Estimating the Time-To-Own of an Unpatched Windows PC

An anonymous reader notes a recent post on the SANS Institute's Internet Storm Center site estimating the time to infection of an unpatched Windows machine on the Internet — currently about 4 minutes. The researcher stipulated that the sub-5-minute estimate was valid for an unpatched machine in an ISP netblock with no NAT or firewall. The researcher, Lorna Hutcheson, called for others to post data on time-to-infection, and honeypot researchers in Germany did so the same day. They found longer times to infection, an average of 16 hours. Concludes the ISC's Hutchinson: "While the survival time varies quite a bit across methods used, pretty much all agree that placing an unpatched Windows computer directly onto the Internet in the hope that it downloads the patches faster than it gets exploited are odds that you wouldn't bet on in Vegas."

Comments

How is this measured

[Lord Lode]

I've heard similar statistics in the past already. How is this statistic measured? Is it the time after you connected your ethernet cable or modem and doing nothing at all but wait, or is it the time after you opened a browser and let an "average" user surf the internet and open things? Is it a problem if you need 4 minutes to install all windows patches and updates?

Re:How is this measured

[Spad]

I know that last time I put a new install of XP SP2 straight onto the internet without firewall or antivirus (A tiny oversight - plugged in the wrong cable) it was owned in under 5 minutes without any interaction on my part.

Re:How is this measured

[JimboFBX]

The fact your firewall was disabled shows you already did some interaction.

Re:How is this measured

[BazilBBrush]

How is this statistic measured?

How long is a piece of string?

Pretty short in this case...

Re:How is this measured

[Anonymous Coward]

Same here. Some years ago I installed XP and when I connected to the internet I almost immediately received the "your computer will shut down in 60 seconds" notice triggered by the blaster virus.

I bought Suse the same day and never looked back.

Re:How is this measured

[Anonymous Coward]

It's simple: install fresh OS, plug in Interweb, wait 4 minutes. No other user action, instant zombie.

It comes from vulnerabilities in default services that shipped in the very first version of the OS. Nothing special about Windows except that there's enough of them to make it worthwhile to use some zombies to constantly probe for new ones.

Re:How is this measured

[Alpha Whisky]

I'd mod you funny if I had modpoints. I think he probably meant no router/firewall, Microsoft's toy firewall enabled by default in SP2 is about as effective protection as a wet paper bag would be against a rocket propelled grenade. Or for the Slashdot crowd who only understand car analogies, as good a protection as a Ford Pinto crashed into by an express train.

Re:How is this measured

[Gumbercules!!]

I recall working at a university, in which every PC had a public IP address. I clearly remember a Windows 2000 server being pwned during installation. As in before the install process even finished.

That was the last time I installed with the CAT/5 still plugged in (and yes, it was my first job)....

Re:How is this measured

[Dr.M0rph3us]

That's one of the reasons I never plug in the network cable until the OS is installed, configured, hardened, firewalled, [insert paranoid security measure here].

I usually turn automatic updates off, and i don't immediately switch to new Service Packs (using Win. Server 2k3 EE/DC), cause I don't trust them until they are thoroughly tested (see what happens with XP SP3).

Re:How is this measured

[Opportunist]

I did exactly the same kind of "research" (for a documentation about online threats for our local TV network), here is what I did.

I installed XP SP1 (bear with me, it was the pre-Vista days), the way you got it delivered on a CD. I did nothing else (XP SP1 came without the firewall preinstalled). I turned on a network monitor to document and show what happens. Then I patched in an Ethernet cable to the local network which had unfiltered access to the internet (pretty much what the average cable user, or the average DSL user has after dialup).

Time to infection through the RPC hole was less than 2 minutes.

I did essentially NOTHING to faciliate it (besides, well, not having the machine patched at least to SP2), I just let the machine sit there, connected to the internet.

In a nutshell, if you're using XP and have one of those SP1 install discs, download SP3 before you kick the system in the gutter, put the service pack on a USB stick or external drive and install it before you connect that machine anywhere.

Re:How is this measured

[welshie]

It takes considerably more than 4 minutes to patch XP, even from a local copy of all the service packs and patches on a USB hard drive. More like 2 hours if you haven't got the updates scripted, and at least 30 minutes if it's all scripted. If you factor in that the average user doesn't have all those service packs and hotfixes archived, and need to download from the internet... It's toast. I had the unfortunate experience of taking delivery of a new Laptop that had Vista on it, and at the time, the only Internet connection available was a dial-up. After five hours online, it still hadn't finished downloading the updates. This makes me think - why can't Microsoft's updates just patch files that is already on the disk, rather than replacing the entire binary? This is hardly new technology.

Re:How is this measured

[Anonymous Coward]

Really? Pre-SP1 XP has widely known vulnerabilities in the services that listens on the network by default, which are heavily exploited without user interaction. SP2 comes with a firewall on by default, which has not been compromised AFAIK, so I'm pretty skeptical of the claim that it can be exploited without user interaction.

FWIW, I have a spare box around with stock SP2 installed one or two years ago, and no additional firewalls, AV, and no patches until SP3 recently. It has had many months of cumulative direct internet exposure (USB ADSL modem, not ethernet with built-in NAT), and no compromises so far. (I've scanned it off-line a few times from a known good machine, and nothing came up so far.

Re:How is this measured

[bloodninja]

I recall working at a university, in which every PC had a public IP address. I clearly remember a Windows 2000 server being pwned during installation. As in before the install process even finished.

How did you know that the system was compromised? It's been a long time since I've installed any version of Windows, but I don't remember any "you've been pwned" message facility.

Re:How is this measured

[BillyGee]

FUD much? I think if one gave you a default install XP SP2 to play with remotely, you'd get frustrated oh in about 30 minutes, shrug and go back to WoW.

Re:How is this measured

[Mistlefoot]

Absolutely. SP2 firewall is enabled by default.

And from the article "This older guide was written based on Windows XP pre SP2. One of its main feature
was step by step instructions on how to enable the Windows XP firewall."

XP SP2 was released in August of 2004. Why are we talking about 4 year old software? Heck, Firefox 1.0 hadn't even been released yet. And Ubuntu's first release was in October 2004.

Why is an OS older than Ubuntu or Firefox being tested? And I mean 4 years older then Ubuntu - even with SP2 it would still be older then Ubuntu or Firefox.

Re:How is this measured

[erlando]

Why is an OS older than Ubuntu or Firefox being tested? And I mean 4 years older then Ubuntu - even with SP2 it would still be older then Ubuntu or Firefox.

It could be that there is a lot of pre-SP2 install-disks out there. In the likely event of needing a reinstall you are faced with having to put a pre-SP2 XP on the net to retrieve SP2.

Re:How is this measured

[WingedHorse]

Windows servers require (shut up. I am sure that there are some workarounds so "require" isn't a good word but that's the default way to deal wit it) access to network for some of the configuring during installation. So if he put ethernet cable for that time, took it off after it was done and later on found that the computer had been infected... Just one feasible option.

Re:How is this measured

[Mistlefoot]

Actually, Thorsten at http://honeyblog.org/archives/193-Survival-of-the-Fittest.html answers that. He states

"Yonah, if you read the blog posting things should be more clear: "For example, we can use low-interaction honeypot such as nepenthes or amun that emulate common network-based vulnerabilities and deploy them at different locations."

Thus we did not use native machines, but low-interaction honeypots that emulate different kinds of exploits. You can find more information about these tools at http://nepenthes.mwcollect.org and http://amunhoney.sf.net - hope this helps to understand the results a bit better."

No where on any of the pages is there any indication that these are windows exploits nor was a windows machine used in this study. According to https://sourceforge.net/projects/amunhoney/ Amun requires linux.

Although I've no doubt any unpatched OS has vulnerabities (hence the pathces), could KDawson please point us to the article discussing "Estimating the Time-To-Own of an Unpatched Windows PC" because this article (and none of the links) even mention windows.

Re:How is this measured

[Anonymous Coward]

The best thing to do would be to download and burn an offline SP3 updater on a good PC, and install that before connecting to the net.

Sadly this is not very well known especially amongst those who need it the most, and MS doesn't go out their way to make it very clear either. So geeks, do your duty and inform those who you suspect could use it.

Re:How is this measured

[anomnomnomymous]

Don't know if they still give those out, but I have this (free) SP2-update on CD, which I ordered from the MS-site.

Re:How is this measured

[Alpha Whisky]

I don't play WoW. I do, however, run Zonealarm. Now, a fresh Zonealarm install will tell you that loads of Windows services are asking to open ports on to the big bad internet. All of these are open by default on the Mickey Mouse Microsoft firewall, because "they're Microsoft services and none of them could possibly be a security risk". As I recall there have been a metric fuckton of patches for many of the default Windows services since SP2. I rest my case.

Re:How is this measured

[johnw]

The fact your firewall was disabled shows you already did some interaction.

This comment misses the point. It was quite clear what the question meant and trying to twist around one of the pre-conditions to be one of the others can be intended only to create confusion rather than illumination.

Re:How is this measured

[CastrTroy]

Because the last OS put out previous to Vista was Windows XP. That's why we are talking about such old software. It's only 1 version behind current. The biggest problem, is that there's a lot of people who have XP discs with no service pack incorporated. When you reinstall from these discs, and try to connect to the internet to download SP2, your computer is owned before you can even download the service pack. That's a major problem.

Re:How is this measured

[Gumbercules!!]

I know it was pwned because during the installation I got an angry phone call from the Cisco Comms boys, who wanted to know why one of our servers was suddenly flooding the network with traffic matching the signature of the Code Red worm.

Once the installation finished (now with the cable unplugged), sure enough, the box was infected with Code Red. No doubt because IIS installs by default (set to on) and my leaving the cable in allowed it to get infected.

I was then embarrassingly the reason for a new policy stating all installations must be done with the network cable unplugged.

Re:How is this measured

[KGIII]

Why? So that they can use it as an excuse to hate Windows. Like we needed additional excuses? Hell, I'm even a Windows FAN but not a fanboy. There are piles of reasons to hate Windows.

Re:How is this measured

[Chutulu]

but I don't remember any "you've been pwned" message facility.

the BSOD??

Re:How is this measured

[cryptodan]

The best thing to do would be to download and burn an offline SP3 updater on a good PC, and install that before connecting to the net.

Sadly this is not very well known especially amongst those who need it the most, and MS doesn't go out their way to make it very clear either. So geeks, do your duty and inform those who you suspect could use it.

This would be all fine and dandy and all, but who has access to two computers at home? Work computers do not count as most of them probably do not have burners.

Re:How is this measured

[Stellian]

Oh please. This is why I love Slashdot. I'm as big of a MS hater as the next guy, but those who ignore MS's progress from the Blaster days are just spewing FUD. A default Windows SP2 installation, with non-executable buffers (DEP) left enabled for Core windows services, running on supporting hardware will not get owned by just sitting on an infected network. I challenge any Slashdoter who thinks otherwise to prove it. Of course, when people start browsing porn sites with the default browser things get tricky, but that's no longer a remote, automated attack.
TFA counts *ALL* forms of attack. Even scans for obscure webserver or game vulnerabilities, Blaster type scans and ssh brute force attempts. I fail to see how these "attacks" can have any impact on a computer running a fresh install of a recent version of Windows like XP SP2, SP3 or Vista.
You can argue about security track-record all you like, and talk about why Windows is not secure by design, and how it should not be used for life support systems and ATMs, and I would agree. But this is getting ridiculous.

Re:How is this measured

[Anonymous Coward]

This would be all fine and dandy and all, but who has access to two computers at home? Work computers do not count as most of them probably do not have burners.

Most families I know have more than one computer at home nowadays. This isn't 1995 anymore you know. And if the work computer didn't disable USB, you can usually download it on a USB stick from there. Jeez, this isn't rocket science. You can usually even just download the linked ISO image on a compromized machine, as there are very few virusses in the wild that are actively looking for ISO images on your HDD to patch on the fly.

Re:How is this measured

[PopeRatzo]

but who has access to two computers at home?

Everybody who would be reading this article?

Re:How is this measured

[drsmithy]

Is it a problem if you need 4 minutes to install all windows patches and updates?

It's not a problem at all if you just turn on the firewall that comes with every version of XP, or in pretty much every consumer-level cable/ADSL modem/router.

It would be interesting to see how long default, unpatched installs of OSes like RH7 and Solaris 8 last as well.

These sorts of articles are just flamebait. Pretty much any version of Windows XP acquired since 2004 has SP2 integrated, and this the firewall enabled by default. The vast majority of consumers sit behind NAT routers (at the very least) and firewalls (also common). A completely exposed Windows XP box - much like a completely exposed box running any OS - is a rarity, today.

Re:How is this measured

[darkmeridian]

The last I checked, Windows XP SP2 did not ship with an effective firewall that shipped auto-on.

Re:How is this measured

[petermgreen]

IIRC (and I could be misremembering) the XP SP2 firewall by default leaves a lot of stuff open to what it considers the "local network". The problem then comes when either it's idea of the local network is overly wide or the local network you are on has infected machines.

Re:How is this measured

[cryptodan]

but who has access to two computers at home?

Everybody who would be reading this article?

Take into consideration "What if the computer doesn't boot up?" I know quite a few people who only have 1 computer and they are not techy savvy to go out and buy a USB Stick. So where would they store it. Its why computer repair shops exist, and if everyone was computer savvy like most of us here then there would be hardly any need for The Geek Squad, and others.

Re:How is this measured

[drsmithy]

I don't play WoW. I do, however, run Zonealarm. Now, a fresh Zonealarm install will tell you that loads of Windows services are asking to open ports on to the big bad internet. All of these are open by default on the Mickey Mouse Microsoft firewall, because "they're Microsoft services and none of them could possibly be a security risk".

No, they're not. A default Windows XP SP2 install doesn't even respond to pings.

Re:How is this measured

[drsmithy]

Then I patched in an Ethernet cable to the local network which had unfiltered access to the internet (pretty much what the average cable user, or the average DSL user has after dialup).

The average DSL user, at least, is sitting behind a device which at the very least does NAT and probably has a firewall enabled as well.

It's been some time since I had a cable connection and modem, but I'd be surprised if they weren't the same, these days.

Re:How is this measured

[phoenixwade]

if everyone was computer savvy like most of us here then there would be hardly any need for The Geek Squad, and others.

Are you sure there is a need for geek squad? People can steal porn off of computers without professional help....

Re:How is this measured

[Corporate Troll]

A default Windows SP2 installation, with non-executable buffers (DEP) left enabled for Core windows services, running on supporting hardware will not get owned by just sitting on an infected network.

Absolutely, spot on! I'm no Microsoft fan either, but if you start with a stock SP2 install nothing bad will happen to your machine. Install firefox, surf whatever you want with that while the rest of the patches come in and be happy. I have done it myself, and it's not a problem.

The built-in SP2 firewall is enough for most tasks, even though I still prefer to be behind one of my OpenBSD firewalls.

Dare I say: mod parent up...

Re:How is this measured

[PopeRatzo]

Of course, you're right, cryptodan. There are lots of people who don't have a clue about computer technology (one of them, who is running for president, says he is "Learning to go online").

It's easy to forget that not everyone uses a 4-way KVM switch at home.

Re:How is this measured

[FireFury03]

The average DSL user, at least, is sitting behind a device which at the very least does NAT and probably has a firewall enabled as well.

I'm not convinced that is the case - lots of ISPs provide "free" USB ADSL modems (not network routers) - this sort of device will appear as an unfirewalled network interface. This might be changing now, with more people using 802.11, but I'm sure a lot of people are still using USB ADSL modems.

It's been some time since I had a cable connection and modem, but I'd be surprised if they weren't the same, these days.

Cable modems are usually just network bridges - if you want firewalling, NAT, etc. you need a separate router.

Re:How is this measured

[klubar]

To be fair, you really should use a 4 or 5 year old version of RH7 or Mac OS9 and make sure it's not behind any firewall/NAT device.

This article is an example of anti-virus FUD. Almost no consumers are left running without a cable/DSL NAT/firewall device. Perhaps a more telling story (but not as sensational) would be that a automatically patch version of XP SP3 (or Vista) behind a $20 cable router doesn't get infected. Wouldn't that be a headline!

Re:How is this measured

[svunt]

Everyone except you. I'm barely keeping my head above water financially, and my gf and I (both part-time students with part-time jobs) have a total of 5 desktops...you can find beige boxes in full working order on the footpath, dude.

Re:How is this measured

[Anonymous Brave Guy]

That, and it was on pretty much every magazine cover DVD for months.

