Slashdot Mirror
Windows Infected in 12 Minutes
Uber-Review writes "The speed with which PC's can become infected has now shortened. If your Windows computer is not properly protected,it will take 12 minutes before it becomes infected, according to London-based security company, Sophos. They have detected 7,944 new viruses in the first half of 2005, a 59% increase over the same time span last year."
And Slashdot can apparently be infected with a dupe in as little as 5 days!!!!
Don't mod me, bro'!!!!
Not to mention the original article was a lot better, and not a link to yet another news aggregrator that in turn links to another site: http://www.globetechnology.com/servlet/story/RTGAM .20050704.gtvirusjul4/BNStory/Technology/
Will wank off Linus Torvalds for fame.
Honestly, who cares anymore? We've all seen this exact same story with some slightly different words or numbers in about 100 different places. Use a firewall or don't use windows, I get it. Let's get on with our lives plz.
No, this time it was another windows machine that was infected in 12 minutes. Expect to see 200 million similar stories in the next week or so.
I'm waiting for a dupe in 12 minutes, now that would be good! :D
So there are variants and minor changes... do we really count these as new viruses?
ogg
Black cat, searing pain, flames...? I must be in Heaven! - Homer Simpson
The Internet Storm Center is tracking a similar number for while. See the "survival time". It has actually improved over the last few months!
---- join dshield.org Distributed Intrusion Detec
Speed doesn't shorten, kids; perhaps the OP meant "increased?"
"Windows infected in 12 minutes."
there is a new virus that causes the same news story to be posted twice
Hey. I saw this episode on Star Trek. The same thing kept happening over and over again until Data finally kept the ship from blowing up. /. Now we need to repeat all of our original posts, while sending a message with tachyon beams back to our original selves...
That's what's happening on
Blog's Up!
12 minutes hey. Gee I thought IE opened up quicker than that.
Sophos telling us that we really need them, and providing some subjective numbers to make their case...
I know Windows PCs get infected quite easily, but do we really have to:
1. repeat this statement every few days?
2. quote numbers from an organisation which is served well by making this look as bad as possible and present it as fact?
For years I have run Windows straight out of the box (no firewall, no security software, nothing), and I've only ran into two viruses -- one through Kazaa, and one through IRC (both my fault).
I can understand that Windows is vulnerable -- but if I've managed to run Windows for many years without any major problems, then I'm curious what they are doing during these 12 minutes to arrive to such a conclusion.
For he today that sheds his blood with me shall be my brother.
London-based? They're based in Abingdon, Oxfordshire, England. Does English now automatically mean London-based or what?
+Pete
Score:-1, Funny
I'm curious how many times this (and similar) stories will have to be posted on tech journals before Microsoft addresses the problem. In any other business, their customer base would shrink to nothing - imagine a model of car that was consistantly stolen due to shoddy lock manufacturing.
Viva Firefox, and viva the GoogleOS
Single? Canadian? We can help. Visit http://www.l
This has to be about the 10th time i have seen the whole "Windows can be compramised in [insert time here]" deal.
Anyone who actively follows the news and comments on slashot should know by now that windows is open to attack. And secondly i would hope that anyone who has the least bit of common sense would realise the viruses exist and that if you dont take neccisarry precations such as patching your version of windows.
Let me make it staight.
Windows has security issues, it gets viruses, and other malware. Get over it. Get onto doing something about it. stop scareing thepublic and educate people on ways of being protected.
I'm tired of talking about tech fixes to Slashdot's dup plague. It would stop if the editors would just read the damn front page.
--
make install -not war
But the funniest thing about the link is the one and only comment on there that says "Crappy article, but this girl will warm you up inside" and then gives a link to something that would probably lead you to the very exploit it is talking about.
Just leave your computer open and live on the internet without a firewall. I guarantee you that in less than 30 minutes, you will porbbaly catch something.
It's even faster if you have a static I.P.
I know, i was testing some vpn inside my company and i hooked the laptop to my external hub and it took about 20 minutes to get a worm, and i wasnt doing anything and my win2k was fully patched.
Do the editors of Slashdot actually read the site regularly? If not, should they be posting articles to the front page?
Followup question: Isn't this common sense?
My Windows blue screens in nine minutes, so I'm safe.
The global economy is a great thing until you feel it locally.
A herd of buffalo can only move as fast as the slowest buffalo. And when the herd is hunted, it is the slowest and weakest ones at the back that are killed first. This natural selection is good for the herd as a whole, because the general speed and health of the whole group keeps improving by the regular killing of the weakest members. In much the same way, the Internet is only as good as the slowest Windows members. Excessive going online, as we know, gets Windows machines pwn3d. But naturally, it attacks the slowest and weakest Windows machines first. In this way, continuously going online eliminates the weaker Windows machines, making the Internet a faster and more efficient place.
