box is no longer a factor and if you're not using one during a Windows OS install, you're an idiot. I highly recommend Autopatcher from http://www.autopatcher.com/
It's free.
They'll soon have versions for W2K and W2K3.
Put this on CD and you're good to go for a large majority of your OS patches. There is also a nice collection of tools and toys included in autopatcher to play with too. Check it out, it's worth your time.
Use autopatcher to install what you are missing and then visit WU to get up to date patches.
It's quicker and safer than the Windows Update download/reboot/download/reboot game when you're most vulnerable.
They even include some nice CD/DVD cover graphics too.
There simply is no excuse for being unpatched when there are solutions like this available, if you are still unpatched, you deserve what you get. No sympathy from me.
there is a little difference here. Most of the stories I read use winXP. You use win98. Granted, it's also insecure as hell until you install a firewall. But I've had the experience of installing a firewall on winXP before plugging in the net, and within 2 minutes, because of winXP flaws that the firewall isn't supposed to "cover up" for, the firewall gets crashed, and it's a wide open box on the web. Which makes life so much more complicated for winXP users compared to win98 ones, like you. I'd go back to 98, but I have hardware that doesn't work with 98 :/
---- I am certain of only one thing : I know nothing else.
Ok, I'll bite.
...... Really, when it comes down to it, why not just recommend Linux? With all the hoops you'd jump through to secure a Windows box"
"It seems as if we've forgotten who the typical Windows user is. No, they won't do any of the things mentioned above,
To be honest, the average user won't be installing an OS from scratch, so it's a moot point, but lets pretend they are. Which is easier?
When windows 98 (that is what we were talking about) has finished installing, install Zone Alarm before you go online.
OR
When Mandrake has finished installing, learn how to use a new OS and a whole new suite of applications?
Go on, answer that and stay fashionable.
I use Linux (Slackware) myself, and I agree it is easy to use, but if you think learning a new OS is easier than double clicking on the Zone Alarm installer, then you are, quite frankly, deluded.
As it happens, my brothers store bought XP system has just died. I'm going to wipe it and install windows 98 this weekend. I did think about recomending Linux. He's a reasonably IT savy chap, I figured I could teach him how to use it. But it's missing his one desperatly needed killer app, Championship Manager, so no go there.
"I realise this is not a very popular opinion but it's the truth, and there for needs to be said" -Bill Hicks
Indeed, the only time I've ever been infected with something is when I was trying to figure out parralel port networking and set C:/ to filesharing (not realising that I was online). Even then, it was easy enough to clean out the intruder with spyware software and manual deletion.
Are Scottish IP's immune to attack? Are my Built In Vunerability Features TM corrupted? Is my system secretly crawling with stuff that is completely undetectable? Have I got a mutant OS that I should reverse engineer and sell for millions?
i think i'll go and update my compu8937589y43{ijjiouli_%jkln;'OPjlkjnken kwjqiohi~~~~ojhkl #"hioehq
If you noticed, I didn't start with the Windows user completely re-installing the OS. Here's a typical after-install security sequence for Windows:
And two months later, you'll repeat the process yet again. It seems you forgot to apply the latest patches while on vacation, and some internet worm has taken over your machine....
Is this really any worse than installing Linux, once?
The society for a thought-free internet welcomes you.