And how many people really don't have access to at least an SP2 DVD anyway? If the average lifetime of a PC is, say, somewhere in the 3–5 year range, then almost all PCs in use today would have come with such a disk.

This entire article is (-1, Troll). It's like asking the average time to crack an Ubuntu box if you install it with a direct, unfirewalled connection to the Internet, disable all the security settings, and post the root password in your Slashdot sig.

Re:How is this measured

[hesaigo999ca]

I would love to see how long a windows xp pro without spk2 but behind a router takes before being owned....as this would set the precedent to how long you have to download your updates....
select a few at a time then reboot etc.... until u have all of them. How long do u figure?
Almost worth testing, unfortunately I don't have a router, anyone else???

Re:How is this measured

[jamesh]

I made a monumental screwup and broke the firewall (iptables on a Linux machine) in such a way that there was no filtering to one of our /24 IP addresses. The IP address belonged to a Windows server running an unpatched version of MSSQL, and Blaster was at it's peak. It took no less than 10 seconds from the time I activated the updated (broken) firewall rules to me scratching my head wondering why the router appeared completely dead.

Blaster had infected the machine within about 10 seconds and the traffic had killed the router (well... not killed, it came back to life when I pulled the plug on the infected machine).

Fortunately Blaster was memory resident only so there was no lasting damage.

Of course one infection doesn't prove anything, looking through the firewall logs at the time the average blaster packet per IP address was a few minutes so I think I was just unlucky to have been owned that quickly.

Re:How is this measured

[cryptodan]

Everyone except you. I'm barely keeping my head above water financially, and my gf and I (both part-time students with part-time jobs) have a total of 5 desktops...you can find beige boxes in full working order on the footpath, dude.

I also have 2 computers and a lap top at home. I was referring to the not so tech savvy family who use a computer for generic stuff from email, myspace, chatting, and your typical other generic type uses. My wife and i are gamers.

Re:How is this measured

[apathy maybe]

I won't put it in my sig, but my password is "looselipsloselifes". As well, I have no firewall, and I have disabled all security settings.

And a direct connection to the net on an always on broadband connection.

Enjoy!

Oh wait, you wanted my IP address? I'm not that stupid.

Re:How is this measured

[ThatTallGuy]

I'm one of those people who doesn't use a KVM switch. VNC is better because it works on virtual machines as well as physical ones. :D

Re:How is this measured

[jamesh]

but I don't remember any "you've been pwned" message facility.

the BSOD??

No, that's normal.

Re:How is this measured

[Anonymous Coward]

I use XP SP1 at home. No firewall with connection thru Comcast cable. Never had a virus (I check regularly) and rarely any other malware. I also have a Win 98 box with no firewall connected thru a wireless link (does have anti-virus, though) - never pwned.

I suspect a lot of these stories are apocryphal. However, I do back up regularly and have a safe and secure restore options.

Re:How is this measured

[vk2]

That's the second best thing. I already did the first best thing and I am not looking back.

Re:How is this measured

[jandoedel]

Easy... Your IP is 127.0.0.1

Re:How is this measured

[Anonymous Coward]

How do you know your window machine has been owned? How can an average person tell if their computer has been owned?

Re:How is this measured

[PNutts]

If only there was software that would apply all current patches and SPs before connecting to the Internet. Something like an auto patcher . I'm sure the vendor would embrace and promote this feature. Oh, wait...

Re:How is this measured

[mr_nazgul]

The same thing happened to me. I had just ran a fresh install of XP SP2, and went to get some updates and drivers, and before I was even finished downloading them I was infested (over 100 hits with my scanner).

Mind you, when I had gone to download everything it was done with IE.7, while using Firefox (1.5 at the time) resulted in only one infection. I suspect it's more of an IE issue than an OS issue (though buggy XP doesn't help at all).

I moved all the updates to an external drive, and had to reinstall and run all the updates and security items before even browsing the net once.

Re:How is this measured

[CrazedSanity]

Sadly, many of the new cable & DSL installations still use a modem that has no firewall, NAT, etc. to protect the user. The user isn't warned about the dangers of connecting their system directly to the modem, or even told why they should get a router with a proper firewall/NAT system.

I went to my mother-in-law's house to work on her computer and found that she'd been given a cable modem that lacked any firewall whatsoever. Amazingly, her M$ laptop that was directly connected always seemed to freeze...

Re:How is this measured

[Anonymous Coward]

People are still choosing XP over Vista.

Re:How is this measured

[mysticgoat]

XP SP2 was released in August of 2004. Why are we talking about 4 year old software?

For people like me, TFA was highly relevant.

I'm now using Linux (Ubuntu) for more than 95% of my work. But I still have WinXP on dual boot since I've got a couple of image processing workflows in PaintShop Pro that I haven't developed Linux equivalents for as yet, and since my 8 color Canon i9900 only achieves its full potential (13"x17" photorealistic posters) when I use the proprietary Windows driver.

I have not had to do a re-install of WinXP for more than 5 years. Back then, I re-installed from the original disks, got on the internet, and spent hours downloading and installing patches (and weeks reloading software and tweaking configurations). Had I not read TFA, I would have been using the same approach if WinXP crapped out on me today. I probably would not have noticed that WinXP had gotten pwned in the first few minutes, since I have done 0 none nada Windows installs in the last 5 years. I'm letting that skill set rust away.

Now I know that the next time WinXP craps out, I need to use Ubuntu to gather up the latest SP and patches and prepare an update disk, then disconnect the network cable before doing the WinXP reinstall.

So what should I keep in mind as I go scrounging for the latest WinXP SP, etc, from Ubuntu? Remember that I might not need to do this for a couple of years or so (prolly not until the HD that has the WinXP partition dies). Will I run afoul of Genuine Windows Advantage?

BTW, Ubuntu is a pretty slick platform for 3D modeling. I'm getting reasonably fast renders with a 1.6 MHZ CPU and 1 GB of ram. Much better than what I was getting with WinXP. Some of this would be improvements in Blender, but I'm pretty sure most of the improvement is from the lower overhead of the OS.

Re:How is this measured

[thetartanavenger]

The fact that you have a firewall shows that you have made additional interaction. The firewall didn't come until SP2, and I don't know about anyone else but I tend to call a service pack a patch.

Re:How is this measured

[Nimey]

What you should really do is slipstream SP3 into your SP1-or-later CD with nLite or some other tool, then burn the resulting ISO and install from that.

If you're feeling particularly ambitious, slipstream in DriverPacks.net's drivers; you'll need a DVD-R because with all the driverpacks it ends up being about 1 GB.

Re:How is this measured

[Anonymous Coward]

but I don't remember any "you've been pwned" message facility.

Oh come now - it's in every tech movie. It's the same facility that flashes the blinking green "ACCESS GRANTED" text that reflects off the glasses of the guy sitting in the chair and eyes of the girl stooping over him in the dimply lit computer room as he cleverly guesses the system password ("password") needed to access the computer that is counting down the nuclear missile launch, while he keeps telling himself that this is not a good time get distracted by peeking down her blouse and enters the abort codes just in time to stop the bleeping clock from making its last bleep, preventing the launching of the missile that would destroy all humanity.

Re:How is this measured

[Anonymous Coward]

Or enable the connection firewall that comes with XP?

Re:How is this measured

[JoeMerchant]

A hardware firewall (think: $40 Linksys router) is 100% effective at blocking the inbound threats during download of SP2.

Re:How is this measured

[Nos.]

As others have stated, your best bet is to pick up a Linksys or other router and place it in between your system and the Internet. If your Ubuntu crashes, you're in the same boat.

Re:How is this measured

[Opportunist]

You do that, maybe I would if I ever feel the need or at least urge to install XP again, but Joe Average doesn't. He doesn't know how to do that. If he is halfway skilled, he can reinstall XP with the CD provided without too much damage.

The problem isn't people with a clue. I doubt many have the problem. First of all, even if they don't have a slipstreamed version, they have no problem installing a service pack from an external drive or CD, the have a router that protects them from incoming threats, etc.

The problem are the thousands or maybe millions of clueless users that don't want to know a thing about security, that only want to surf, mail and maybe do some IM'ing with their friends. Most of them would be incredibly happy to get a machine with a system on a rom that can do just that, they don't even want a "full" computer because "so many thing can break".

Why nobody ever had the idea of marketing such a computer is beyond me.

Re:How is this measured

[elrous0]

Don't underestimate the power of the wet paper bag, my friend. There are quite a few actors on the CW who can't even act their way out of one.

Re:How is this measured

[urbanriot]

Thank you, I'm glad someone is being sensible and not hopping on the FUD train. Windows Firewall (ie. packet filtering) is enabled on a default installation of Windows XP, and the entire article and most of these comments are completely fictitious and don't apply to Windows XP post SP2.

For kicks, I put a fresh install of XP SP2 directly onto one of our public IP's about an two hours ago, and it has yet to get 'owned'. Seriously, all Slashdot needs to hate on Microsoft is a cute little blog with a couple paragraphs saying that their Windows was lolownd without any proof, and they'll fill up pages of Linux pwns Windows.

Re:How is this measured

[InvisiBill]

I would love to see how long a windows xp pro without spk2 but behind a router takes before being owned....

Behind a properly configured NAT router, never. NAT inherently blocks all inbound connections to a specific device, therefore a bad guy can't directly connect to the XP box to exploit any vulnerabilities. See http://www.grc.com/nat/nat.htm for more info.

Obviously, the clueless user could still do something to cause an infection. Once it's compromised that way, the floodgate for malware is opened up and anything goes. However, an outsider can't initially connect directly to the XP box to exploit it.

Re:How is this measured

[AusIV]

And how many people really don't have access to at least an SP2 DVD anyway? If the average lifetime of a PC is, say, somewhere in the 3â"5 year range, then almost all PCs in use today would have come with such a disk.

Most consumer PCs these days come with a recovery partition, not an install CD. If you're reinstalling because of a hard-drive failure, and hadn't made backup CDs from the recovery partition, good luck.

I'm sure if I went around to all my friends and family I could find an SP2 disk somewhere, but I'm pretty sure the only disk I have lying around my house is from the first few weeks XP was on the market.

That said, I don't use Windows on any of my own systems anymore - the only reason I'd be looking for a CD would be for a family member. If I still had an XP system of my own, there's probably a higher chance I'd have a disk lying around.

Re:How is this measured

[Anonymous Coward]

2002 called and they suggested you install SP1.

Re:How is this measured

[ozmanjusri]

those who ignore MS's progress from the Blaster days are just spewing FUD.

Exactly.

Everybody's long since upgraded to the Storm worm.

Re:How is this measured

[kesuki]

what firewall? windows firewall was the only firewall to score a 0 in a comprehensive test of firewall programs.

http://www.pcworld.idg.com.au/index.php/id;159719021

the guy said he plugged in the wrong cable, circumventing his hardware firewall.

Re:How is this measured

[Anonymous Coward]

Hey, if I was a botnet owner, I'd be posting anecdotes like this too.

Re:How is this measured

[74nova]

while I agree, I do have to comment that SP2 is relevant because of two things

1. SP3 isn't that old
2. SP3 isn't that good and has a nasty habit of leaving your machine (or at least your VPN) unusable

Re:How is this measured

[realkiwi]

I have seen this with my own eyes at a small ISP that had brought me in to beef up their firewall. There was unfortunately some kind of obligation to install with the computer plugged in - some software issue that needed the connexion. In any case the machine was owned almost immediately after network services were started during installation.

The network at this ISP was under constant attack I put in a diskless box running shorewall and life returned to normal for them.

Re:How is this measured

[AmiMoJo]

Microsoft used to send out free update CDs, at least as far as SP2. Now they seem to be charging :(

Re:How is this measured

[Anonymous Coward]

The "Time to Own" figure of 4 minutes is based on several assumptions.

1) A log of the frequencies of attacks on common ISPs' customer assigned IP address blocks. Assumption is that most of these are winxp attacking worms.
2) The you are using a completely unpatched version of windows that is susceptable to every attack that hits it.
3) That your ISP will not be filtering out any of these worms.

A pre Service Pack 2 Install (I think that means a system install disk that's more than 3-4years old) with a naked broadband internet would very likely get owned this fast, if a firewall was not used.

There might be some commonly exploited worm vulnerabilities with WinXPSP2 installs (where the user didn't choose to open ports/disable the built in firewall, or used Win4All iso), but I haven't heard that this was a problem. Prudence tells me to use a dedicated firewall anyways.

The article seems concerned with attacks on older install media (w2k, wxpSP0, WXPSP1), whether or not you could patch them before they get owned, and a link to a howto page concerning their workaround. I'm sure there are people that have forgotten or were just never aware of the dangers of updating old winxp without a firewall. I don't think this is particularly slashdotworthy though.

Re:How is this measured

[kesuki]

you are completely misrepresenting the data available!

#1 the 'original guide was written pre sp2' is true, but has nothing to do with current survival times, or the new SANS vista 'surviving the first day' guide.

the 4 minute time? what is it 'really' it's the length of time it takes for any internet enabled machine to receive an attempted compromise that would have infected a vulnerable machine. the very article, had you read it would have informed you that WINDOWS FIREWALL DOES NOT STOP ALL ATTACKS, SANS is most worried about malicious websites, and P2P applications, because people tend to allow those types of communication through all their firewalls. infection rates have gone up, and the whole point is that sans is now offering a guide that Every vista using computer newbie should be required to read completely before they ever get internet (not that they will) http://www.sans.org/reading_room/whitepapers/windows/1298.php

SANS says windows firewall improved things, yet contrarily Survival times have GONE DOWN since windows firewall was introduced. i remember when windows survival time was 13 minutes, today it is 4 minutes, that means since the last time i paid attention, the number of attempted attacks have gone up by 333%

oh and hey, there wouldn't be an attack every 4 minutes on every pc on the internet, if there was some glorious magic bullet firewall that came with sp2 that blocks every outside hacking attempt.

one of 2 things must be true, 1. enough people run old machines without a firewall. 2, the most widely used firewalls don't block hacking attempts. it could even be both! why would hackers bother letting compromised windows systems send that much data, if it didn't catch people with their pants down, couldn't they utilize the available bandwidth more efficiently?

Re:How is this measured

[WNight]

That's totally unrelated to security - that's it being trained to hide in the damp forest leaves without making a sound so that the big bad animals don't eat it. Like a fawn.

Real security is when a machine can be pinged without compromising whatever else it's doing.

Re:How is this measured

[kesuki]

"Oh please. This is why I love Slashdot. I'm as big of a MS hater as the next guy, but those who ignore MS's progress from the Blaster days are just spewing FUD. A default Windows SP2 installation, with non-executable buffers (DEP) left enabled for Core windows services, running on supporting hardware will not get owned by just sitting on an infected network. I challenge any Slashdoter who thinks otherwise to prove it. Of course, when people start browsing porn sites with the default browser things get tricky, but that's no longer a remote, automated attack."

http://www.grc.com/ click on 'sheilds up' and do a 'common port scan' with windows firewall as your only inbound protection. Since i use a dedicated hardware firewall i can't post those results here, but here were my results... note: the first test failed because 1 port identified as 'closed' instead of as 'stealth' as for the last, i didn't disable ping, because i use ping a lot myself.

btw these are the ports scanned "0, 21, 22, 23, 25, 79, 80, 110, 113, 119, 135, 139, 143, 389, 443, 445, 1002, 1024, 1025, 1026, 1027, 1028, 1029, 1030, 1720, 5000" I seem top recall that even with a linksys wireless router, many of these ports were still 'open' to complete internet strangers. yeah, that's part of why i switched to always having a hardware firewall.

"Solicited TCP Packets: RECEIVED (FAILED) -- As detailed in the port report below, one or more of your system's ports actively responded to our deliberate attempts to establish a connection. It is generally possible to increase your system's security by hiding it from the probes of potentially hostile hackers. Please see the details presented by the specific port links below, as well as the various resources on this site, and in our extremely helpful and active user community.

Unsolicited Packets: PASSED -- No Internet packets of any sort were received from your system as a side-effect of our attempts to elicit some response from any of the ports listed above. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system remained wisely silent. (Except for the fact that not all of its ports are completely stealthed as shown below.)

Ping Reply: RECEIVED (FAILED) -- Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation."

Re:How is this measured

[gravis777]

I find this kind of hard to believe, the idea that you will get exploited before patching. On unpatched XP, after connecting to Internet, I go and download Firefox, which takes under a minute. Install, close IE. Open Firefox, go download AVG or Avast. Install, update, reboot. Relaunch Firefox, download Spybot, and install, update, and imunize system. Run Windows Updates, install SP3.

I have yet to be exploited before patching.

Re:How is this measured

[kesuki]

Was that you? I reported a lot of code red reports that i got on my apache log, especially the ones in university netblocks!

