Slashdot Mirror
The 12-minute Windows Heist
An anonymous reader writes "Sophos has come up with some pretty interesting research: apparently, there's a 50 percent chance unprotected Windows PCs will be compromised within 12 minutes of going online. Sophos came to that conclusion based on research covering the last six months of virus activity. The company said
authors of malware such as spam, viruses, phishing scams and spyware have increased both the volume and sophistication of their assaults, releasing almost 8,000 new viruses in the first half of 2005 and increasingly teaming up in joint ventures to make money. The new-virus figure is up 59 percent on the same period last year."
You know, on second thought, the better idea is just get a Mac. The average PC user will find it safer and they can do 99% of what they were going to do anyways.
Strange women lying in ponds distributing swords is no basis for a system of government.
I'd like to see the actual numbers and the methodology of their study. It seems like all of the compromising attacks require action on the part of the user, like downloading unknown attachments, clicking spam links, and browsing shady porn sites.
I don't see how any of those could be affect turning on your computer and using automatic updates.
There are attacks which don't require your help; Sasser in particular goes through an open port rather than through Outlook or IE. There are a few others.
But that's pretty unlikely with a new PC, which presumably comes with the latest service packs. The article is incredibly short on actual data. There's nothing to support their 12-minute average. I get the impression that they chose the scariest headline to support an article which is mostly about phishing attacks, trojans, etc: attacks that require your help.
So for all I know they're talking about the fact that there are enough attackers that if you throw a Windows ME (or even unpatched XP) box on the Internet, yeah, you're hacked. That says a lot, but not about how insecure Windows is. It says that there are still plenty of computers running hacks like Sasser; if you're not protected against it, you're screwed.
That's mostly scaremongering, since unless you're installing a very out-of-date Windows, you're protected. You're not protected against new attacks, nor are you protected against many trojans. They're trying to convince you to buy software for that, which is relevant, by using scary but irrelevant numbers.
First Kaspersky, now Sophos... I've lost all respect for AV vendors. Using scare tactics to sell software is just sad.
Here's all it takes to keep your Windows box safe: a router (or SP2) and Firefox. Oh, and enough common sense to not run any executable file sent to you by a stranger.
There, I let the secret out.
smattawichu
I hate to be the prick who answers the theoretical question, but clearly the first post. First post was one minute after the article went up, infection is 12 mins. The first poster would have time to get a cup of coffee and return to find his machine hax0red.
I really find it quite ironic that there's so many MS apologists in this discussion willing to say that getting infected is the user's fault for being too stupid to have a commercial A/V package installed (at additional expense) and have a hardware firewall (at additional expense) between their system and the internet.
Yes, I know that AVG is free and very good, and Zone Alarm has a free version (I make sure both are on every MS box I have to look after).
But this ignores at least two problems. First, OEM PCs don't come with AVG or ZA, they come with Norton or Symantec or McAfee and a very short period of free support. Two months after you bring your new PC home and the new NetskyBlaster.z hits your hotmailbox, you're SOL. Why, if MS is so focused on improving security, do MS customers need to rely on 3rd party vendors for A/V security software?
Secondly, the firewall in XP SP2 is certainly an improvement over nothing at all (or over nothing useful, a category to which the the pre-SP2 firewall certainly belongs). So then why do I need to buy a $70 hardware firewall if XP has a firewall already?
Why does ZA tell me about so many more applications that want to reach the internet than the XP firewall? Why the hell does rundll need the internet (let alone Nero, or my printer for that matter), and why doesn't the XP firewall tell me about it?
For a commercial software vendor, MS's security record is beyond dismal. For a company that claims security as a priority, MS's poor performance would be laughable if it weren't so damned expensive and time consuming.
Why is it that Linux vendors can provide fully configurable firewalls that block anything and everything (if that's what you want) out of the box, but MS Windows insists on leaving open ports, enabling ActiveX, and phoning home to download updates whether you want it or not?
Why is it that wierdo hippy-commu-nazi Linux developers understand the difference between user and administrator but MS developers insist on every little widget having complete kernel access?
Why is it that MS thinks security is something to tack on to an OS through SPs, weekly downloads (with requisite reboots), patches, and 3rd party products, rather than something that is built into the code?
Lets talk apples to apples here. When we are talking about viruses/worms coming through open ports on a system running Linux, this is not a fault in *Linux*; this is other various open-source software running.
Its not Linux that has your port 25 open; it's sendmail or exim. Its not Linux that has your port 22 open; its openssh. With Windows *IT IS* the operating system that has those ports open.
It really depends on your distro how secure the system will be out of the box. What software is enabled, what configuration settings that system has.