Shameless parody of the 'beer is good for you' joke
Free XBox, PS2
At least it's stable. It's exactly the same amount of time as the last time slashdot mentioned this.
Here's a solution.
*dodges flying tomatos*
OK, OK, here's a patch.
*runs*
Beware: In C++, your friends can see your privates!
Never-Review writes "The speed with which /. editors can become infected has now shortened. If your /. editors are not properly protected, it will take 12 minutes before a story becomes duped, according to world-based geek crowd Slashdotters. They have detected 7,944 new dupes in the first half of this year, a 59% increase over the same time span last year."
(Okay, so we're not quite there yet. But with Moore's law...)
--
--
Terrorists can't threaten a country's freedom and democracy. Only lawmakers and voters can do that.
Zone Alarm has a free version.
The laws of probability forbid it!
pot. kettle. black.
That is why you unplug the computer while you install Windows and security programs. Have that stuff burned to CD or on a back up hard drive. You really don't want to be online right after a fresh install of Windows. I don't have my computer online until I have installed service pack 2, Anti-Virus, and Spybot.
No, no it isn't. Not even in the slightest.
Have you done extensive tests on a range of IP addresses, or are you just extrapolating based on a single result?
Seven! Seven's the key!
You can get robbed in a little as three minutes in Downtown Detroit if you walk around counting large stacks of cash.
The internet is not a nice place. Evolve or die.
There are some people that if they don't know, you can't tell 'em.
So apparantly people start an email client _on average_ within 12 minutes after an install and catch a virus? That is pretty rough, and IMHO unrealistic. I don't know what most people do, but I'm usually still install drivers, turning off teletubby mode etc.
Sounds like the vendors included a few old worms that snatch chronically unpatched systems, and gave it a spin to boost antivirus sales.
If your Windows computer is not properly protected,it will take 12 minutes before it becomes infected,
/.'ers can get infected. The only time they have dirty sex is if they don't wash their hands.
Well that's faster than most
Get a cheap Linksys router from CompUSA.
When MS_Blaster was at its peak I had computers that were infected before the install finished if I left it connected to the internet.
Abindgdon is to the West of London and a good way away - being in a different county (Oxfordshire unsuprisingly).
Ripping an new rectum in the fabric of spacetime.
I seem to recall some cases of software firewalls (if this is what you meant) which don't initiate before the NIC driver comes online, meaning the PC has a few seconds where it can acquire an IP and receive packets before protection commences.
Good design practice should prevent this but it'll never be quite as good as a hardware f/wall. Decent FW devices can be found for very cheap prices now.
If you really can't run a hardware firewall due to a need for many open incoming posrt, the 2nd-best solution is to use a modem with routing ability and direct ports 445, 593 and 135-139 to a dead address (remember to send them to an address outside the router's DHCP range so that address can never be assigned to an unprotected machine). These ports represent Windows file/print sharing, RPC Endpoint mapper (a major exploit target) and RPC comms ports. Killing those 5 ports stops 80-90% of remote attacks, although if you are running a web server, but not actually serving remote users, block ports 80 and 8080 as well to kill frontpage server extensions overflow attacks.
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
but you don't see anybody supid enough to claim something made there as coming "from the suburbs" of London.
Actually to maintain proper parallelism, it should be the island of Formosa with Oxfordshire.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
I'm getting ready to install Fedora Core 4 on my laptop, and I can't find a driver for my wireless card yet. I was thinking about plugging straight into the cable modem, since I don't have an extra ethernet cable at the moment. Will I be okay, or should I just buy an extra cable and keep using the hardware firewall?
There's no way linux can beat windows speed record now!
Hmm I dunno which one is funnier . .
In Soviet Russia Slashdot dupes you
or
In Soviet Russia Windows infects you
wait . . that second one. . . excellent, its funny because its true, and not only in Soviet Russia
If you pay your taxes you support terrorism!
This would be cool if the hunting actually culled the herd but it does not. The infested members of the herd continue ramble on like... zombies. In so doing they are able to impact the rest of the herd and slow it down rather than speed it up.
An Ebola type strain of computer virus might actually be a public good. It would kill off these flu ridden beasts, put them out of their misery and prevent them from continuing to harm the rest of the herd.
Ra's al Ghul anyone?
A Pirate and a Puritan look the same on a balance sheet.
Nope, it leads to a picture of some insecure girl with big tatters looking to validate her life through the intarweb.
(Kind of like what I do here, but without the boobs)
Like install Linux on Lego or something?
Each minor variation means that the old anti-virus signatures won't catch it.
So new signatures have to be downloaded.
The problem is that any error in that and you're vulnerable to these "new" viruses/trojans/worms.
The real problem is that the infection routes on Windows still haven't been closed.