I was probably the guy who reported the ip address of your code red machine to your admins!

Re:How is this measured

[bigstrat2003]

No, others don't have two computers. I only have one, and will only have one for the foreseeable future, because that's simply all that I need. I have my one machine, which I periodically put new hardware in as I need it, and it'll serve my needs for a long time to come that way.

Granted, I live alone, but the number of machines some people have just blows me away. What the hell do you need so many boxes for? Why don't you just build one really good one, instead of N mediocre ones? I just don't get it.

Re:How is this measured

[hesaigo999ca]

This nat router, is this the usual linksys or dlink router, or are you talking about corporate level only?

Re:How is this measured

[jedidiah]

> FUD much? I think if one gave you a default install XP SP2 to play with remotely, you'd get frustrated oh in about 30 minutes, shrug and go back to WoW.

This isn't about what the slashdot peanut gallery can do.

This is what the ENTIRE PLANET can do.

Your kind of thinking is why Microsoft is such a security quagmire.

Re:How is this measured

[LunaticTippy]

Hardly anybody is going out and buying multiple boxes for their personal use. Most of the cases of hoarding I've heard about (and done myself) are scavenging. I'll see a machine in the alley or on a pallet headed for the recycler and snag it. It's fun to have for experimenting with other OSs or to set up a file/email/web/app/db server, or to give to someone who needs a basic machine to check email and websurf, or to use to fix your "main" box, etc.

I must have set up dozens of friends with free computers over the years.

Someday you're going to wish you had an old P3 when your single PC is dead and you need to download drivers or troubleshoot.

Re:How is this measured

[Anonymous Coward]

Download, burn to cd before reinstall
http://www.microsoft.com/downloadS/details.aspx?familyid=5B33B5A8-5E76-401F-BE08-1E1555D4F3D4&displaylang=en
Not too hard??

Re:How is this measured

[Allador]

Those USB things are very rare, at least in my experience.

I havent actually seen on in use in many, many years.

And every residential internet package I've ever seen in the past 2-3 years includes a nat/firewall/router combo unit (combo'd with the modem).

Business packages you often get it without a router/firewall because they all run their own equipment.

Re:How is this measured

[toddestan]

The other thing you could do is enable the Windows XP firewall before hooking it up to the network, in the case of a pre-SP2 install disk. The people who are more screwed are those reinstalling Windows 2000, where you really do need to have a 3rd party firewall handy or a CD with all the updates.

Re:How is this measured

[westlake]

XP SP1 came without the firewall preinstalled
.

The firewall was in Win XP from Day 1 - just a little hard to find and not enabled by default.

Re:How is this measured

[westlake]

The biggest problem, is that there's a lot of people who have XP discs with no service pack incorporated.
.

You could, of course, simply enable the firewall that shipped with XP before connecting to the net.

Re:How is this measured

[CastrTroy]

Do these hardware firewalls work with dial-up connections?

Re:How is this measured

[drew]

It's not a problem at all if you just turn on the firewall that comes with every version of XP, or in pretty much every consumer-level cable/ADSL modem/router.

Every DSL/Cable Modem I have ever used was essentially a straight network bridge. No firewall, no NAT. Granted my current Cable modem is about 3 years old, and I got my last DSL modem about 6 years ago, so maybe for brand new installations this is no longer the case. Still, I have to imagine that there are a large number of people out there who still have older broadband equipment, so that is certainly not true of "pretty much every consumer-level cable/adsl modem".

Not sure how RH or Solaris would fare, but a base install of most Linux or BSD OS's that I've installed in the last 5 years don't enable much from a network perspective beyond SSH and apache (with a basic index.html page) which doesn't leave a lot of surface for attack, unless you happened to have one of the SSH installations with a compromised key generator, and even then I don't remember hearing much about automated attacks.

Re:How is this measured

[Anonymous Coward]

Seriously, I see a much bigger problem. Why should a university use Windows?

Re:How is this measured

[mysticgoat]

If your Ubuntu crashes, you're in the same boat.

Um, no. Not at all. I'd have the latest Ubuntu CD around (almost always less than 6 months old), or if all my copies were out on loan, I could prepare another by using WinXP to download a fresh Ubuntu image. That's the seven year old version of WinXP that is duly recognized by WGA, which I keep up to date on all security patches, and which has Microsoft's firewall and antivirus products enabled. Reinstalling Ubuntu and updating its security is a turnkey operation, and fast enough that the risk of getting pwned is minimal. Especially since there are few pieces of malware that are aimed at Linux.

Ubuntu just doesn't have the security issues that Windows has.

Re:How is this measured

[cbhacking]

I realize you're being humorous, but for those here who don't - Storm spreads through trojans. Every form of installer for it that I've discovered requires at least some user interaction, usually as Administrator (no, I don't even run XP as admin - though I realize that's not the default).

Re:How is this measured

[Anonymous Coward]

Well done. The check's in the mail.

Re:How is this measured

[Nos.]

It doesn't matter how few security issues have been found in whatever OS you're trying to install. Patching of a newly installed OS should always be done before it is exposed to the Internet.

Re:How is this measured

[Droulic]

I have acces to 17 computers at home. WIN 9x NT 2000 XP 2003 Vista, MAC, Ubuntu, SUSE, FreeBSD, BeOS. Even still have a Warp 4 pc. Oops, shouldn't have gave that away.

Re:How is this measured

[InvisiBill]

This nat router, is this the usual linksys or dlink router, or are you talking about corporate level only?

Any NAT router. While an expensive business router should be higher quality and less vulnerable to attacks against it, the whole idea of NAT is what protects the PCs behind it. http://www.grc.com/nat/nat.htm explains it pretty well.

Re:How is this measured

[hesaigo999ca]

so , does this include linksis or dlink routers bought at compusa or bestbuy?

Re:How is this measured

[kesuki]

"A hardware firewall (think: $40 Linksys router) is 100% effective at blocking the inbound threats during download of SP2."

another myth. I was pwned in 2006 behind a linksys with current firmware by hackers.

if you want a real firewall, one that is half-open, for free, get smoothwall.

the problem with linksys firewalls is that a single forged packet can penetrate, it tells the firewall it is a 'response' (aka an ack) to a mythical outbound packet, because linksys fire walls are 'full open' a simple ack will open any port inbound, the same problem affects 'windows firewall' with SP2 only a half open firewall denies non-allowed ports (using a pure whitelist of approved ports.)

did i mention the hackers in 2006 that pwned me used a polymorphic rootkit, with bios level infection, that is also capable of corrupting writable DVD and CD media? yeah i spent about 9 months trying to recover from the problem.

Re:How is this measured

[JoeMerchant]

Good to know - on the practical side, I've had an XP box, unpatched from Jan 2006 until about two weeks ago, sitting wide open behind the Linksys with about 95% uptime. Nothing found it.

It might help that I've gone to a non-standard sub-net, and I occasionally moved the internal IP around - it wasn't always at 192.168.0.100 - but otherwise, there wasn't any protection.

I guess you got hit by someone serious, most of the 5kr1pt k1dd135 aren't that sophisticated.

Re:How is this measured

[kesuki]

well, you claim your system is clean, but the fact is, polymorphic rootkits are absolutely undetectable from within the operating system. do you really know it's clean? or do you just know, they're not running a bot on your system?

and being able to send a packet in, isn't the same as being able to infect a machine. In my case the hacker knew what software i was running, and was able to send the packet in, and take advantage of a known vulnerability.

here's the upshot, once he hacked my windows system he hacked my linksys with a custom firmware. I could immediately tell because it powered up the lights differently after he hacked it. (i didn't have a really secure password on the linksys, i thought 'it can only be flashed from the inside, so i don't need a good password')

Re:How is this measured

[Anonymous Coward]

Ah! - feeling confident now - I do have a real password on my router (seemed a sensible thing to do....), and no, I don't know if there's a quiet root kit in the system, but if it's there, it's well behaved - no visible use of network or cpu - no funny charges on our credit cards - and there's not really anything to steal on the PC anyway besides photos that are mostly posted on the web anyway....

Re:How is this measured

[mgcarley]

Last time I re-installed Windows was early 2006: I had an XP SP1 disc. Time to be owned: approximately 4 *seconds* (10MBPS public facing LAN connection to the internet, no router or anything in between)

I had to download XP SP2, AV software, Firewall program etc while putting up with popups, then, save those to a separate partition, nuke the Windows install and start *again* (this time installing the AV and firewall software before plugging in the cable again)

Honeynet

[Architect_sasyr]

Didn't the honey project provide us this exact same information a few years ago?

Re:Honeynet

[jd]

The fact that another Slashdot reader queried my insistence Windows 7 should have better host and network security is proof that there is still rampant ignorance on the subject. The fact that the time-to-pwn has not fallen over the past four years despite "security fixes" and security engines that inconvenience users and break applications is proof that the security methods employed by Microsoft are a failure. The fact that there is virtually nothing mainstream in the Windows world that compares with even the pittance of auditing offered by SARA and TARA is proof that there is no desire to fix this.

Re:Honeynet

[EvanED]

The fact that the time-to-pwn has not fallen over the past four years...

Pray tell what has happened to the base Windows installation over the past for years? Those security fixes you mention aren't counted in this time, so you can't claim that they aren't contributing to overall security. From the article (sort of ) it sounds like this is still the time for XP and not Vista (though since neither the summary nor either linked article actually says or anything, so I'm not sure). So why, exactly, should we have expected the time to decrease?

Re:Honeynet

[neokushan]

How can you say this shows no improvement over the last 4 years when the test subject was an UNPATCHED version of Windows?
The article wasn't even particularly clear if it was good ol' Vanilla XP or XP SP2 or whatever.

Re:Honeynet

[willyhill]

One question though - why exactly would I face out a machine with an unpatched OS (the "article" doesn't even mention the version), any OS?

Especially since a $20 Linksys router solves my problems, assuming I'm unable to splipstream service packs or errata or whatever?

If this is Windows XP, why isn't there an article on the time-to-own for an unpatched RedHat 8 install? Do I not have to go online to download the errata for that one as well? Or even the new version?

Even with the larger number of exploits for Windows vs Linux, that doesn't mean there are no exploits for Linux. So I have 20 minutes to download my patches, instead of 5? And that's some sort of median, right? Wow, that sure sounds a lot safer. I hope I make it.

This "metric" is like measuring how deep a machete can cut into your leg, or how much chlorine bleach you can chug before doubling over. Useful? Sure. Should you try it? Nope. With *any* operating system. Not even with any of the *BSDs, which I tend to trust a hell of a lot more than most Linux distros nowadays.

Looks like a slow news night for Slashdot, as usual.

Re:Honeynet

[ozmanjusri]

If this is Windows XP, why isn't there an article on the time-to-own for an unpatched RedHat 8 install?

Can you still buy Redhat 8?

Re:Honeynet

[jcupitt65]

One question though - why exactly would I face out a machine with an unpatched OS (the "article" doesn't even mention the version), any OS?

Because that's the version of Windows that (just about, I think, for now) Microsoft still sell. If you buy a copy of XP it really is unpatched. You need to either download the patches from a secure machine and slipstream them on to your own install disc, or you need to make sure you're behind a good firewall before you plug your fresh machine into the net and do an update.

When you download a Linux ISO, it already has all (or most) of the latest patches applied. In effect, they slipstream them on for you. If you but a CD ina shop, it will typically not be more than 6 to 12 months old, since that's the cycle time of most distros, and will not have so many patches to apply.

Of course XP SP2 is pretty old now. I wonder if Vista SP1 would get broken in to? Probably not.

Re:Honeynet

[EvanED]

Because that's the version of Windows that (just about, I think, for now) Microsoft still sell.

As I've said a few times, in the absence of information I would expect to see (the article is deficient in actual information about what it is they are measuring), I suspect this is pre-SP2 XP. You haven't been able to buy that for years. (Or at least MS hasn't printed it for years.)

Re:Honeynet

[bloodninja]

If this is Windows XP, why isn't there an article on the time-to-own for an unpatched RedHat 8 install?

Can you still buy Redhat 8?

Can you still buy Windows XP?

Re:Honeynet

[Mistlefoot]

You say "The fact that the time-to-pwn has not fallen over the past four years despite "security fixes" and security engines that inconvenience users and break applications is proof that the security methods employed by Microsoft are a failure."

Yet the article is about "the time to infection of an unpatched Windows machine" and by unpatched they mean pre-SP2. ie, software from the year 2000. The security fixes that you refer to are not included on the OS in this study.

Re:Honeynet

[ozmanjusri]

Can you still buy Windows XP?

Yes. Of course.

Re:Honeynet

[jcupitt65]

Yes, that would pretty much invalidate their findings if true. I looked through the German article but couldn't see the information there either.

Re:Honeynet

[ydrol]

But it has SP2 (look at picture).

Re:Honeynet

[hairyfeet]

Considering that one of their "security" links is referencing XP SP1,I would say the data was pretty old. I know we used to hook XP SP2 machines straight in my last shop and after patches always did an online scan and I can't remember the scan ever finding anything. If they want to be taken seriously on the subject,they should list specific service pack,PC specs,and connection used. Then their data would be easily replicable if someone disputed their findings.

Re:Honeynet

[hairyfeet]

Not to mention when I went to Newegg to build a machine for a client nearly all the OEM XP discs had SP3. So is there anyplace that has done this with SP3? SP2? Basing any test on XP SP1 is pretty pointless,as a PC repairman I haven't actually seen SP1 in the wild,either installed or on a clients CD,in at least a couple of years. But as always that is my 02c based on my observations,YMMV

Re:Honeynet

[neokushan]

Exactly. Saying an unpatched OS is vulnerable to attack is like saying an unlocked Car is liable to be stolen.
I'm not even sure what it is they're trying to prove - that Microsoft can't bend time and space and retroactively patch ALL XP disks every time they release an update?

This actually got me thinking, even Linux has it's vulnerabilities from time to time, but I could argue it's MORE vulnerable because of all those Ubuntu Live CD's people have lying around. I've known a few people that have resorted to one of these Live CD's in times of dire need (i.e. when windows has decided to break) and one guy even used one for a few months because his HDD died on him - but how do you patch THOSE?
Luckily, Linux is pretty good at not getting owned so it's a bit of a non-issue at the moment, but I dare say it's only a matter of time before someone starts targeting them as well.

Re:Honeynet

[amazeofdeath]

Here you go: http://www.ebuyer.com/product/114048

Re:Honeynet

[Anonymous Coward]

Mebbe. http://www.newegg.com/Product/Product.aspx?Item=N82E16832116515

Re:Honeynet

[Mattsson]

One of the problems with windows is that I, as a license owner but not a MSDN-licensee, can not download an updated version of the windows install-cd.
When doing a new RedHat installation, I can easily go to their web-site and download the latest version.
I can of course download the patches and then slipstream a pre-patched XP cd, but this is a more complex operation than simply downloading an .iso and burn it before making a new installation.

Burning a cd is a mainstream, average computer-user operation.
Slipstreaming a servicepack is not.

Re:Honeynet

[tepples]

Saying an unpatched OS is vulnerable to attack is like saying an unlocked Car is liable to be stolen.

No, it's more like saying that a car is likely to be stolen before the locksmith has a chance to install locks.

Re:Honeynet

[tinkerghost]

This actually got me thinking, even Linux has it's vulnerabilities from time to time, but I could argue it's MORE vulnerable because of all those Ubuntu Live CD's people have lying around. I've known a few people that have resorted to one of these Live CD's in times of dire need (i.e. when windows has decided to break) and one guy even used one for a few months because his HDD died on him - but how do you patch THOSE?

Why would you bother? A live CD can only be infected upon creation. After that, any infection is automatically removed when the computer is shut down & the ramdisk is closed.

As for using an old disk for installs, the big advantage is that most Linux install CD's assume you know what your doing & have a minimum of exposure - letting you install/start the services you need. From my experience, MS turns most of the stuff on, presumably on the theory you're too stupid to do it yourself if you should ever want to.

Re:Honeynet

[neokushan]

Does it matter that the infection is removed upon shutdown? Assuming the author doesn't just overwrite a bootloader or something just as sinister, even temporary access to a fresh boot of a LiveCD could still be enough to swipe some credit card details or something.
ANY kind of system access is bad, no matter how long it might last.

Re:Honeynet

[Anonymous Coward]

Exactly, pretty soon they will be hacking the live CDs and installing rootkits right on the cdROM disk. Then the next computer you use the livecd on will be infected. Oh, why couldn't people make liveCDs on some kind of read-only media.