For example, Redhat ships SSH with default settings to downgrade the connection to v1 if v2 fails. This leaves Redhat open to SSH1 attacks. A system like Debian does not allow SSH1 by default.
Some distributions are secure, some are not. You cant lump them all together. And you cant blame the kernel for the shortcomings of some other open source software. Put blame where blame is deserved.
Secondly, with regard to malware - Linux systems are much less vulnerable simply because we dont surf the web or run our systems as the root or Administrator user. Yes, running as a limited account on Windows accomplishes the same thing, but less people actually do it.
I set up a fresh workstation PC for my mother barely a year ago. New Linux compliant components, a top grade Asus Mobo, Infineon RAM, a nice case, etc. Time was getting short and I in the last moment I decided to screw Linux and install Win2K to avoid the driver setup hassle and have her a more stable DVD playback. (turns out that was pointless, since Win2k had more driver hassle than Linux later on)l ing. Anything else I can't take serious anymore.
The first time it went onto the internet was across a brand new 56 anaog modem. I swear it was less than 15 Minutes when the first addware started to pop up - and we just had gone online for a very short period to test her mail account.
My mother emphasised a clear "No go" and I felt the very same way. I went to the next convienience store, got a copy of Aurox (a european/polish magazine fedora-variant Linux distro) and installed it right away.
I still use Win2K for the occasional task that can only be done with it, but I don't do anything mission critical with it anymore. Since 4 weeks ago my Mom has a Mac Mini (the PC had untracable power issues) and is happier than ever before.
Bottom line:
Mac to get the job done, x86 Debian or Ubuntu Linux for cheap PC workhorses/servers/tinkerboxes/old-hardware-recyc
We suffer more in our imagination than in reality. - Seneca
This is like your 5th time saying this. Methinks you have no damned idea about security, and whoever keeps modding you up needs to get a clue.
Let me help you out. The following things ARE NOT attributes of a computer that is powered on and connected to a network: 100% secure, untouchable, inpenetrable.
You should try reading some sites like securityfocus. I recommend a 2-part article that just came out, Software Firewalls: Made of straw? and part 2.
SWM seeks new sig for a brief fling
Sure, and anyone working retail knows that Winblows has been getting creamed for years, cable or no. This puts a number on that you can use, and the number has gotten smaller.
"But wait," you might plead, "I remember just a few months ago reading about a minimum time to exploit of four minutes. This is twelve, how can things be getting worse and how do you know?"
Well, Sophos knows because they have the thankless and hopless task of "protecting" hundreds of thousands of Winblows computers around the world. They came up with their figure by studying what their little clients fold them for the last six months. With so many clients, it's easy to watch them pop and extrapolate rates of infection, just like you can with radioactive material.
What they have told you is a Winblows computer now has a HALF LIFE of twelve minutes. That's much worse than a four minute minimum because half lives have a way of adding up quickly. In 24 minutes, a given machine has only a 25% chance of not being owned. In 36 minutes, the chances of being "factory new" are down to just 12.5%. After an hour, oh my, you have less than a one in fifty chance of being virus free. Needless to say, after a few hours on line, YOU WILL BE OWNED. This is why even dial up users are suffering quickly.
Notice that Sophos can be off by an order of magnitude and the results will be about the same. If the half life were really 120 minutes instead of 12 minutes, you would still be owned after a few days on line. There's little practical difference to the average user between 10 hours on line and 10 days. It's doubtful they are off by that much, given ammount of data they have available.
Just for fun, try this fun little half life game. It's a little fast and the lables are elements, but you can imagine different Winblows versions getting oowned and spewing out their toxic spam and trojans onto the rest of the world. Radioactivity, cancer and Microsoft, what great analogies. Given real world M$ performance and it's results, the cancer shoe fits much better on Steve Balmer than it does on any GPL'd project.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
My cable modem isn't a modem at all.
Well, since we're on Slashdot, technically, it is a modem. It takes analogue signals and figures out digital data from them. It modulates and demodulates. Your cable modem just don't happen to be NAT'ing. Think of it as one long ethernet cable to your ISP.
In my experience, most cable (as in television land-based cables) modems behave this way, which I find quite pleasant. Any box on your network can be reached from the outside, without funky NAT-routing. In fact, you can probably just keep asking for IP-addresses, and the modem will happily give you true, Internet-routable IP's. Enjoy.
Now, would some people argue, NAT is great for your average Windows user, who probably don't want or need his machine available from the outside. This is the wrong way of solving problems. Any remotely modern operating system should be able to safely stay on the Internet, given a bit of care (read: patching). Furthermore, your average Windows user will often need Internet-routable IP-addresses - think Bittorrent, any P2P, remote desktop and so on.