If you're running a router then just enable NAT and bingo - a simple firewall. I always deploy ethernet ADSL modems now for many reasons - but this is the main advantage.
...)
1. Go to new site
2. Plug PC into modem
3. Configure modem
4. Plug phone line into modem
5. Download latest windows patches
Note that at stage 5 the PC is already protected by a firewall. Just need to AV and patches to protect against email, adware etc.
But then I also configure Thunderbird - which limits the email viruses as well (the number of times I've been called becuase a user can't open an email containing a virus
By "Windows" they mean Windows XP pre-service pack 1 which was released in 2001.
So, what they're saying is: "if your unpatched 4 year old operating system is connected to the internet, it'll get infected pretty quickly."
Granted, pre-sp2 versions of XP has security that wasn't exactly the greatest and, granted, post-sp2 it still isn't perfect (and I'm not defending that) - but the above statement is like saying "if your vanilla install of Redhat 7.2 is connected to the internet, it'll get infected in a couple of hours".
The latter isn't fair to Redhat and so I don't see why it's particulary fair to Microsoft either.
Avantslash - View Slashdot cleanly on your mobile phone.
just a matter of time until Microsoft posts a technical report on how it takes 6 minutes for a Linux box to be infected. blah...
two words
XP SP2
and if you don't have:
install XP, then switch on the damn firewall before you plug in the bloody ethernet cable
Screw you all! I'm off to the pub
But what I want to know is how do these machines get infected???
It is certainly easy to get infected while using e-mail or surfing. But now that SP2 comes with a firewall turned on by default, shouldn't it now be impossible to infect a SP2 machine without some sort of user intervention?
Does the SP2 firewall have some holes pre-poked in it already? Are there flaws in the firewall?
"-1 Troll" is the apparently the same as "-1 I disagree with you."
The problem may also be the websites themselves, If I can't put my browsers internet security slider on High and expect not to miss content, Sholdn't we also be blaming the technologies used by those sites ?
Anyone blaming the scripting or active content methods used?
Seem to me that the PC is only half the
problem !
How can a firewall or anything effectively stop what we must allow through to see content ?
Many people just lower the security bar to allow the missing content
What about technologies that pass though firewalls
including web content over http ?
What about buffer overflows that add bad stuff ?
How can any firewall or antivirus stop these?
When the content is allowed staring in?
When they are allowed through ?
I guess when they manage to speed up the Windows boot cycle it'll be even quicker, at the moment the rate of infection is probably held back by Windows 9x finding new (phantom) devices that require drivers, and Windows 2000 doing safe restarts after it loses track of it's own registry.
Win XP is quite a bit faster, so it obviously helps
How long before Minix gets owned?
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
that the editors of slashdot don't even read their own website
i'm a casual reader, and the dupes jump out glaringly at me just from reading the titles of articles
you would think then that an editor would have a little more exposure than me to the content coming into and out of slashdot, no?
hey editors: you have meta-moderation, how about meta-editting?
from your logs, identify readers who have read the website daily for a few months, and just as you randomly nab people for meta-moderation, randomly nab this pool of readers to review a story before it is published for dupes
leave the story in a holding area for a few hours, and if 5-10 of these regular readers look at it and don't have any dupe complaints, send it to the front page
because you have serious problem with all of these dupes
you need a solution
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
German admits creating Sasser
These infections are mostly direct host-to-host infections by Sasser, right?
Beware: In C++, your friends can see your privates!
These guys don't know what they're talki... [NO CARRIER]
Right.
WinXP boots to the desktop quickly, allowing the luser to screw himself more quickly.
Oh, wait, I forgot - XP SHOWS the desktop quickly, but you still have to wait up to a minute for anything else to happen as Windows fumbles around in the background trying to find the rest of the system - including the DSL connection.
God knows what the security state is as XP stumbles around back there dragging in useless services and pumping out thousands of log entries that no customer actually ever asked for. Fortunately, since nothing can be done until it finishes, it probably means nothing can be done TO it as well.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
1) Start
2) Post dupe.
3) ???
4) Profit!!!
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Yeah, but what does it run?
Oh, well, if there's no software for it, I suppose it can't get owned due to flaws in that software.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Yeah, and the guy you linked to tries to teach correct English usage while making errors like "Trying to pretend [...] that a blurb from a random jackass which claims to be an authority [...] is nothing but a way to delude one's self [...]"
How ironic.
--
--
Terrorists can't threaten a country's freedom and democracy. Only lawmakers and voters can do that.
No but your more likely to get attacked if you always have the same ip, and this single result backs up this article.
I'm pretty sure i'm not the only one who has gotten a virus in less than 30 minutes without a firewall.