Re:Honeynet

[dontPanik]

They're trying to prove that if you put an unpatched windows computer on the internet, it will get pwned mercilessly!
So...don't!

Re:Honeynet

[Anonymous Coward]

No, you buy XP SP2 (at worst).

Re:Honeynet

[sootman]

Linux is pretty good at not getting owned so it's a bit of a non-issue at the moment, but I dare say it's only a matter of time before someone starts targeting them as well.

100% true. OTOH, I've been hearing that for ten years now. As a practical matter, I'll continue to use various non-Windows OSs without worrying about vulnerabilities day-in, day-out. It's the difference between living in a decent neighborhood where you lock your door each night, versus living in Cracktown and sleeping with one eye open and a handgun under your pillow.

Re:Honeynet

[Whatsisname]

Unless you mount available disks and begin trashing them....

Re:Honeynet

[Anonymous Coward]

This project also uses honeypots - not Windows machines at all. Here's a comment by the blog author:

Yonah, if you read the blog posting things should be more clear: "For example, we can use low-interaction honeypot such as nepenthes or amun that emulate common network-based vulnerabilities and deploy them at different locations."

Thus we did not use native machines, but low-interaction honeypots that emulate different kinds of exploits. You can find more information about these tools at http://nepenthes.mwcollect.org/ and http://amunhoney.sf.net/ - hope this helps to understand the results a bit better.

It's not clear exactly which version of Windows they are emulating, but this later quote makes it clear that he's not talking about Vista or XP SP2:

Furthermore, I think that Microsoft does take security seriously in 2008: A Vista machine would presumably survive without any problems and also XP SP3 would survive for a long time. Remember: These statistics are for old exploits against unpatched systems (emulated by honeypots).

This means that you can't even buy a version of the software that's being tested. This is a fairly salient point, but salient points don't make for good Slashdot stories.

Re:Honeynet

[Anonymous Coward]

Gah, you should be stripped of right to post on slashdot in future, because you are clearly too stupid.

"A live CD can only be infected upon creation. After that, any infection is automatically removed when the computer is shut down & the ramdisk is closed."
Have you forgotten live CD do have access to the hard disks?

Re:Honeynet

[Anonymous Coward]

"Luckily, Linux is pretty good at not getting owned so it's a bit of a non-issue at the moment, but I dare say it's only a matter of time before someone starts targeting them as well." - by neokushan (932374) on Tuesday July 15, @06:12AM (#24193515)

Take a read(s), it's happened PLENTY of times, & Linux (even SeLinux bearing distros in their DEFAULT config) aren't somekind of "magical panacea", either:

----

Critical Security Hole in Linux Wi-Fi:

http://it.slashdot.org/article.pl?sid=07/04/15/1515259

Linux Kernel 2.6 Local Root Exploit:

http://it.slashdot.org/it/08/02/10/2011257.shtml

Major Security Hole In Samsung Linux Drivers:

http://it.slashdot.org/it/07/07/18/0319203.shtml :

http://it.slashdot.org/it/08/01/24/1930207.shtml

Mystery Malware Affecting Linux/Apache Web Servers:

http://it.slashdot.org/it/06/10/03/2122220.shtml

SUSE Security Announcement: lprold (SUSE-SA:2003:0014):

http://www.novell.com/linux/security/advisories/2003_014_lprold.html

----

* That's just some (some might be patched now though, I did not check, but point is? They happen - bugs/vulns on *NIX period)... you weren't nearly as 'bad' as some Linux Penguin fanboys, but, I felt obligated to put out some data that keeps even your mild & actually decent reply, in check, to some degree (pointing out that Linux is NOT the "magic bullet"... heck, even BSD distros aren't).

APK

P.S.=> There's plenty more over @ SECUNIA.com for intance, in case you're interested, that's MORE CURRENT... open security vulnerablities are present in Linux still... e.g.->

http://secunia.com/search/?search=LINUX&w=1

You *NIX guys always try to "cut up" Windows on this note, but you often fail to acknowledge your systems/OS of choice is far from 100% "bugfree & bulletproof" too... apk

Re:Honeynet

[hairyfeet]

Well,you really should be worried,because your Realtor is trying to sell all the houses around you to clueless home owners that will fall for any con man,so the cons WILL be looking at your neighborhood. Do you really think you can have a "Windows replacement" Linux distro that doesn't have everything work automagically without the clueless user having to turn on services? Because otherwise you get companies saying Linux isn't worth the hassle and let us not forget that the bad guys can just bypass the OS and own the hardware directly,so security should be a concern to us all,REGARDLESS of OS used.

And as for the earlier poster and all the talk of old live CDs? When you use a live CD there is almost always a HDD hooked up and running in that PC. It may not be used by the OS,but Linux has had read/write NTFS access for awhile now,and of course read/write to Linux FS. If a bug takes over via and old unpatched vulnerability it wouldn't be hard to write the bug to the HDD. You could even write multiple bugs so that no matter what the underlying OS was you could still take control upon startup. After all,it isn't like the OS directories in Windows and Linux are in secret locations. But as always this is my 02c,YMMV

Re:Honeynet

[tinkerghost]

Have you forgotten live CD do have access to the hard disks?

Usually not. Most of the Live CDs don't mount the HDDs by default - and design. Unless your infection is going to mount the HDDs automagically or do block level work through /dev, most uses of a Live CD won't have access to a HDD.

If you're technically savvy enough to be working your way through a recovery using a live CD, you are also, almost certainly, savvy enough to be hiding behind an external firewall or without a network.

Is it potentially a real world problem - sure, but I'm not going to rebuild my utility CD's every time theres a new vulnerability patch. At work,I've got border virus scanning and border security, I've got AV & system monitor software, & I've got network traffic monitors. If somethings running around in my network & I don't know about it yet, an up to date Live CD isn't going to help me. At home, I've got a much more basic system w/ a router & AV software on everything & just some basic net traffic software.

I know I'm not an edge case in either place. From logs, I would say that a basic router catches & drops 95+% of the shit that would hit an unprotected system - and a good percentage of the remaining 5% is crap targeted at owning the router itself. So as long as you're behind an external firewall - almost everyone on broadband now days - you're probably just about as safe with an older live CD as you are with a new one.

In the event of not having an external firewall, well, for the most part, you're still more secure with an old Linux Live CD than you are with a current copy of Windows - simply from a volume of attack perspective.

In short, I'm not an idiot, I am a realist looking at the fact that most viri are built to attack the mounted filesystem - not go after block level edits of a random drive. Since any successful attempt at altering the mounted system will be reset after a reboot, the potential for long term damage is minimized. If you want to chase edge case infection scenarios go right ahead - but if you're planning for them, you're also not going to use a live CD.

Re:Honeynet

[dotancohen]

Please don't cloud /. with facts.

Re:Honeynet

[jd]

Find me SARA and TARA - or comparable tools - for Windows, and then I'll be able to actually tell you what has happened to Windows base install over the past four years. Without auditing tools, how am I supposed to know? Telepathy? The base install for Windows has gone from XP to XP-SP1 to XP-SP2 in those years - it's not the same program - but I cannot tell you if any meaningful security holes are fixed without the software tools to do so, and to hell with buying something like N-Circle - it's good, but it's more than I'm willing to pay for a one-shot security eval in order to reply to a Slashdot poster.

Re:Honeynet

[Allador]

The fact that the time-to-pwn has not fallen over the past four years despite "security fixes" and security engines that inconvenience users and break applications is proof that the security methods employed by Microsoft are a failure.

It's fallen hugely.

Most windows boxen since XP SP2 are completely safe to put out on the internet in default config.

Now you wouldnt want to go browsing anything except MS update with IE before you patch, but thats different than an 'auto-own' scenario being described here.

Re:Honeynet

[mjwx]

I can still get it pre installed on all Dell Vostro Latitude and Precision laptops (and if you're not looking in the small business section you deserve to get ripped off).

Realistically you haven't been able to buy XP since Nov 2006 as every license of Windows Desktop OS sold since then has been vista with various downgrade rights used (how do you think MS has been able to claim such fantastic sales figures for Vista), it's not just Hollywood that has a creative accounting department.

Re:Honeynet

[willyhill]

If you mean that as a clever way of saying you can't buy Windows XP, you are incorrect as I'm sure you know.

Re:Honeynet

[Anonymous Coward]

but I dare say it's only a matter of time before someone starts targeting them as well.

Linux is HEAVILY targetted. But, the attacks are 1) Dictionary attacks via ssh, looking for poorly-passworded accounts. 2) Attempts to pwn via webapps, PHP, MySQL. LiveCDs and desktops do not ship with ssh, mysql, or php enabled (if they have them at all, as opposed to requiring the packages to be added on later).. practically the only service enabled might be cups, and if it's network-enabled at all, is limited to the local subnet. There's ALSO stack-smashing protection on most if not all modern distros, so attempts to pwn via buffer overflows etc. would crash an app rather than pwn it (both a non-executable stack, and process address randomization). Servers? ssh isn't a REAL problem, passwd command complains "Your password is too weak!" if you have the kind of password a dictionary attack would find. SSH, PHP, MySQL, and some webapps would all be updated via package manager (I guess getting you into the "race against time" similar to Windows & Windows Update, if you had a severely holed app...); the main hole is custom webapps though. Best keep those up to date!

Re:Honeynet

[cbhacking]

More specifically, can you still buy Windows XP RTM (SP0).

No, of course not. SP2 and above have the firewall enabled by default, and many fewer vulnerabilities anyhow.

Doesn't make sense

[kaos07]

Man this doesn't make sense. So what, are they saying that as soon as you plug in your modem to the PC thousands of different sources are already trying to infect you? Even if you don't browse? Because the point is you can download Windows Updates and you can install and update your AV with only two connections. Not sure how you're going to get infected that way.

Of course it could just be "Windows users can't resist dodgy porn sites for more than 4 minutes". Which makes more sense. I mean, when you've just gotten access to the internet what's the first thing you do? Hot Busty Nurses > Slashdot.

Re:Doesn't make sense

[FluffyWithTeeth]

There are plenty of botnets that just scan and attack ip blocks. I'd imagine the frequency of attacks depends on country and whatnot.

Re:Doesn't make sense

[thona]

That makes a lot of sense - because that is exactly what happens. Tons of bots around trying to get into "known and patched for years" exploits. They jsut scan IP Address ranges for computer to come online. So, really - no browsing required. No user action required. They happily come to you. This is why a simple firewall like the one you have now on Windows (allow only outgoing connections by default) or simple NAT ALREADY raises quite a bar in security - there ARE, HAVE BEEN and WILL BE exploits that do not require any user interaction.

Re:Doesn't make sense

[kitgerrits]

No, this type of infection is sent to random computers all over the Internet.
If one computer on the same IP range as you if infected, it will try to infect all computers on the same IP range and continue to try until someone either turns off the PC or formats the harddrive.

Try installing a firewall, connecting a computer directly to the Internet (don't -do- anything, just connect it) and then Wireshark to look at your Network Interface.
You'll be surprised at the stuff you get without asking.

Re:Doesn't make sense

[MadMidnightBomber]

Exactly. It used to be a real problem, and at my uni in 2003 or so, I'd insist everyone built their servers and patched them offline. Some didn't listen to me and got owned during install.

These days, you turn on the firewall on XP SP2 or 2003 and don't have the problem. (As the OP said, just don't browse the web while you're doing a server install.)

cheers,

Re:Doesn't make sense

[Anonymous Coward]

You don't even need to turn it on; with SP2 it's on by default. The same with Vista. Yet the compromised machines had the Windows firewall turned off. So it's kind of a bogus test, because XP doesn't ship without SP2 any more, and ships with the firewall on by default.

Re:Doesn't make sense

[gmuslera]

My firewall logs at least are pretty spammy with what are stopping at all hours.

Not sure if my netblock is relatively quiet or active, but got 14 test of 9 different ips to 9 different ports in a random chosen 10 minutes interval. If any vulnerability was there, i had no need to browse or do anything more than just get connected to get infected/exploited/botnetted.

Re:Doesn't make sense

[Max Littlemore]

What doesn't make sense to me is the editorial standards on /.

The title should be "Estimating the 71m32pwn of an Unpatched Windows PC.

Really, the standard is slipping.

Re:Doesn't make sense

[sowth]

I'm going to jump in, because I don't think anyone explained this.

Windows runs lots of services (server programs) by default, some of which have vulnerabilities. Some of which can't be turned off, because of the way MS programmed them. If you wonder why they are there, this is how things like filesharing works: it has a server program which will reply when someone else on the lan broadcasts asking for other shares. If someone creates specially formed packets, they can break into those vulnerable services, and you are rooted.

There could also be vulnerablilities in the kernel (main system), but they are rare. You could also be infected if you opened up a shared folder, and someone / a program uploads a hostile program to it, and you run that program.

This is in addition to getting infected by visiting a hostile site with an insecure browser.

I may not have explained this very well, but hopefully you get the idea.

Re:Doesn't make sense

[NickCatal]

I was thinking the same way

For instance, I had a Windows XP machine with the latest updates setup as the DMZ host for YEARS and I *NEVER* got compromised in any way. And this is with no anti-virus or firewall. I used this thing for all of watching movies, so if it got hacked I would just reformat the thing. Every so often I would come back and run a virus scan (not norton or mcafee, but like NOD or Kaspersky) I would not find a single thing.

Not once, not ever.

EVER

Now spyware/adware I watched crop up constantly. Those anti-virus programs would find that all over. But that is mostly from downloading it unknowingly or just being careless.

Now go on my parent's computers and it is full of crap that they downloaded. They were behind NAT the entire time.

Re:Doesn't make sense

[NickCatal]

I might add that this machine was recently reformatted and is safely behind NAT and I use it to only play music and host media files, so trying to compromise it now would be... difficult.

Re:Doesn't make sense

[Opportunist]

What's cooking here is worms. Those pesky little things that don't wait for you to click on an infected program but use security holes in your RPC to infect you. XP pre-SP2 was notorious for such a security hole, and my firewall logs tell me that such machines are still widely in use on the internet.

As I stated above, it took less than 2 minutes with SP1 in 2004. I should repeat that test, I wonder if it changed in the past 4 years.

Bottom line of it all, a router for 20 bucks can already solve that problem if it's configured to drop any incoming packets (which it is by default). An expense of 20 bucks is all that keeps Joe Average from defeating about 99% of today's worms. I know of a few POCs that can actually find ways around this, but so far I'm not aware of any widespread use of any of those.

Re:Doesn't make sense

[Opportunist]

Actually there was a security hole in the ... GDI I think, someone with better memory correct me... concerning icons. You could create a file with a bogus icon which triggered a buffer overflow, executing malware. Since Explorer uses those icons to display the content of folders, opening a folder containing such an icon caused the GDI32.DLL loaded in Explorer to read the bogus icon, try to interpret it, run the buffer overflow and the exploit was run with the rights Explorer had (in other words, pretty much top level privileges).

So just browsing to a folder containing such a file was enough. MS patched this security hole afaik, though.

Re:Doesn't make sense

[Opportunist]

I had a Windows XP machine with the latest updates setup as the DMZ host

You just explained why you never had malware.

If everyone would do that, we'd have far less troubles. But you have people without a clue cluttering the internet. They don't have routers (let's not even think about DMZ, they probably think that's a subdivision of the DMV), because "what do I need a router for, I only have one machine". They don't patch their Windows because it's a ripped copy and they think MS comes to kick down their doors as soon as they try to download any. If they even get the idea that you should maybe patch your system once in a while. "Why should I? It's running fine. A bit slowly maybe... but hey, old systems might just get slower, just like cars need more oil after a while".

And so you have machines blasting out ancient worms to the net. I still get firewall log entries of worms that came out in 2001. They're still going strong. You'd think people would start to ponder that something might be wrong when they get spammed with popups for trojan sites that don't even exist anymore for half a decade, but it seems they think such popups are normal and they have to bear them for some odd reason.

Telling them to reinstall their system won't do jack. They will attach the same unpatched machine again to the net and be installed in a flash again. They don't seem to learn. A router for 20 bucks would already solve 99% of their problems, but they just don't want to make this purchase.

Re:Doesn't make sense

[bloodninja]

As the OP said, just don't browse the web while you're doing a server install.

Yeah, let's see YOU install Gentoo without browsing the web.

Re:Doesn't make sense

[1u3hr]

Try installing a firewall, connecting a computer directly to the Internet (don't -do- anything, just connect it) and then Wireshark to look at your Network Interface. You'll be surprised at the stuff you get without asking.

Before I got a router, I did have the ZoneAlarm firewall. Just looking at its logs showed probeson various odd ports every few seconds. After getting a router, hardly anything gets through to be even logged.

Re:Doesn't make sense

[NickCatal]

Remember, this is DMZ host as in Consumer Router DMZ host. Open to all inbound internet traffic.

Re:Doesn't make sense

[Stooshie]

... So what, are they saying that as soon as you plug in your modem to the PC thousands of different sources are already trying to infect you? ...

Yes! Iinstall a firewall and just watch the log file. Your machine is probably scanned around once every 20 seconds by some botnet or other.

Re:Doesn't make sense

[Stooshie]

... but they just don't want to make this purchase ...

They won't even install AVG/Spybot/Comodo or some other free combo.

Re:Doesn't make sense

[Anonymous Coward]

It makes very much sense indeed.

You don't have to initiate any connections in order to have your system infected. Ever heard about an ip-scanner? Lots of botnets do just that: Scan for open ports on a range of ip-adresses and dump their nasties on unprotected systems.

Re:Doesn't make sense

[smoker2]

206.53.51.217 - - [13/Jul/2008:09:20:17 +0100] "GET /phpMyAdmin-2.7.6-rc1/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:18 +0100] "GET /phpMyAdmin-2.7.7-rc1/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:18 +0100] "GET /phpMyAdmin-2.7.0-rc2/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:18 +0100] "GET /phpMyAdmin-2.7.1-rc2/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:18 +0100] "GET /phpMyAdmin-2.7.2-rc2/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:18 +0100] "GET /phpMyAdmin-2.7.3-rc2/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:18 +0100] "GET /phpMyAdmin-2.7.4-rc2/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:18 +0100] "GET /phpMyAdmin-2.7.5-rc2/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:18 +0100] "GET /phpMyAdmin-2.7.6-rc2/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:18 +0100] "GET /phpMyAdmin-2.7.7-rc2/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:18 +0100] "GET /phpMyAdmin-2.7.0-rc3/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:18 +0100] "GET /phpMyAdmin-2.7.1-rc3/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:19 +0100] "GET /phpMyAdmin-2.7.2-rc3/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:19 +0100] "GET /phpMyAdmin-2.7.3-rc3/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:19 +0100] "GET /phpMyAdmin-2.7.4-rc3/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:19 +0100] "GET /phpMyAdmin-2.7.5-rc3/main.phpmain.php HTTP/1.0" 404 305 "-" "-"
206.53.51.217 - - [13/Jul/2008:09:20:19 +0100] "GET /phpMyAdmin-2.7.6-rc3/main.phpmain.php HTTP/1.0" 404 305 "-" "-"

That is a short (1.5 second) excerpt from my linux servers httpd access log. This "attack" ran for around 5 minutes making around 3600 attempts. Then the ip address changed and the attack restarted. This is a more or less constant process.
I used to have a lot of log entries where windows commands and processes were targeted, but I mostly got control of that by blocking IPs as they appeared.
If you think windows is immune to these attacks, then you are (a)very young, (b)inexperienced, (c)stupid.

Re:Doesn't make sense

[ThePhilips]

Wasn't measuring recently.

In worst times, I had seen one exploit attempt per 10 seconds on average. Since I have seen this all from pov of Linux router/firewall for sub-C net with 30 IPs, the logs were pretty messy and I had to do special script to clean syslog.

Right now my friend was setting up for himself firewall too and was seeing about 1 exploit attempt per 1-2 minutes.

That's Windows side.

On Linux side this isn't much prettier. In past some botnets from South Korea were dumbly scanning whole net trying to probe well known services (ssh, rsh, telnet, mysql, etc) as root with well knows passwords. I had something like 20-30 "auth failed" per minute in my syslog. Right now still some botnets try to scan *nix systems with weak passwords continuously. It is not as bad as it was with attack from SK, still I'm not leaving SSH running on port 22 anymore (just in case).

Re:Doesn't make sense

[X3J11]

Close. It was the GDI+ library.

On September 14, 2004, a vulnerability in GDI+ and other graphics APIs was discovered related to a defect in the standard JPEG library. It allowed arbitrary code execution on any system that displayed a malicious JPEG file using a tool that used the decoder in GDI+.[1][2] A patch was released to fix the issue on October 12, 2004. (from here)

Since one can use a JPEG for the folder icon, and presumably Windows uses GDI+ to decode them, placing a malformed folder.jpg in any directory could trigger it.

Re:Doesn't make sense

[flahwho]

port sniffing

Re:Doesn't make sense

[Culture20]

worms my friend. The _real_ virtual kind, not the fake virtual kind where user intervention is required. Plug a box in, it gets owned. A poor grad student I worked with five years ago learned that the hard way two times in four hours. Fresh install of XP sp1 on her laptop, connected to internet for updates, owned. Ditto a couple hours later. When she came to me I gave her my CD with technet downloaded patches & the batch files (some patches really required reboots back then) that installed them.

Re:Doesn't make sense

[MadMidnightBomber]

*giggle* Reminds me of the time I hosed my laptop so thoroughly I only had 'ed' to recover /etc/fstab. Had to browse the ed man page with one laptop while working on the other.

Re:Doesn't make sense

[sowth]

Yes, good point. Malformed files can potentially attack any program with buffer overflow bugs and other security holes. This is why it is important to run programs as a separate user. I usually try to have one account for network facing programs, and one for important files. That way, not only will an attacker have trouble taking over my system, but she will not be able to mess with important work.

I also try not to compile programs as root (only run install). I remember hearing about one open source project who were cracked, and the script kiddie put some sort of nasty code into the configure script. People who compiled as a lesser user didn't get the trojan installed. For a while, I created a special admin user just for installing. It had permissions to write files in /usr/bin /usr/lib and such, but not /etc or /bin. This wasn't supported by my distro though (ownership was clobbered every time I installed a package), so I gave up.

These procedures are not bulletproof, but is better than nothing.

Um, what version?

[EvanED]

You think either the summary or the linked article would have been kind enough to say what version of Windows.

From the link that goes here (linked from the first linked page) it looks like Windows XP. Would be interesting to compare with Vista.

Re:Um, what version?

[Anonymous Coward]

Would be interesting to compare with Vista.

They tried. They ran into some obscure bug with Vista that prevents it from accessing the internet while the machine is powered on.

Re:Um, what version?

[IntlHarvester]

XP SP2 comes with a firewall on by default. Vista comes with a firewall on by default.

This is only seems interesting if you're installing from your vintage 2001 XP disk.

Re:Um, what version?

[EvanED]

Which is exactly my point. We know those machines get pwned quickly, so why is this news? The /. summary presents it as if it's a current measurement of a current OS and not one that was superseded almost four years ago? (Assuming they are using a pre-SP2 install. Which, since the site doesn't give any actual information, I don't know.)

Re:Um, what version?

[Computershack]

Which is exactly my point. We know those machines get pwned quickly, so why is this news?

Because it's about Windows and in the current trend, you don't have to bother on /. with little annoyances like facts and the truth if it's to do with Microsoft - any old shite will do if it is trying to make Microsoft look bad.

Yet you'll notice that the /. crowd isn't bleating on about the 33 year old Unix bug that's only just been fixed this week.

Re:Um, what version?

[Opportunist]

Which is pretty much what most people do. They don't know how to "roll your own" system, with SP2 installed and all. They already consider themselves power users (what a term... but whatever) if they can slip in that XP SP1 CD they got with their computer and reinstall the system without trashing their data.

The problem is just that, that most people only have ancient versions to install their system with, and no idea how they could create a better, more secure version that doesn't need 5 hours of update cycles before they may attach it to anything that could remotely be considered "evil".

Re:Um, what version?

[EvanED]

Which is pretty much what most people do. They don't know how to "roll your own" system, with SP2 installed and all. ... The problem is just that, that most people only have ancient versions to install

I agree to some extent, but MS has been pressing XP+SP2 discs for close to 4 years now. Considering it was less than that from initial release to SP2, probably around half of the XP discs (and hard drive restore partitions) that went out have SP2. Take into account that a lot of people would consider a 4-year-old computer pretty old and so would replace it, take into account that computer adoption increases over time, and I bet that at *least* 2/3 of XP installations today, not even counting new computers selling with it, are off of media that has SP2 and was not set up by the user to do so.

So I think it's a substantial problem, but at the same time, I think "most" people are SP2-safe.

Re:Um, what version?

[ozmanjusri]

Yet you'll notice that the /. crowd isn't bleating on about the 33 year old Unix bug that's only just been fixed this week.

Yes they did.

And you're seriously trying to compare a bug in a largely obsolete parser generator that only runs on one version of BSD, with an entire OS that's so poorly written that it can't even last 5 minutes without being pwned?

You evangelists are getting desperate. No wonder Microsoft is having to spend +$300 million to try to persuade MVPs not to abandon ship...

The time of worry is over.

Lol...

Re:Um, what version?

[johneee]

Well, given that the OS they're testing is the same as was used 4 years ago, the only variable is the environment they're putting it in, so the test (and the article reporting on the test) is interesting in how it reflects the current state of that environment rather than how it continues to reflect the state of the OS

Re:Um, what version?

[Opportunist]

I'm still running systems with XP that were originally installed as SP1. Yes, it is possible to run a Windows OS for more than 5 years.

Even though MS would love it if they didn't, people buy new hardware without buying a new OS immediately.

Not to mention that yes, there are even ancient machines running today. When all you do is "surfing", mailing and IMing with your friends, where's the need for a current machine? Any machine after 2000 will do. A machine of 2002 will certainly do. And those machines came with XP-SP1.

Re:Um, what version?

[EvanED]

I agree that it's a reasonable thing to test and report on, but /. did it very disingenuously IMO by not saying that it's an old version being tested. It's like me going around the comment areas posting saying that "Linux doesn't support my sound card, doesn't support RAID, has crappy desktop environments" etc. but not saying that I'm referring to the state when I first installed Linux in 2002 rather than what's going on now.

Re:Um, what version?

[EvanED]

Oh, I agree. I still have a box that first had XP from 2002 running, and it's only within the last year that XP has come to no longer live on it. But we're talking numbers here, which you started by saying that "most people only have ancient versions to install their system with". I think the majority swings the other way.

Baloney

[Anonymous Coward]

I am posting this message from a completely unpatched windows box on the Internet and I am not seeing any side eff....

Buy Viagra Cheap at http://myipaddres/viaga

Re:Baloney

[Anonymous Coward]

Pft. Newb. If you were smart, like me, you would have patched your Windows bo

Buy Viagra Cheap at http://myipaddres/viaga

Re:Baloney

[SurturZ]

Fools, don't you know that all you have to do is make sure you scan any flopp

Buy Viagra Cheap at http://myipaddres/viaga

Re:Baloney

[Exitar]

Haha, no problem for me with my Linux dis

Buy Viagra Cheap at http://myipaddres/viaga

Re:Baloney

[Anonymous Coward]

Well, once again, me and my Mac have been proven to be superi

Buy Viagra Cheap at http://myipaddres/viaga

Re:Baloney

[Anonymous Coward]

This reminds me, can your OS be shut off remotely? Because I just got a new dell, and I'm wondering if I install linux can dell jack my computer and turn it off remo

Re:Baloney

[EvanED]

Oops, sorry about that. I selected the wrong post in my post->IP reverser and hit you instead of Exitar. My bad.

Re:Baloney

[Anonymous Coward]

It's not just Dells.

Every Windows computer can be remotely controlled by Microsoft via a secret backdo

except Vista, which is perfect in every way. Such a thing of beauty, elegance and grace. An efficient user of resources and not at all irritating. BTW, have I mentioned what a dick Twitter is?

--
[twitter: Erris Mactrope gnutoo inTheLoo willeyhill westbake Odder ibane deadzero freenix myCopyWrong] See my homepage

Re:Baloney

[Exitar]

Hey, are you hitting on me?!?

Re:Baloney

[EvanED]

No, I'm not, but if you're looking for someone to, you might have some greater success if you get some Viagra.

Re:Baloney

[Anonymous Coward]

Sorry, the URL you listed seems to be down. Can you please be hacked correctly?

Thx

Re:Baloney

[Anonymous Coward]

Excuse me, I have no such problems with my Linu

Execute: SwarmMail(Buy Viagra Cheap at....)

Re:Baloney

[Anonymous Coward]

Haha, no problem for me with my Commodore 64

Buy Viagra Cheap at http://myipaddres/viaga [myipaddres]

Offline updates

[Fallen Andy]

For XP/Office/Vista, you owe it to yourself to use the Heise offline updates.

Back in '04 the time to live was (claimed to be) around 20 minutes. I wonder what the time is for an unpatched Vista (the figures in the article are for XP). Heh - I bet '98SE survives forever (nobody would want to exploit that).

Andy

Re:Offline updates

[Anonymous Coward]

For XP/Office/Vista, you owe it to yourself to use the Heise [heise.de] offline updates.

How do I access those without going online?

Burn them on a CD, you say? How do I do that? Connect the CD-burner to the modem, without using the computer?

Imagine that I only have one computer. Imagine it is brand new, and this is not a 5*Re trouble shooting session.

(5*Re: Retry - Reboot - Reinstall - Reformat - Redhat)

Re:Offline updates

[drx]

You could buy one of those Walmart Ubuntu CDs and download the patches from the LiveCD.

What constitutes an unpatched Windows system?

[Anonymous Coward]

Windows XP SP1? Windows 95? Windows 98? No, wait... Windows 3.1.1? Oh, I know! Windows 2000 SP3! Or was that Windows 2000 (Post SP4) Update Rollup 1 for W2K ver 2?

The related article didn't seem to mention what exactly constituted an "unpatched Windows system."

In the words of a Corellian...

[CriminalNerd]

"I like those odds."

Time-to-0wn with dumb NAT firewall

[billstewart]

The article recommends using a NAT firewall and a correctly configured personal firewall, and of course that's a good start (NAT is evil, but is generally a good starting place for devices that aren't running servers, and until you've got your system running the current patches, you don't want to be running servers at all, and even after that many client-like things work adequately behind NAT.)

But does anybody have any estimates of how long an unpatched machine will last behind a dumb NAT firewall? Are you ok at least until you've installed the standard patches for Windows (or your favorite Linux) and your favorite applications?

Re:Time-to-0wn with dumb NAT firewall

[JimboFBX]

A system behind a NAT device could sit forever because no incoming traffic would come to it without it making a connection request first. Just don't stick it in the DMZ until you have a firewall.

Re:Time-to-0wn with dumb NAT firewall

[totally bogus dude]

You should be perfectly safe, as a dumb NAT firewall won't be sending your PC any traffic that it didn't originate. The only possible vectors would be: a) if its connection tracking code gets confused and lets in traffic which it thinks is associated with another connection but really isn't, b) bugs in the NAT firewall device (pretty much the same thing), or c) an attacker gets very lucky with spoofing connections that happen to be in the NAT table (tremendously unlikely).

All up, the chances of anything getting through are pretty much negligible.

The caveat is that stuff on your PC may be making connections without your knowing; and in particular, some programs may use UPnP to open a listening port for incoming traffic. This shouldn't be an issue with an out-of-the-box install.

This is of course assuming the common NAT device setup, where you have your modem/router which gets a public IP address and then NATs all outbound traffic. Inbound traffic will hit the router and not go any further unless the user has explicitly set up forwarding rules on it.

Pretty much everyone with broadband in Australia will be behind such a device, as this is the kind of device most every ISP recommends or sells. Not sure what the norm is elsewhere in the world.

Re:Time-to-0wn with dumb NAT firewall

[Cramer]

Answer: Until the dump user clicks on the wrong attachment, etc. Browsing the web from an unpatched IE is asking for trouble. The same is true of unpatched Outlook and Outlook Express.

NAT cannot protect you from your own stupidity.

Re:Time-to-0wn with dumb NAT firewall

[Opportunist]

The remote attack vectors on a NATed system are few. Every normal SYNC attempt dies at the firewall (unless you configured it to forward ports, but let's assume you don't build the worm a tunnel). What can pass under certain circumstances are fragmented packets, but with NAT you still can't get far since you still don't exist in the NAT's table, so the packet won't go anywhere.

Re:Time-to-0wn with dumb NAT firewall

[Anonymous Coward]

There are a lot of these in the UK as well, though also some people using USB modems to connect directly. I'd recommend anyone with a home net connection having one of these.

I also turn off uPNP on mine, though on the most recent it was turned off out of the box.

Re:Time-to-0wn with dumb NAT firewall

[FireFury03]

A system behind a NAT device could sit forever because no incoming traffic would come to it without it making a connection request first.

Untrue.

For untargetted attacks, yes you'd be relatively safe. However, if someone is on the same global scope subnet (as is quite common in the case of cable connections), they can send packets into your network by addressing them to your internal (site-local scope) IP address and your router's MAC address.