What's even funnier is that the article is basicly saying that if you put an unprotected Windows box online, that within 12 minutes it's got problems. I want to know who is putting an unprotected Windows box online? All the Windows boxes that are sold today have the latest updates already installed on them, and I must say, Microsoft has stepped up it's game a bit. Days of Windows bashing should be near-end.
...but back to Windows.
Sophos are quoting 12 mins, the ISC currently cite 32 mins "survival time". Does *anyone* see anything near these times though? If I connect a Windows box to the net and monitor firewall logs then it's normally a couple of minutes before someone's probing where they shouldn't be. I reckon I'd be very lucky to last 12..
Comment removed based on user account deletion
The speed with which PC's can become infected has now shortened.
Of course it's faster now than before! What did you expect? Considering how much Microsoft has invested in improvements, of course it's become more efficient!
--
Terrorists can't threaten a country's freedom and democracy. Only lawmakers and voters can do that.
The thing is, to take them seriously, we need better evidence than we have. If it was an independent organisation, then we could reasonably assume that they had a reliable testing mechanism. Sophos are far from independent. They need to present better evidence, especially if they're going to be as specific as 12 minutes.
Anecdotal evidence does not make their result any more reliable. I can find dozens of people who will provide an example of just about anything happening. It doesn't make it any more likely. You may just have been unlucky. A single sample is by no means representative, especially a sample that is self selecting. All the people who didn't get a virus in less than 30 minutes would not bother to respond to my comment.
Is it possible that a computer will be infected in 30 minutes? Clearly it is. Will that happen to all computers? Perhaps. Is the average 12 minutes? We don't know. The only evidence is from a company that makes no mention of their methodology, and has a definite reason to be biased. It has as much validity as a Microsoft sponsored report on Windows cost of ownership vs. Linux. Nobody would believe that, so why believe Sophos?
While I'm sure their numbers are pretty much correct, it's worth noting that Sophos sells a network anti-virus product and that may be coloring their findings.
Only fair to mention it, just like it's fair when some company says Windows NT has a lower TCO than Linux...and the funding for the study came from Microsoft.
Weaselmancer
rediculous.
This is as wonderfull as the Zombie Dog story last week. No facts, no information about the PC, connection, patch history, viruses, etc. Just some random number and some advertising.
Big suprise, the world most popular OS has the largest number of virus's written for it. Another big suprise, leave your machine unpatched and unprotected on a network and it'll get infected.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
I want to know what was the methodology used? Was this just a box plugged into the net without a firewall? Were they connecting to web sites (if so what ones?) Where they checking mail (what client, was the email address new)? Etc
It would be very easy to build up a system and get it infected though use, but there is no real information to tell us how real world it is, just to scare us (or make us happy we use a different OS).
What do you know I wrote a novel
Putting London in the right country is probible a good as it is going to get in the US. Why do you think the New Mexico license plate have "USA" on them?
Moore's law has proved accurate for three decades, so we can reliably predict that if Windows gets infected in twelve minutes today, in December next year it'll be six minutes, in June 2008 three minutes, and so on. By 2017 Windows will get infected in just 50 milliseconds.
Terrorists can't threaten a country's freedom and democracy. Only lawmakers and voters can do that.
I never said it can't be done. But it's not feasible for me to buy a computer with two double-width PCMCIA ports *plus* carry that computer around with me everywhere, just so I can access the Internet via Verizon's BroadbandAccess service. For a modem this is slightly more feasible, but for wireless Internet we're talking about spending hundreds of dollars on a firewall which would still be rather bulky to carry around everywhere.
. . .maybe Microsoft should just ship their OS pre-infected.
As the family's official computer nerd, I'm called upon to fix all the infested and/or dead boxes. I've rebuilt my sister-in-law's box several times now due to spyware and virus infections. This last weekend I said "screw it" and refused to fix her stupid Windows ME box, and said it was scrap unless I could install XP SP2 and give her the windows firewall. (Before the Linux/Mac fanbois descend upon me like a horde, she uses some weird Windows software for work on this box, and I'm not Mr. WINE.) I've given my nice gnucleus, I've talked to her about downloading kazaa I don't know how many times, but still she downloads it, and still she screws the box over big-time.
So, evolution happened. ME is gone, and now she has XP SP2 with every defensive program I could find loaded up on it, along with a lock down of every incoming port. Firefox has replaced IE, and Spybot S&D has "innoculated" it against 4000+ pieces of spyware.
I give her a month :-(
John
For stories that subscribers can see from "The Mysterious Future", but a button that can be clicked on the story title if the poster thinks the story is a dupe. I realize that each Slashdot author doesn't read every story that is posted, but enough other people would notice that dupes could get caught before they make the main page.
beware the jabberwock, my son! the jaws that bite, the claws that catch!
If you do, you'll also remember that they actually count.