What you need is a stateful firewall, which will actually block incoming connections - many NAT routers have no firewall and the only security you get is on the assumption that the router will never receive a packet destined for a private address.

Re:Time-to-0wn with dumb NAT firewall

[JimboFBX]

I think that only applies if your if your modem doubles as a firewall and has the firewall option turned off. Otherwise the MAC address should have nothing to do with it since NATs typically (although not always) use the port field to determine who goes to what. For example, I send information to w.x.y.z. When its sent, the source port on the packet is some random number, and the router keeps a table of what it assigned to what. When it receives a packet back from w.x.y.z, it looks at its destination port number and then converts the packet back and sends it back to the original computer. If it doesn't match anything on the table, then it assumes it was sent by mistake and discards the packet.

I suppose its all how you implement it though. We're probably both right in a sense.

Re:Time-to-0wn with dumb NAT firewall

[FireFury03]

I don't think you understood what I was saying.

Alice has a LAN with a computer on 192.168.0.1/24 and the router on 192.168.0.254/24. Alice's router's public address is 1.2.3.4/24 and the router's MAC address is c0:ff:ee:00:11:22.

Eve is on the same public subnet, with the address 1.2.3.100/24 (this is common when you are using cable instead of ADSL). Eve can send a packet addressed to 192.168.0.1 at MAC address c0:ff:ee:00:11:22. It will arrive at Alice's router, which will forward it to her computer.

It doesn't matter whether or not Alice's router is doing NAT since NAT only affects outgoing connections and this is an inbound connection - Alice's router is behaving as a normal IP router in this case. Most consumer NAT routers will do nothing to prevent this attack since they have no built in firewall (try it if you don't believe me).

Typical /. Hypocrisy!

[Anonymous Coward]

I keep hearing on /. about how slow Windows is. Now it turns out that Windows is very fast.

Re:Typical /. Hypocrisy!

[ya really]

Now it turns out that Windows is very fast.

Kinda like a high priced callgirl...and just as expensive to purchase.

Re:Typical /. Hypocrisy!

[pbhj]

Now it turns out that Windows is very fast.

Kinda like a high priced callgirl...and just as expensive to purchase.

But you only get to use windows for a couple of hours before you get a virus ... oh, wait ...

Re:Typical /. Hypocrisy!

[Ox0065]

Now it turns out that Windows is very fast.

Kinda like a high priced callgirl...and just as expensive to purchase.

But you only get to use windows for a couple of hours before you get a virus ... oh, wait ...

So wouldn't that make Windows more like a high priced 'crack ho'?

Re:Typical /. Hypocrisy!

[Anonymous Coward]

At work (right now) I have two inspiron 8600s, same specs and all. One boots to fedora 7, one boots to windows xp sp3. The windows box boots significantly faster and is generally more responsive. Every Monday I test boot times, just press the power simultaneously, and sure enough, windows boots+logs in+runs pidgin, outlook, and firefox before fedora reaches login.

I have to call BS

[Anonymous Coward]

I never patch my windows unless its a service pack and I run just fine... Always have my Antivirus running and Windows defender with a router with built-in firewall... No complaints for the 7 years since I built my pc....

Re:I have to call BS

[Anonymous Coward]

I never patch my windows unless its a service pack and I run just fine... Always have my Antivirus running and Windows defender with a router with built-in firewall... No complaints for the 7 years since I built my pc....

Indeed, your computer is a valued member of our botnet.

Re:I have to call BS

[CrackedButter]

I never patch my Mac unless its a point release and I run just fine... never used antivirus or any other program to shield me from the net... no complaints for the 5 year since I owned Mac's.

Re:I have to call BS

[fastest fascist]

Always have my Antivirus running and Windows defender with a router with built-in firewall...

Good for you, that's not what the article is about, though. The point is, a system NOT protected by a firewall or antivirus will get owned in about 4 minutes.

Re:I have to call BS

[IntlHarvester]

Point release for OS X is more like "Patch Tuesday" for Windows than a Service Pack. The GP is basically saying he goes years between patches, which I hope no Mac user would consider.

Re:I have to call BS

[maglor_83]

Good for you, that's not what the article is about, though. The point is, a system NOT protected by a firewall or antivirus will get owned in about 4 minutes.

Which is kinda moot since you can't buy Windows without firewall on by default.

Re:I have to call BS

[Raineer]

I never patch my windows unless its a service pack and I run just fine... Always have my Antivirus running and Windows defender with a router with built-in firewall... No complaints for the 7 years since I built my pc....

Would you even know if your PC was a Botnet client?

Re:I have to call BS

[truesaer]

I would assume that anti-virus software can detect that stuff.

College Network

[Anonymous Coward]

I think the Time to Infection on a college network is like... 45 seconds.

Re:College Network

[Anonymous Coward]

False. I run on a college wireless network every day, and the only problems I've had are overall system slowdown, stolen identity, a cease and desist from the RIAA, and my computer turning itself on and off at odd times...

Ah. I see your point.

Re:College Network

[Anonymous Coward]

Surely the computers can't be infected that quickly.

Oh wait...

That's why you slipstream

[Toreo asesino]

You can bundle all the patches & service-packs you want into a slipstream image and install everything at the same time.

Otherwise, there's WSUS (http://en.wikipedia.org/wiki/Windows_Server_Update_Services).

(Not that I disagree XP was horribly insecure when it came out)

Re:That's why you slipstream

[Anonymous Coward]

No no no no no no no NO. I don't know why people keep trying to bring this up.

WSUS is not there.

WSUS is only available if you have Win2k3 (or, I think, it would run on 2k Server). This is generally only something that medium-sized businesses would end up running (and maybe some smaller ones). Unless you have a friendly admin with a domain you can join across the public internet, WSUS is useless to home users.

Slipstreaming is far more likely, even for the home power user. Seriously, how many home users are willing to go to the effort to run a 2003 server instance just for WSUS?

Re:That's why you slipstream

[evilviper]

You can bundle all the patches & service-packs you want into a slipstream image and install everything at the same time.

Sorry, but no. I've tried it, it DOESN'T WORK.

Service packs slipstream just fine. However, it takes endless weeks of trial-and-error to determine which hotfixes can be integrated without completely screwing things up... There are a great many that just can't be integrated, or the system will perform badly, and future attempts to update normally will fail until you've tracked down the bad actor, and removed all traces of it. It's clearly not worth the effort.

I would, instead, recommend copying all the available hotfixes and SRPs to a USB drive, so they can be installed offline, and are quite easily added to when new patches are released.

Improved odds in XP/2003 SP2 and Vista/2008

[FuegoFuerte]

At risk of sounding like I'm supporting something Microsoft has done, the feature they added with Server 2003 SP2 (and I believe also XP SP2) was quite a good move considering these facts.

When a SP2 system is first brought up, after running through Mini-Setup or the OOBE, it will open a "Post-Setup Security Update" wizard. Until the user clicks the "Finish" button on the wizard, the firewall blocks all incoming traffic. The wizard also has links to Microsoft Update, etc. This gives the user a chance to download all the patches before opening up the firewall.

In Vista/2008, the firewall is on by default and fairly locked down, only allowing certain traffic through. In Server 2008, the firewall rules are also grouped into categories to make it easier to configure so the user doesn't get frustrated and just turn it off completely (and if a user tries this by just stopping the firewall service, they lose their 'net connection completely... one must instead set a firewall policy to allow all traffic, which then shows the firewall status as "off").

Re:Improved odds in XP/2003 SP2 and Vista/2008

[louarnkoz]

Actually, all versions of Windows since XP/SP2 (August 2004) come with the built-in firewall turned on by default. To get the "owned in 4 minutes" statistic, you need to either install an old unpatched version of XP or XP/SP1, or deliberately turn off the firewall. Which explain maybe why TFA is so light on details...

Re:Improved odds in XP/2003 SP2 and Vista/2008

[rdnetto]

When a SP2 system is first brought up, after running through Mini-Setup or the OOBE, it will open a "Post-Setup Security Update" wizard. Until the user clicks the "Finish" button on the wizard, the firewall blocks all incoming traffic. The wizard also has links to Microsoft Update, etc. This gives the user a chance to download all the patches before opening up the firewall.

I don't know about Server, but I've installed both WinXP and Vista, and I've never seen a Post-Security Update wizard (although I have noticed that if you insert the setup disk while Windows is running, it let's you download updated setup files before it starts installing). In my experience, just installing updates after installation is fine, even with the internet connected. But then I'm safe behind my router's firewall, just like the majority of people - AFAIAA, there is no default installation that would leave you open to the internet like that.

Re:Improved odds in XP/2003 SP2 and Vista/2008

[bdenton42]

Interestingly enough a couple years back I had to reinstall and all I had was the OEM SP1 disk. I installed, plugged into my Linksys router, which includes a firewall with whatever default settings it had, started downloading the 30 or so "critical" security patches, but I was infected within 4 hours. To this day I'm not sure what the Linksys firewall was letting through... perhaps the infection comes through ports opened by Windows update?

Based on a.. diary post?

[ulash]

The source for this post seems to be lacking on quite a few fronts when explaining how they arrived at this data.

- (As pointed out already by numerous posters) Which version of Windows are they using?
- What activity are they using the computer for?
- Who are the "all" in "placing an unpatched Windows computer directly onto the Internet in the hope that it downloads the patches faster than it gets exploited are odds that you wouldn't bet on in Vegas" ?
- How unpatched is unpatched? Is this a version of the OS that one needs to deliberately search for or if I go and buy a boxed version of the OS there is a pretty good chance it will be just as "unpatched" ?

The "piece" raises more questions than the answers it provides.

Re:Based on a.. diary post?

[Anonymous Coward]

- Who are the "all" in "placing an unpatched Windows computer directly onto the Internet in the hope that it downloads the patches faster than it gets exploited are odds that you wouldn't bet on in Vegas" ?

I can't find the "all" in there...

Re:Based on a.. diary post?

[dotancohen]

The "piece" raises more questions than the answers it provides.

That's why it is called science.

inform yourself

[Anonymous Coward]

There are exploits that don't require any interaction of the 'former owner' of the machine.

What?

[Waccoon]

So, why have I been using Windows for 12 years with no antivirus, and have never gotten a virus? At one time I had a DSL connection at work with no NAT and didn't have any problems there, either.

Re:What?

[able1234au]

How do you know you don't have a virus unless you scan your computer? Even then, if you have a rootkit successfully installed it might be possible for the rootkit to avoid the AV software.

Re:What?

[Anonymous Coward]

Luck.
hell people have managed to survive jumping from airplanes without a parachute.

Re:What?

[Computershack]

How do you know you don't have a virus unless you scan your computer? Even then, if you have a rootkit successfully installed it might be possible for the rootkit to avoid the AV software.

Same could be said about Linux. In fact I'd go as far to say that that post is more pertinent to Linux given the false sense of security Linux users have.

Re:What?

[Waccoon]

18 second boot time, no randomly disappearing files, no BSOD for two years, no re-install for 6 years, no malware, no pop-ups, no CPU-sucking background tasks, no hd corruption, no weird things showing up with my pre-Microsoft SysInternals tools, no IE toolbars or plugins...

Not every Windows user is an idiot. Of course, I repair computers all the time, so I'm very familiar with what viruses and malware does to a Windows computer, and I know how it gets there, too. Namely, idiot Windows users.

Re:What?

[Anonymous Coward]

If you patch your machine and don't browse dodgy sites you are very VERY unlikely to ever get hit. Most exploits are for old vulnerabilities where they exploit people that don't upgrade (even had a friend who got done as he turned off his automatic update after some advise from a moronic slashdot poster who claimed MS used to get personal details from him). Really though a smidgen of common sense and intelligence will block all but the most targetted of attacks.

Re:What?

[bdenton42]

Blaster did not require any idiots... it was perfectly happy infecting any and all connected machines whether you were doing anything or not. That was really the beginning of the "you must take every security update as soon as it comes out" era that we are in because the patch for that had been released less than a month earlier.

Re:What?

[^_^x]

Because, you actually know more Windows than "clicking teh pretty picshurz" so the FUD doesn't apply to you.

My last virus was SubSeven, back in Win98 because evidently I clicked on an executable that installed it. I scan occasionally, but don't run resident protection. I log in as admin. I've even knowingly installed adware, to later remove it along with the program it supports when I'm done. If you have any awareness of what's going on on your system, you can protect a Windows installation pretty easily. That would be why we're not 80% Mac OS now.

Then, on a Linux centric site, many users haven't touched Windows since the early to mid 1990s so a lot of obsolete complaints are raised, more as back-patting than real argument. That said, this case is ostensibly an experiment, but I've found if they stuck it behind a cheap home router the time to infection would probably stretch to at least 5 years if it were properly set up for 5 min.

Re:What?

[Culture20]

Because, you actually know more Windows than "clicking teh pretty picshurz" so the FUD doesn't apply to you.

I know more about windows than clicking icons too (pstools, regedit[32]/reg.exe have been my friends for years), but if I forget and leave a cable in when I do a new windows xp install, it gets owned. Updates need to be done offline, even when you installed the base from a slipstreamed CD.

Unix deals with this too; Heck, Solaris 10 ships with a remotely exploitable telnet daemon on by default. Always unplug, install, update offline, _then_ connect to the internet.

Don't think of this as FUD; this is undoubtedly legitimate fear about certain types of remote exploits on unpatched machines with almost any OS that can be prevented easily.

If you have any awareness of what's going on on your system, you can protect a Windows installation pretty easily. That would be why we're not 80% Mac OS now.

I'm pretty sure it's another reason, because very few people are aware of what their systems are doing.

Re:What?

[^_^x]

You're right. It is a valid concern. I just think that anyone with "common sense" when it comes to comptuers will avoid this. I actually update fresh installs online because they don't really matter for the most part. I just ALWAYS do it from behind a router that blocks any port that isn't needed. I don't know how it took with the general public, but I remember a few years ago that was given as a (the?) basic Internet security tip.

I wrote about FUD really unclearly, but what I meant was that this kind of thing on a site like this is usually FUD, though this is a valid lab test from a trusted source - it's just not neccesarily that relevant in itself. Haven't new XP boxes supposedly been owned in 5 min for a year or two now? Being posted here it feels like just another trumpeting of Linux's supposed strengths - kind of like showing how badly a car performs in crash tests after you disable the airbags and remove the seatbelts - SOME people may drive like that, but it takes some manual safety disabling to do, and most are probably smarter, or at least I'd like to think that...

And these techs tell you...

[www.sorehands.com]

These tech people from Comcast or SBC tell you to plug your machine directly. Maybe they work for the people who run botnets?

A spit on them. They seem to be as incompetent as the 'Geek Squad'

Obvious misspelling in title

[oodaloop]

That should be Time-To-Pwn. You're welcome.

7 months and counting

[petes_PoV]

At the end of last year (just before christmas) I reconfigured an old laptop with W2k/SP4 for use receiving weather satellite pix and acting as a weather station. Since it only has a 150MHz processor and 96MB memory I decided not to include any anti-virus or spam filtering on the box itself. It does sit behind my Netgear DG834GT, which only lets through selected ports - mainly for the benefit of the other machines I run.

While the laptop itself has very little internet presence (just downloading patches, drivers and s/w updates) I've occasionally remote-mounted it's disk to another box that runs Norton. I've never detected any spam, viruses, trojans or other nasties.

My conclusion is that with some basic precautions and common-sense (plus no email and only visiting "well known" websites) it's quite feasible to run a windows box for dedicated applications 24*7 without the overheads of virus protection.

Re:7 months and counting

[10101001 10101001]

My conclusion is that with some basic precautions and common-sense (plus no email and only visiting "well known" websites) it's quite feasible to run a windows box for dedicated applications 24*7 without the overheads of virus protection.

It's interesting you say all that because I have a suggestion for a test. On the one hand, you can use a fully patched Win2k/sp4 machine, but you're required to use Internet Explorer with javascript, java, flash, etc installed. On the other hand, you can use a fully unpatched Windows 2k machine, but it will use a hardware firewall and use the latest of either Firefox or Opera, but have javascript, java, flash, etc disabled for 99% of websites (including youtube, myspace, etc). The only limit on the actual websites visitable is not being allowed to go to known demo websites for exploits or to specially crafted websites by you just to intentional attack one or the other machine. Which machine do you think will become infected first?

My bet is that the fully patched machine will be infected first. Why? Because the two main avenues for attack on a Windows machine are Windows crappy default services being enabled along with tcp/ip stack exploits and javascript/flash/java exploits, especially through Internet Explorer. Truthfully, the same avenues hold for Linux and Mac OS X (minus Internet Explorer).

The core weakness is a lack of robustness in most software. Until that is fixed, then yes, removing as many unknowns as possible greatly reduces the risk. It's a sad commentary, though, that so many hoops have to be jumped through. Perhaps, some day, a group (like OpenBSD) will do a code audit of Firefox (and java, flash, etc) so such fears will be mainly a non-issue.

Re:7 months and counting

[Anonymous Coward]

Your situation couldn't have less to do with what the article is saying if you tried. You have a NAT/firewall that the machine is behind and you install patches on said machine.

another nonsense MS bashing piece

[timmarhy]

right let's install a 5 year old linux distro and see how long it takes to get owned. it's the same thing they are putting forward here with an unpatch winXP system.

unpatch systems with no protection are easy to infect - this is not news.

Re:another nonsense MS bashing piece

[EvanED]

right let's install a 5 year old linux distro and see how long it takes to get owned. it's the same thing they are putting forward here with an unpatch winXP system.

No it isn't. That Linux distro wouldn't be old enough... it should be 7 years old, not 5.

(Not that XP would stand a chance even in that comparison, but the failure to mention that it sounds like these numbers are for XP without SP2 in the summary, making it sound like Vista or even XP with SP2 is as vulnerable is very disingenuous.)

Re:another nonsense MS bashing piece

[Opportunist]

Considering that the average Linux distro from 5 (or rather, if you want to make a real comparison since they're obviously using XP SP1 to "prove" their point, 7 years) already came with an iptables/ipchains firewally built in and rather few, if any, remotely accessable services running if you don't want them to run (they ask you if you want to have SSH running and yes, should you enable a 7 year old version of SSH then you're vulnerable), I'd think XP would still lose.

The problem is that even if you KNOW that the RPC is a deadly remote exploit vector in XP, you CANNOT turn it off during install. With Linux, at least I have the option to avoid enabling SSH or other services that I know are no longer safe.

Re:another nonsense MS bashing piece

[Anonymous Coward]

Well XP is the current version of Windows. There is a beta/unstable o/s out called vista but hardly any software will run on it (specifically, the software I use to do my job).

I have an XP install disk. I paid a lot of money for it. I don't want to pay for it again if I need to reinstall. So how can I reinstall without being unsafe and getting owned halfway through the process?

Whereas with Linux they give away updated install disks on the front cover of magazines each month.

Re:another nonsense MS bashing piece

[timmarhy]

5 years ago most of them had ssh on by default (we ARE trying to compare apples and apples right? none of this i can configure linux but lets leave XP wide open), they also had gems like bind8 or bind4 on by default as well as sendmail.

Re:another nonsense MS bashing piece

[Chutulu]

ffs you can install an offline version of SP2 or SP3. It's also free!!

Re:another nonsense MS bashing piece

[petermgreen]

I have an XP install disk. I paid a lot of money for it. I don't want to pay for it again if I need to reinstall. So how can I reinstall without being unsafe and getting owned halfway through the process?
download the SP3 offline installer and either slipstream it into your windows install CD or if that is too complicated for you just burn it to a CDR and keep it with your windows install CD.

alternatively just connect the machine behind a router/firewall/nat that doesn't allow incoming connections while you install the update.

Re:another nonsense MS bashing piece

[Opportunist]

...and if your distro doesn't allow you to turn it off during install, choose another distro.

It's not like any of those programs can't be turned off without breaking the system. Now try the same with the buggy RPC of WinXP SP1.

Anonymous Coward

[Anonymous Coward]

Why does my IT guy always say PwN3D? he actually pronounces the "3" in klingon. Does this somehow relate?

But in practice...

[cruachan]

Who ever sets up a windows PC with a direct internet connection? Being behind a NAT will cover the drive-by attack issue perfectly adequatly, and whilst it was it was common a few years ago for consumer broadband companies to supply USB broadband 'modems' which did connect directly, in practice now this is rare as most now use a pre-configured (generally wireless) router.

Re:But in practice...

[_Shad0w_]

Oh you'd be surprised; companies that host Windows web servers for a start - especially when they normally only deal with BSD and Linux based boxes. I've known a hosting company put an unpatched Windows 2003 Server on their external network, it was riddled with all sorts of fun by the time I looked at it.

Re:But in practice...

[Opportunist]

Who ever sets up a windows PC with a direct internet connection?

You don't spend much time looking at your firewall logs, do you?

I had to filter out worm traffic in the logs, my logs started to tie up considerable space on the machine I use as my firewall. I cut the log size by 90% just by filtering out the worms.

Granted, I use a provider that's notorious for signing up everyone who wants "thar intarwebs", and who is about as clued as its users (it has its advantages, I for one won't run into a "Comcast" anytime soon...:)), but worms are still a widespread problem. I get hits from worms that came out in 2001 and should be by any standard a thing of the past by now, yet there are still a fair number of machines out there spewing them.

For this infection to happen (and still exist), those machines must have been unpatched for years, without any form of anti virus whatsoever (even an ancient signature file of any AV kit would find those worms) and be connected directly to the internet without any router or firewall between them and the net. They are certainly no longer the majority, but with worms, a single one is enough to start the fire again.

What about Vista?

[Tracy Reed]

Whether we like it or not MS is slowly but surely on their way to strong-arming everyone into running Vista. I don't care about XP anymore. What is the TTO (time to ownage) for Vista?

I'll believe Windows is getting more secure when I start getting less spam in my inbox.

Re:What about Vista?

[IkeTo]

> I'll believe Windows is getting more secure when
> I start getting less spam in my inbox.

I'd be a bit easier. I'll believe Windows is getting more secure once the anti-virus companies go out of business.

Re:What about Vista?

[Toreo asesino]

Should be much more secure as the 1st time you connect to any new network (wireless or otherwise), Vista assumes it's a hostile network by default, and coaxing it into opening any ports at all on the new interface requires admin privileges. If you don't, everything inbound is locked down.

So, in theory, if you just "plug in a vista RTM machine", it should be watertight. Start opening ports though, and it might be a different story.

Just connected

[SmallFurryCreature]

This is about worms and such that spread across the internet, not about trojans and virusses people download. Afterall, I could surfe google for years without ever getting a single virus and go to a .ru site and be infected in seconds. No, the 4 minutes is for a windows PC directly connected to the internet (no router in between) doing nothing but being connected. What will happen to a lot of people who just bought a new computer and are using a direct connection to the internet like many a cable company offers. If your connection to the internet has only ONE ethernet port or is a USB modem or something similar this means you. ADSL typically uses routers in my experience (more then one computer can be connected) and this effectively closes of your PC from the internet meaning it can't be contacted.

Re:Just connected

[Allador]

And its not even really that.

If you RTFA, you'll see that its a honeypot machine (not a windows box) that 'emulates' typical windows vulnerabilities.

It is effectively running like an unpatched (wont say which sp version) windows with no firewall.

In other words, its only a meaningful article in the sense that it tells you how much auto-scan/auto-exploit traffic there is out there.

The article says nothing about how long an actual windows machine will stay alive on the network.

ha!

[thatskinnyguy]

4 minutes eh? I've seen XP installs (Pre-SP1) get owned during the install process!

Re:ha!

[freedom_india]

You made me spill hot coffee in my lap, you insensitive clod!

Re:ha!

[westlake]

4 minutes eh? I've seen XP installs (Pre-SP1) get owned during the install process!

Please explain to me why you had a live network connection during the install.

Re:ha!

[thatskinnyguy]

I didn't say I did it. I just saw it happen in college quite a bit.

What about TCO?

[Anonymous Coward]

Also, this really undercuts the notion that Linux has a lower cost of ownership. I mean, Windows computers are getting owned for *free* and it only takes a few minutes online!

A TCO like that is just incredible!

Use a Linux live CD

[Nicolas MONNET]

But then you might just want to install Linux instead.

Re:Use a Linux live CD

[Cramer]

*ding* we have a winner. of course, sadly, a linux (or solaris, or in fact, almost any *NIX) box can be hijacked just as fast if no patches are (ever) installed. ('tho i don't know about 4min, as linux isn't as highly targeted.)

Re:Use a Linux live CD

[petermgreen]

The real problem with pre-sp2 XP was the default config had no firewall and a lot of services listening for incoming connections. Plus many of those services were running with localsystem (~= root) privilages.

XPSP2 enabled the firewall by default but IIRC there were a lot of exceptions for whatever windows considered to be the "local network"

Afaict most linux distributions are not stupid enough to do this. So the exposure is much reduced.

Of course if you manually install services that listen to the internet without patching first then things change big time.

Re:Use a Linux live CD

[Cramer]

Afaict most linux distributions are not stupid enough to do this.

Like installing and enabling SSH, Apache, etc? Unless you are doing a live network install that's pulling in all current security updates, just about every major OS (which includes Linux distro's) have several known exploitable flaws in the box. They need to be connected to "the web" to automatically update themselves. Doing so without any form of firewall is dangerous.

XP SP2 improved things greatly, but like most things from M$, there are still hundreds of exploitable flaws... many remotely accessible with zero user interaction. Even Vista's infamous "Allow or Deny" crap has been defeated a dozen times over -- yes, you still have to get your code on the machine, but given the general windows userbase, that's not difficult at all.

In the case of the redhat box, by the time we inspected it, it had been compromised three times... via an unpatched ssh server, unpatched apache, and unpatched bind. All three where hit by automatic breeching tools -- worms that scan and compromise machines all by themselves.

Thats because once you patch....

[3seas]

... you are infected and there is no more "time to infection".

Re:Thats because once you patch....

[Opportunist]

You can install a Windows patch in less than 4 minutes? What kind of magic machine from the not so near future do you have?

What about NAT?

[samael]

Does putting it behind NAT entirely protect it?

Or are there worms out there that can bypass that?

Re:What about NAT?

[LanceUppercut]

An XP machine behind a NAT (router) remains uninfected forever, without any additional protective means. Moreover, I don't know where they get their strange times. I had an XP machine connected directly for 7 months in a row without any infection.

Re:What about NAT?

[Buelldozer]

That's what you think...until the day you reboot and say "Why is my machine loading an mIRC client at startup?"

I've got a Windows 2003 SBS machine on the bench right now, only even that question wasn't sufficient for the inhouse IT staff to realize they had a problem!

Personally installed blinders can be a powerful thing.

Running round in circles?

[Anonymous Coward]

Now this is indeed funny tbh

Imagine you have a fresh install of windows XP because it crashed the hard drive or something like that, you are on holidays and the only connection you have is a wifi up link with limited bandwidth.

This could (or prolly will, like proven in the test) lead you to getting owned by several trojans, exploits or whatever you name it.

Now how could you ever, when only having an uplink without any blocking/firewall mechanisms on hand, get updated with the right patches.

I guess the only solution is to not do this.

Now I don't use the XP firewall, but use netlimiter pro for firewalling and bandwith shaping. I truly wonder if this is good enough, since I mostly sail through the year and my only connection uplink is through wifi (which is as open as it can get)

About all of my connections run through a openvpnserver which I run at home, but ofcourse, the first step in the process to get a connection is by getting an ip-adress and start the tunnel. From that point on I suppose it is secure since all traffic from that point on is through the tunnel

But then again, if it get's compromised before the rerouting through the tunnel starts, everything is screwed, or isn't it? Now once comprimised, everything, including the trojans and other such will go through the tunnel and I'm still screwed right? allthough from that point on, there won't be any new trojans/exploits/... since the firewall on the other end will block it, but wait again, if the trojan is already inside, it still can open an connection and start transfering new ones to me...

I guess I got a dutch saying here, the chicken and the egg problem, running round in circles...

So to get it all done, this means I have to get a dvd filled up with patches to make sure I can update/fix all the holes before getting online. But wait again, to activate the XP I have to get online, or pick up the phone to dial Microsoft to get it all activated.

Ahhh, nope, XP has this firewall activated by default.

Or is it not?

If it is activated by default, not patched, but a clean install, it still has this truck load of vulnerabilities?

Just wondering.

... and if you leave your car key in the ignition?

[petes_PoV]

you'll find that also gets "owned" in less than 5 minutes, in any city in the world.

Solution: don't do it.

The point is not that there are bad people, or 'bots, about, it's that there are still a few individuals who are either too lazy or haven't been educated in the hazards of leaving their PCs unguarded. In time they will learn the hard way - or be taught (or possibly punished, as this weakness affects not just the person who's PC it is) that they will take a loss if they don't or "forget" to take the proper precautions. You can build better security into an O/S, but it still requires the people to actually use it: the problem is more an educational issue than a technical one.

Any OS will get owned post-install

[ptashek]

I took about 2 minutes the last time I remember this was *accidentally* tested on our /16 network (XP SP2, way down in mid-2006). But this is not a Windows problem per-se. Any other OS, in a post-install state, will eventually get compromised. It's just a matter of time. Solution: build + patch + secure offline, then deploy.

So what?

[Anonymous Coward]

So what? I'm not sure what this is telling us that we didn't already know. It's like removing the airbags and seatbelts from a car, putting a person in the drivers seat, putting the car in drive and letting the car go without the person intervening. Eventually the car is going to come in contact with something and the person is going to be harmed. This is obvious. Throwing an estimated amount of time onto it doesn't tell you anything useful.
Running the test with a fully patched install, that's usable information.

Re:... and if you leave your car key in the igniti

[Opportunist]

I actually forgot my car keys in my car overnight once and nothing happened. Well, this isn't LA downtown. I live in one of the cities with the least crime overall.

The problem is, with the internet space means nothing. You essentially automatically live in all the worst cities at once, they're all right in front of your doorstep.

That's what most people forget when they deal with the internet, especially if they live in a sheltered community where it's safe to walk the streets at night. They're not used to pondering being mugged any second. But that's exactly what happens on the internet, you live in the worst kind of neighborhood, anyone out there who wants to do something bad to you is camping right in front of your door.

Don't feel special, though. They camp in front of every else's door at the same time.

I have always known......

[rust627]

That bugs come in through open windows......

What does "prior to install" count as?

[Cramer]

I recall a former boss's computer getting compromised during the installation. It was either NT4 or 2000 server. I'm not sure his disk (most likely an MSDN disk) had any service packs on it. (this was late '03.) It was beyond the firewall, naked on a Bellsouth DSL line.

I also recall a friend (sysadmin) had his linux (redhat 6.2 maybe) machine compromised within a day of installing it. I don't know if it was within 4min or 16hrs; the next day we noticed it was scanning the network. That was a "naked" workstation on an ISP's core network -- no firewall of any kind. That was 7-8 years ago, and we still kid him about it.

The T1 at the office was seeing about 100 probes per minute years ago when I cared enough to log all that shit. The DS3 was seeing just as much crap the instant it was turned on a few months ago. (seeing how the morons setup that router (cisco), I wouldn't be surprised if people have broken into it -- with no logging turned on, how would anyone know?!?)

Can you trade in?

[Anonymous Coward]

Can you trade in your OEM XP (SP1) disk for a new shiny XP SP2 or 3?

No.

In fact, because it's burned for a specific machine, you can't even slipstream.

So the antipiracy doodad is the problem here.

Re:Can you trade in?

[Anonymous Coward]

If all you got is a pre-SP2 OEM image, you should really download the SP2 (or better SP3) offline installer and burn it to a CD. Install it after restoring the OEM image and before you connect the network and you won't have any problems.

SP2 or not SP2, that's the question

[adam1101]

A stock install pre-SP2 XP is easy to own in a few minutes without user interaction, because there are vulnerabilities in some of the services that listen on the network. That it is not news, that's ancient history. Whether it's owned on average in 4 minutes or 16 is pretty much irrelevant.

Stock SP2 has a built in firewall. If that's exploitable without user intervention (installing apps also counts, as they might disable it, or at least open more ports in it), that would be big news. But I can't really find the configuration details of the "unpatched Windows PC" in the articles.

It just means your aquarium populates faster now..

[vittal]

http://xkcd.com/350/

Re:wholesale jewelry

[bloodninja]

Slashdot the spammers!

FUD

[aXi]

This is just yet another FUD to get people to use VITSA.

Don't get me wrong I dislike any microsfot product as much as the next guy.

But I'd rather have microsfot continue developping windwos PX then have everybody be FUDded into buying VITSA and giving Microsfot even more undeserved money.

But it would seem that now that microsfot' FUD machine is no longer effective against the likes of Ubuntu, they are using the same tactics towards thier own biggest userbase. Chapeau microsfot, here's to your own pawnage, by your own means, what am I saying, by your own FUD network.

Look at the giant snake eating it's own tail.

Re:... and if you leave your car key in the igniti

[Lennie]

I'm sorry, but if you take your average Linux distribution, you will see this won't happen.