-=-=-=-=
I know life isn't fair, but why can't it ever be un-fair in MY favor!?
Comment removed based on user account deletion
Well, it isn't installing Linux on Legos, per se, but it using Legos on Linux. http://www.tldp.org/HOWTO/Lego/intro.html
The views expressed are mine own and do not express the views of my employer.
Taco, read your own fucking site much?
-b
myselfmusic
32 bit extensions & graphical shell for a 16 bit patch to an 8 bit operating system, originally coded for a 4 bit microprocessor by a 2 bit company that can't stand 1 bit of competition.
There are two main things wrong with that assertion.
1) Software firewalls are the crappiest kind of protection you could have. Even the best software firewall will never be as good as the cheapest standalone unit, merely because it is integrated into the host system and therefore intrinsically shares the host's faults/vulnerabilities, whatever they may be.
2) I have seen and heard reports of major SP2 malfunctions...like losing all ability to communicate using http and ftp, or not being able to read non-DNS'ed web adresses (entering IP adress instead of name results in no connection), or just flat-out refusing to burn data CDs, no matter the program. Since SP2 can't be uninstalled, this turns these minor problems into major problems requiring a system reinstall without SP2. And if you're unlucky enough to own a new copy of XP with SP2 integrated, then you're totally screwed.
SP2 may be the worst software release from Redmond since they dropped that big steaming turd that was WinME. If all the claims of Windows' new-found security and stability rest entirely on SP2...
Let's just say I'm not planning to move back to Windows anytime soon.
"Why don't you interface with my ass...by biting it!" -Bender B. Rodriguez
>>The first rule of PATRIOT act is do not talk about PATRIOT act
>Has it occurred to you that your sig is lying? There's no provision in the PATRIOT act that says you can't talk about it. You're just adding to the incoherent ramblings of the Left, which nobody listens to. There are plenty of real problems with the PATRIOT act, but your sig does nothing to address them. It's actually hurting by further making its opposition look like idiots.
Oh wise AC, verily, my slashdot sig is not doing enough to change society's problems. For that, I apologize profusely.
$8.95/mo web hosting
Will a NATing router protect you sufficiently to download patches once you've turned off File & Print Sharing?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
I did a fresh install of Windows not too long ago for one of my relatives. They happen to use Earthlink DSL. The new install was infected in less than 3 minutes of going on line. So I think the time depends on who you use as an ISP.
Specks
Batteries not included
Remembers me the joke of the two guys in the jungle who see a lion.
The first one start immediately tying is shoes, preparing himself to make the run of is life.
The second one say: "What the hell are you doing, do you really think you can run faster than the lion?"
The first guy answer: "I am not planning to run faster than the lion but faster than you!"
Yahh, hiii haaaaa! -Major Kong, from Dr. Strangelove
You're an irresponsible prat, and you're on an ISP that blocks the RPC ports and TCP 445. (Some do this now to protect their network from people like you)
For christs sake at least install zonealarm so you can find out whats on your PC and talking to the outside world
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
All the Windows boxes that are sold today have the latest updates already installed on them,
Not everyone buys a new computer every time a critical patch is released. Some people use their old install disks when they have to reinstall and they probably don't even realise that they have been compromised until after they have re-downloaded their favourite virus software.
I'll probably be modded down for this...
If I can beat Super Mario Bros. 3 in less time than it takes to have my unprotected machine infected, then my machine isn't being infected fast enough.
The 11 minute barrier is still alive!
That's a good idea. The next virus I write will use that Orrin Hatch feature that destroys your computer if you have mp3s.
SIGSEGV caught, terminating
wait... not that kind of sig.
And 'boxen' and 'VAXen' are not the plural forms of 'box' and 'VAX'. And so on.
Using those variants does not make anyone look less intelligent. I am not saying that they are not less intelligent, but it is not the spelling of this or that plural that allows you to tell an idiot from a non-idiot.
On the other hand, the ability to recognize usage patterns for words, of variations in forms, of overgeneralization of `rules' of the language, of changes in the role words play (from verbs to nouns, from nouns to adjectives, and so on), of `incorrect' uses of derivation rules for words, of appropriation of jargon from other groups for various purposes, and other thousand ways a speaker of a language can mess around with his/her language, and the ability of recognizing the intent and meaning of such messing around *does* give very good hints as to the intelligence of a person.
> i hooked the laptop to my external hub and it took about 20 minutes to get a worm
Oh, the irony.
Hook a floundering OS to the network and you catch a worm.
At Microsoft, the early worm catches you!
The government which is strong enough to protect you from everything is strong enough to take everything from you.
>I mean, look who's at the apex of the government right now.
Earlier today i was thinking maybe he just ACTS stupid as a cover for his evil actions.
The government which is strong enough to protect you from everything is strong enough to take everything from you.
11 minutes and 55 seconds was for the installation and reboot time.
cyn, free software and *nix operating systems enthusiast.
This is a bit off topic but when the human hunters went after buffalo, they actualy went after the leaders in front first and kept after the ones taking the lead.
By doing this they played on the heard mentality and the buffalo constantly became confused. While standing there looking for the next buffalo to take control they were easy prey. As long as someone was able to take out the leaders when they assumed control, this could go on untill there was either no more buffalo or untill there wasn't enough light to shoot.
The threat of newer "protection" were the computer has to check in before finding a program valid. Once this is in place, the object will be to take out the leaders and then they can pick off the heard. It won't be long before virus stop acting like wild preditors and start acting like organized human exterminators.
I had just finished installing Windows 2000 Professional on my older computer when it happened. All of a sudden, internet traffic became completely saturated, CPU utilization was at 100% and the system became completely unresponsive. Needless to say, I was forced to hit the reset button, pop in a Linux CD and install that instead.
Only 1 minute before fatal infection! That has to be some kind of a record! Imagine if we were that vulnerable to infection. We would all be dead!
That same Linux installation is still working great by the way, after two whole years and no firewall or anything.
I suspect that results for XP SP2 would be much better!
P.S. Sophos is the shittiest antivirus I've ever seen!
Slashdot - free anti-Microsoft propaganda 24/7
It's not SP2 firewall enabled PCs that get compromised in 12 minutes. It's unpatched, un protected machines that do. Put an old, unpatched, unsecured Linux machine on a cable or DSL modem and it will get rooted in short order as well.
*holds up a sign pointing to parent that says: "Lather, Rinse, Repeat"*
Really... that's not such a bad idea.
I'm ALL FOR keeping incapable users from getting online. If it takes an 'Ebola type' virus which actually causes physical damage to the machine and a lot of it, so be it. It's the next logical step of evolution to the current viruses, physical interaction.
Those who habitually leave their systems unprotected will find themselves buying complete new systems because the majority of components are fried. Damage cost assessments of virus infections would skyrocket as "Survival Time" would become a literal.
Perhaps this carefully constructed virus would only infect zombies...that's an interesting thought.
This would ease the load on tech support as well. The first question would be "Do you see any smoke? Yes? Buy a new computer."
It's beautiful....
"Lame" - Galaxar
I get really tired of reading this kind of thing. There is really no excuse for this anymore and if you are an IT professional then SHAME ON YOU if a PC you are loading gets infected. Here's why: Windows XP 1) Use a Microsoft XP SP 2 CD 2) If you don't have one then copy the contents of a old XP CD, slipstream it with SP2 then make your own bootable XP SP2 CD. 3) If you cannot do either and you only have an older version of XP on CD then use another PC to download Zonealarm, burn it on a CD. Load XP with the internet connection disconnected. Load ZoneAlarm. Connect internet. Download Patches. Disconnect Internet, Remove Zoney, enable MS Firewall, reconnect Internet. Windows 2000 See (3) under XP except use ZoneAlarm Windows 98 See (3) under XP except use ZoneAlarm Windows ME See (3) under XP except use ZoneAlarm Windows 95 See (3) under XP except use ZoneAlarm Windows NT See (3) under XP except use ZoneAlarm Windows for Workgroups 3.11 1) Use an external firewall. Your company LAN should already have one OR you should use a ADSL modem/router with this facility. They are cheap enough. Windows 3.1 See (1) Above Windows Server 2003 Standard, Enterprise, Web edition. Same as (3) under XP. You can load the basic server standalone, firewall it, patch it, remove ZoneAlarm, connect to domain etc. Windows Server 2000 et al Same as (3) under XP. You can load the basic server standalone, firewall it, patch it, remove 3rd party firewall, connect to domain etc. Windows Server NT 4, 3.5 Same as (3) under XP. You can load the basic server standalone, firewall it, patch it, remove 3rd party firewall, connect to domain etc. The other solution is to use Microsoft SUS and let your SUS server patch the box without it ever connecting to the net! See! Answer for everything. If you plug an unpatched Windows box on the internet then, yes, it will get infected. Of course it will. - Solution - Dont do it! Same goes for *nix boxes. If you put an ecommerce site on an old unpatched version of Apache then you may as well publish customer details on the front page. Chris Your friendly MCSE
I get really tired of reading this kind of thing.
There is really no excuse for this anymore and if you are an IT professional then SHAME ON YOU if a PC you are loading gets infected.
Here's why:
Windows XP
1) Use a Microsoft XP SP 2 CD
2) If you don't have one then copy the contents of a old XP CD, slipstream it with SP2 then make your own bootable XP SP2 CD.
3) If you cannot do either and you only have an older version of XP on CD then use another PC to download Zonealarm, burn it on a CD. Load XP with the internet connection disconnected. Load ZoneAlarm. Connect internet. Download Patches. Disconnect Internet, Remove Zoney, enable MS Firewall, reconnect Internet.
Windows 2000
See (3) under XP except use ZoneAlarm
Windows 98
See (3) under XP except use ZoneAlarm
Windows ME
See (3) under XP except use ZoneAlarm
Windows 95
See (3) under XP except use ZoneAlarm
Windows NT
See (3) under XP except use ZoneAlarm
Windows for Workgroups 3.11
1) Use an external firewall. Your company LAN should already have one OR you should use a ADSL modem/router with this facility. They are cheap enough.
Windows 3.1
See (1) Above
Windows Server 2003 Standard, Enterprise, Web edition.
Same as (3) under XP. You can load the basic server standalone, firewall it, patch it, remove ZoneAlarm, connect to domain etc.
Windows Server 2000 et al
Same as (3) under XP. You can load the basic server standalone, firewall it, patch it, remove 3rd party firewall, connect to domain etc.
Windows Server NT 4, 3.5
Same as (3) under XP. You can load the basic server standalone, firewall it, patch it, remove 3rd party firewall, connect to domain etc.
The other solution is to use Microsoft SUS and let your SUS server patch the box without it ever connecting to the net!
See! Answer for everything. If you plug an unpatched Windows box on the internet then, yes, it will get infected. Of course it will. - Solution - Dont do it!
Same goes for *nix boxes. If you put an ecommerce site on an old unpatched version of Apache then you may as well publish customer details on the front page.
Chris
Your friendly MCSE
>God knows what the security state is as XP stumbles around back there dragging in useless services and pumping out thousands of log entries that no customer actually ever asked for.
Security privilages are setup before the desktop is loaded...
Take 30 minutes and do this, never get infected AGAIN (on Windows no less), ever, & most certainly NOT in 12 minutes... not again, ever!
.PAC file proxy filters in all web-browsers vs. adbanners & such.
.reg files which the first body of code in the HOSTS file I use is prepped for the .reg filedata for via a program I built in ObjectPascal delphi console mode ripping away the URL from the 127.0.0.1 loopbacks I equate adbanner servers to, etc. & then insert these here and into IPSecPols also).
APK Online Security 20-points basic checklist. A combination of things really, layered security is the idea!
DETAILS:
http://www.avatar.demon.nl/APK.html
SUMMARY:
1.) IP Security Policy in place for adbanner servers blocking OR other "undesirable" IP addresses.
2.) A custom adbanner blocking HOSTS file with 35,000++ entries in it with known banner ad servers in it (which have been shown in some cases even as bearing malicious javascript etc. in them as well as just plain slowing you down as you surf the web by calling out to DNS' servers for URL to IP resolution & loading their remote data).
3.) Tcp/IP filtering @ the IP Stack levels (UDP & TCP) allowing ONLY port 80. Need others? Open then up, this is all I need personally here.
4.) Using up to date AntiVirus & AntiSpyware.
5.) Using
6.) IE Restricted Zones (added to via
7.) Custom adbanner filtering Cascading Style Sheets in webbrowsers when possible (via Opera).
8.) ZoneAlarm Pro or Native Windows Firewall. ZA is the better overall, the Windows one works though.
9.) Disable Java-javascript &/or ActiveX-activescripting in your webbrowsers.
Sorry webmasters, but too many holes popup here and ONLY IE gets that enabled here for Windows Update really only or sites that "demand" I use either.
10.) Making sure the Operating System is up-to-date/fully hotfix or service pack patched.
11.) Disabling uneeded services (especially remote oriented ones, e.g.-> Remote Registry) gaining not only memory & CPU cycles back, but also security:
Microsoft is even into this one now, evidenced by Windows Server 2003 Security Configuration Wizard run by the installation of SP #1 final onto it.
(I've been doing it for YEARS now, better than a decade since Windows NT 3.51 in fact: It WORKS!)
12.) Using restricted Registry &/or FileSystem ACL rights to disks/folders/files + Registry Hives.
13.) Amending secpol.msc & gpedit.msc security polices local to my system for better security.
14.) Using User-Rights & restricting them to my usual logged on user & the system entity SID itself only on most rights, denying all other groups.
15.) Applying registry hacks known to fortify the system BOTH remotely & locally per Microsoft guides for this on Windows Server 2003 for "OS Hardening" &/or "Tcp/IP Hardening".
16.) Being sure applications are up-to-date & patched current as well.
17.) Lastly here, by using a LinkSys BEFSX41 "NAT" & true CISCO technologies based stateful-packet-inspecting firewall router!
18.) Disabling NetBIOS over Tcp/IP & stopping Client for Microsoft Networks (all you need to get online IS Tcp/IP).
However, Ms Lans need these for file and printer sharing and networking properly/fully. THIS changes on LANS, but can be secured better than the default so IF you need it? Patch/harden for it IF you have to use it.
19.) ADDITIONALLY:
RUNNING IE in a "runas limited user class" sandbox effect, is possible -
It is actually possible to run IE securely: just create a throwaway restricted user account for IE use alone. The restricted account user can't install software and can't access files of other users, so even if IE autoexecutes any nastiness, it can't do any damage.
Of course, it's a hassle to
Does XP ship with SP2? I think the problem is that most people have to load an XP system which does not have SP2 on it. To get SP2 they have to connect to the Internet and download it. If they get scanned and attacked prior to getting SP2 installed the game is over. :)
and plus.....
There's a advanced setting in Windows 2000 workstation and server,XP and Windows 2003 server that you can configure so it only allows HTTP (port 80) and SSL (port 443) through the TCP/IP stack.
This way you can download patches from the net and you won't get infected by SMB based viruses.
Any Microsoft techs want to take this up?
I've worked on Windows systems on corporate networks that have been infected in less than 1 minute after installing a fresh copy of windows.
And if you've got a network at home, with shared printers or file sharing or anything at all that lets your separate PCs talk to each other, you especially need the firewall.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
The retail and OEM versions of XP have been the SP2 version since Fall 2004.
-- "I never gave these stories much credence." - HAL 9000
Question for the Slashmind: What is the magic url to get ALL post sp2 patches for a stock Windows setup? http://what.microsoft.com/%5Bwhere%5D ?
Any person using FTFY or editing my postings agrees to a US$50.00 charge
Dear Mr. AC,
Enclosed, please find one (1) clue. Hopefully this will help you in your attempt to find your obiviously misplaced sense of humor.
Best wishes,
A.A
Your mind is like a parachute. It works best when it's been opened.
Now, I do a netstat and find I have these connections open, despite my firewall ( zonelabs ) supposedly having them closed.
I am not running any IM clients.
My Grisoft AVS does not detect anything amiss, nor does AdAware nor Spybot S&D, but my gut feeling is telling me I *am* compromised.
I have not been routinely running with ports left open.
Is anyone else out there experiencing this?
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
2 points for the A.C., I hadn't been interested enough to actually look that up, thanks for the info!!! ^_^
A.A
Your mind is like a parachute. It works best when it's been opened.
...my machines would all've been taken over a really, really long time ago. I run a mix of 2K and XP on my home network, and the machines are all clean. I have no virus protection, I have no real firewall installed.
I just don't go look at "TOP 500 p0rn SITEZ!!!" links, don't open e-mail attachments unless I know where they came from, etc.
And my machines are fine. Make all the jokes you want, go ahead and feel superior, whatever. But I check my machines pretty thoroughly, and they're clean. Have been for years. I haven't had a virus on my network since I got rid of Win95.
The above comment is CopyWrong (K) Erisian Entertainment. All Rights Reversed. Ewige Blumenkraft!
Since that time I always install new operating systems (Windows and otherwise) behind a NAT box until I have all the latest security patches installed.
-- "Most people prefer a popular myth to an unpopular truth"
Dupe, dupe, dupe, dupe of URL. . .
Yet another thing to love about Linux/Unix/*BSD...
The firewall (iptables or ipfw) is turned on before the network interfaces are brought online. This is possible because the firewall functions of Linux are part of the OS kernel and are available as soon as the kernel is running.
Don't get me wrong, I still use a hardware firewall with my Linux box (belt and suspenders, right?) but it's not quite the matter of life and death it is with Windows machines.
Farewell! It's been a fine buncha years!
If you can deal with the trolls and ignorant posts that are very much the norm on Slashdot, you'll also find some very interesting and well written comments. The ratio of good > bad is low, but it is interesting to see what some people around here think about things.
Comments about how bad Slashdot is, and how "everyone" is a troll, are a bit too harsh.
With any public forum you get a lot of noise. Slashdot is no exception. But there is a signal here, you just have to have the patience to look for it.
The user-moderation does have a lot to be desired but if you read more then just the +5's you're more likely to find good comments.
I like Slashdot.
- It's not the Macs I hate. It's Digg users. -
One way that pre-European cultures in America hunted buffalo (since they did not have horses or firearms) was to get the buffalo to start stampeding and drive them off a cliff. In that case, it was the ones at the front of the herd that died first.
e r=25
http://lewisandclark.state.mt.us/sites.asp?IDNumb
Never were taught that in college, were you? Kind of breaks that fantasy story about how Native Americans respected nature and have an inherent moral superiority.
Final 2006 "Proof of Global Warming" US Hurricane Count -> 0