For a company with so many resources (read: money) they keep messing up in a big way.

Who is affected anyway?

[MrTail]

From my experience a lot of people connect to the internet through their modem/router/gateway instead of a direct connection, this usually means NAT. Even though it is interesting to see how quickly an unsecured system can become hijacked, I wonder how many people are still connected directly to the internet?

NAT?

[wintermute000]

can I clear something up: is this only for PCs directly connected to internet i.e. their IP address is their public IP?

As any PC behind a NAT (without static mappings) cannot be directly targeted by a connection initiated from the internet.

Of course the internet facing device itself is another matter....

Or am I mistaken?

Re:NAT?

[jimbob666]

You are not mistaken. Sitting behind a NAT firewall unpatched is fine *for the experiment outlined in the original article*. Just don't start browsing the internet in this state.

I know this is against the original article's experiment parameters but best practice is to get XP SP3 downloaded on a USB key or whatever, update the PC, connect to internet behind a NAT firewall, let Windows Updates do its business.

If you know what you are doing and don't install any old software or click on pop-ups you will have years of safe browsing :-)

OS comparison

[onlau]

Would be interesting to do the same for 5 years-old Linux distros and MacOSX... Anyone has tried it?

It is 1 minute

[Ilgaz]

Well, I actually measured it on friends Windows XP which I stupidly forgot to enable built in firewall after Windows installation. It was a 56K Modem connected machine, it took 1 minute to get "This system is scheduled to shutdown in 1 minute" blaster thing.
Modem connected machines are in bigger danger since there is no firewall in modem.

It's only a problem if you're stupid or a troll

[Moraelin]

Well, it's only a problem if you're (A) fucking stupid, or (B) a troll or security company trying to get some attention. (The difference between trolling and PR can be awfully subtle at times.) Well, not meant personally, but rather the generic "you".

The fact is, you can't even buy a computer nowadays without at least SP1 on XP, or Vista, both of which come with a firewall activated by default. To be unprotected on the Internet like that, you'd actually have to disable it. It's not something that every user will do, and right before downloading the patches, no less. Even if they were completely retarded, well, then they'd be too retarded to find that option.

Even in pre-SP1 XP or even on 2000, you have a little known option to not allow incoming connections. I think it's there even on NT. On 2000 it's under the TCP/IP settings, Advanced -> Options -> IP-Security. It's the poor man's firewall, basically. Not a full fledged one, but it _will_ keep you safe while you download the patches. Yes, I did try it. It worked.

But even that won't be necessary, since (A) you can't even buy a computer with unpatched Windows 2000 nowadays, and (B) even if you somehow found yourself stranded somewhere with a pre-SP1 XP with the firewall suspiciously missing, most vendors include stuff like ZoneAlarm or some security suite. If your computer has a nVidia chipset, it has its own half-hardware/half-software firewall right on the drivers CD. Again, it defaults to be activated by default, so you'd have to be truly retarded and disable it before you even look for the patches.

If you have a 64 bit CPU, as the vast majority are nowadays, and XP SP1 or later, you can also make it use the NX flag. Basically then it can't execute the data segment. That takes care of pretty much all buffer overflow exploits right there, because that's how they work. By default it only checks the Windows kernel and IE, which is enough to get those patches safely, but I'd advise making it check all programs anyway.

Again, you can't even buy pre-SP1 XP nowadays, so you _will_ have that capability.

The fact is, I've been running an unprotected PC for the last 5 years or so, and I don't seem to have any infection. I don't see anything suspicious in the registry. My router led doesn't blink when I'm not browsing and in fact the router does disconnect some 10 minutes after I did anything. I haven't had any extra charges on my credit card. I haven't had my WoW password stolen. So either I genuinely don't have anything bad on it, or it's awfully benign.

So basically this kind of statistics are just pure trolling. So someone took a computer on the net, and actually went and disabled the firewall and possibly the NX protection too. And whop-de-do, it got pwned. Big surprise. That doesn't mean anything about what will happen to the average user. It just means that some retarded troll (either fanboy or a security company's PR) found a way to fuck-up that computer to get a reason to whine, "OMG, Windows gets pwned." Well, gee, big surprise there.

Re:It's only a problem if you're stupid or a troll

[gx5000]

What is actually meant here... Most of my PC's are "unpatched"... But they are behind a router, using zonealarm pro, pest patrol, Norton Coprporate, and Acronis. I've had close calls with friends with CD's that come over, but if there are still the type that just install Windows and surf, well, that's like going swimming without checking for sharks...

How about a VM on NAT in a firewalled host machine

[naz404]

Will this be pwned the same way?

say run an unpatched Win98, Win2k or WinXP VM (VirtualBox or VirtualPC) inside a host box with its own personal firewall.

Will the firewall protect the VM, or will it be pwned just as fast because it's running on NAT and it's probably just the host VM software that's being monitored by the firewall?

Still not apples to apples

[Moraelin]

It's still not apples to apples. Yes, you can still buy XP, but you'll get XP SP2. It's hard to find even XP SP1 any more. Completely unpatched XP, would take some true dedication and ebay-fu to get at all. So, no, you can't buy a completely unpatched XP either. Not any more than you could buy an unpatched RedHat 8.

So whop-de-do, they prove that an OS you can't even buy any more, and just as unpatched as 5 years ago... still gets owned just as fast as it did before. Well, gee, big surprise there.

Re:How about a VM on NAT in a firewalled host mach

[naz404]

pardon my noobishness, but am not as well versed in basic networking... mostly work on web stuff and not mucking around with networks.

Um, no, it doesn't show that

[Moraelin]

Um, no, it doesn't say that. They're _not_ saying that Vista still gets owned as fast as unpatched, pre-SP1 XP. They're saying that, basically, unpatched pre-SP1 XP is still getting owned as fast as... unpatched, pre-SP1 XP did. Well, gee, big surprise there.

It doesn't say anything about how much MS software improved in the meantime.

Basically, to take the mandatory car analogy, it's like saying that the original "unsafe at any speed" 1963 Corvair is... still as unsafe at any speed, as it was in 1963. Well, gee, that's such a big surprise.

Would you use that to claim that GM hasn't made any progress since 1963? No, seriously.

Re:Um, no, it doesn't show that

[jd]

No, their base system was the base system at that time, which was either SP1 or SP2. Other commentators have claimed to see evidence of both of these, so I'm going to argue that possibly both of those were involved. That still doesn't answer the problem of auditing tools. It also doesn't answer why, after the security disasters of prior years, the original XP wasn't so kitted out with security that you'd need the NSA to break in.

XP Firewall...

[Anonymous Coward]

The fact your firewall was disabled shows you already did some interaction.

Win XP versions prior to SP2 apparently didn't always have the firewall switched on by default on install. I haven't used Windows except as a last resort since the 90s (read: before Windows XP even hit the market) and I usually run for cover when I am asked for tech support by a Windows user. Recently, however, I was forced to restore a Windows XP box for family members and apparently there is still plenty of pre SP2 Win XP CDs and restore partitions around. The first thing I did after hitting the blue button on this IBM Thinkpad (Win XP SP1 IIRC) was to install malware protection software. I gave up on this approach after two of the anti malware suites I tried to install caused a BSOD during installation. I ended up downloading the stand alone Windows SP on a OS X box and then installing it on the XP box just to be able to install the anti malware suites without getting a BSOD. The whole Windows restore/patching/hardening process took several hours before the machine was fully patched and internet safe and that didn't cover application installation and configuration. The only bright spot is that next time I can restore to SP3+ level from a binary image I created after finishing this agonizing process. If somebody held a gun to my head asked me to pick between restoring another Windows XP box and a taking a day trip to Gitmo for a waterboarding session I'd be hard pressed to decide which is worse.

Funny thing is that Zone Alarm has had vulns

[George_Ou]

Funny thing is that Zone Alarm has had some serious remote exploit vulnerabilities where if you hadn't installed a 3rd party FW in to your Windows XP computer, you'd be safe. Here's an example of one http://secunia.com/advisories/10921/. Windows XP, Vista, Server 2003 and 2008 Firewall has been rock solid and secure. You're simply talking out of your ass and you're giving the typical knee jerk reaction against Microsoft products. You do not have a single example of where Windows XP SP2 firewall is vulnerable to a remote exploit and there isn't a single example of hackers getting through it if all ports are closed.

Re:Funny thing is that Zone Alarm has had vulns

[KGIII]

To add to this I have helped write both the Outpost Personal Firewall and Kaspersky's Anti-Virus application. As the NDA is up I can admit to the latter. Simply put, you're full of shit. (Not the parent but the grandparent. George is right on.) The reality is that if one doesn't try to pretend they are smarter than the system than the Windows firewall works really well at INBOUND protection. Let me state this another way... If you have a clean system AND don't go screwing with the system's settings the Windows firewall will do just fine at getting you online safely. If your OS installation media predates this than you should really look at slipstreaming or a newer OS. Windows firewall sucks at outbound protection, a lot... As for inbound? It is fine and I will happily toss an image and an IP address up to those who disagree [no carrier] (Just kidding of course, it really DOES do the job of inbound protection. Safe hex and JUST the Windows firewall behind a NAT enabled router has served me well for a long time though outside of that I simply use Outpost.)

Re:Funny thing is that Zone Alarm has had vulns

[Dolda2000]

Windows firewall sucks at outbound protection, a lot...

Is it only I who get the mental image of the Berlin wall when people speak of outbound "protection"?

Re:Funny thing is that Zone Alarm has had vulns

[sm62704]

If you have a clean system AND don't go screwing with the system's settings the Windows firewall will do just fine at getting you online safely

I'm confused then. If what you say is so, and Microsoft's firewall is rock solid, then how could an unpatched Windows installation be pwned in less than four minutes as the summary says? I guess I need to RTFA (grumble mumble).

How hard would it be for Microsoft to add a patch CD to the box, or when patches are released to ship patch CDs to retail outlets like Best Buy and Circut City for their existing stock? AOL used to send me coasters every damned week, why can't Microsoft?

I spent over a hundred dollars for XP, is it too much to ask for a quality product? My car is six years old, but if a defect crops up they'll do a recall and fix it on their dime. Why can't Microsoft?

More confusing, why isn't everybody demanding this instead of making excuses for Microsoft? Apple ships millions of computers quarterly, why don't they have these security problems? Are there any Apple or 'nix viruses (not trojans) in the wild?

Re:Funny thing is that Zone Alarm has had vulns

[rabbit994]

Article isn't clear but they didn't say what version of Windows they put on Internet. If you install slipstreamed XP SP2 or greater, the firewall would be on by default and I imagine time to owned would be much higher then 4 minutes. If you put XP no SP on internet, yea, owned in 4 minutes. Server 2003 SP2 R2 locks down all incoming connections till you say go ahead and open them up after install to let you have time to patch.

As for shipping with patches, they do. All the new Dells at work have been coming with XP SP3 on reinstall CD and there is directions on how to create your own slipstream install CDs. Try googling "XP Slipstream" . Ditto for Windows 2003 Server.

Lastly, they do continue to fix it. Windows Update still has patches for XP as needed. The rate of required patches has slowed down but that's a good thing. They haven't had OMG WE MUST PATCH NOW patch in a while.

 

Re:Funny thing is that Zone Alarm has had vulns

[ColaMan]

How hard would it be for Microsoft to add a patch CD to the box, or when patches are released to ship patch CDs..... to people that ask nicely for them?

It seems that it's not that hard, seeing that they already do.

Your homework for today is to find the link at Microsoft's site that lets you get a copy of the SP3 security update CD mailed to you, and post it below. Extra points if you can write a script that goes through your local phone book and orders a CD for each person.

Re:Funny thing is that Zone Alarm has had vulns

[sm62704]

Your homework for today is to find the link at Microsoft's site that lets you get a copy of the SP3 security update CD mailed to you

Too easy; a comment above my comment already linked it. I never had internet through AOL but they managed to send coasters without my logging on to their site to order them. Microsoft should be AOLing the security updates; nobody should have to log on with an unpatched machine to hunt for links to order the CD.

Does Microsoft still charge for the CDs?

Re:Funny thing is that Zone Alarm has had vulns

[sm62704]

I'm sure computer manufacturers, especially the bigger ones like Dell, would sell their computers pre-patched, but I build my own computers (I'm surprised anybody at /. buys whole systems for themselves) and was wondering about the boxed sets.

Does Microsoft have retailers return boxed sets every patch cycle? because my copy of XP was on one CD.

Re:Funny thing is that Zone Alarm has had vulns

[LO0G]

Usually "unpatched" means XP RTM. Microsoft hasn't sold XP RTM in about 5 years.

Re:Funny thing is that Zone Alarm has had vulns

[Anonymous Coward]

If you think of yourself as the goverment of the city and your programs as the citizens, then I guess it's an ok analogy. It sound like just what most people would want.

Re:Funny thing is that Zone Alarm has had vulns

[everett]

You own your car vs you own a license to Microsoft's Operating System.

There's the difference.

Re:Funny thing is that Zone Alarm has had vulns

[i.r.id10t]

Nope, just got a new Dell with XP on it 2 weeks ago for a friend, and it came with just XP SP2 - no other updates, etc.

Re:Funny thing is that Zone Alarm has had vulns

[rabbit994]

I believe if buy XP, it will be SP2 or 3 now. Not really sure. I don't buy whole system for myself but at work, they are Dell Desktop shop.

http://www.newegg.com/Product/Product.aspx?Item=N82E16837116195 -- XP retail copy from newegg with SP2 preinstalled.

Re:Funny thing is that Zone Alarm has had vulns

[Sancho]

From the first bit of the first article:

The survivaltime is calculated as the average time between reports for an average target IP address. If you are assuming that most of these reports are generated by worms that attempt to propagate, an unpatched system would be infected by such a probe. ...
With the help of honeypots, we can measure the survival time. For example, we can use low-interaction honeypot such as nepenthes or amun that emulate common network-based vulnerabilities and deploy them at different locations. The average time it takes to download the first binary is an estimation of the survival time: The honeypots emulate known vulnerabilities and are thus exploited by different kinds of autonomous spreading malware - similar to an unpatched system.

Honestly, this is FUD. They weren't putting a live Windows system on the net, they were putting a honeypot and counting any attack traffic. Default Windows defensive measures (such as the firewall) wouldn't count in this experiment, nor would new OS releases. An unpatched SP2 is a lot more secure, even with the firewall off, than an unpatched SP0.

How hard would it be for Microsoft to add a patch CD to the box, or when patches are released to ship patch CDs to retail outlets like Best Buy and Circut City for their existing stock? AOL used to send me coasters every damned week, why can't Microsoft?

You can request CDs with patches, but I don't know if that includes the whole OS. Microsoft does ship out SP2 to vendors, now, and vendors can slipstream their own patches. Also, if you do a network install, you can slipstream whatever you want.

Re:Funny thing is that Zone Alarm has had vulns

[kesuki]

"if you hadn't installed a 3rd party FW in to your Windows XP computer, you'd be safe."

http://www.firewallleaktester.com/tests.php

http://tooleaky.zensoft.com/

"This program very clearly penetrates every firewall on the market, including Zone Alarm. It sends data out to a server (in this case, grc.com, just like Steve Gibson's LeakTest), and then retrieves data in response--completely bypassing your firewall."

the thing is, he wrote a 3k program that uses IE to get internet data, if you allow IE, every program is allowed by outbound firewalls, as far as not protecting inbound, windows firewall is still the worst, it doesn't specifically block any inbound data to any default windows service that i can tell... it just lets a completely strange computer connect on netbios because that protocol is supported for file and network sharing, regardless of if you have it turned on on not.

which means of course, that if you go online to download your patch you're already hosed. this is why i downloaded and pre installed SP3 on every system i had to maintain in any event of a format, before connecting the internet, i also install a decent firewall before as well.

Re:Funny thing is that Zone Alarm has had vulns

[nabsltd]

I believe if buy XP, it will be SP2 or 3 now.

Technically, it would have to be both SP2 and SP3 to get close to "current", since SP3 is unlike every other previous Service Pack released by MS (at least as far as I remember). SP3 rolls up all the patches since SP2, but does not include SP2 patches. It does obsolete some of the patches included with SP2, but not all of them.

So, for as much protection as possible (while still running Windows XP), you need to install SP2 then SP3, then a few more patches that have been released since SP3.

Re:Funny thing is that Zone Alarm has had vulns

[buswolley]

I'm not quite a newb or anything. But, how do you know if you've been owned? Standard anti-virus checks? Something more difficult to detect?

Re:Funny thing is that Zone Alarm has had vulns

[floorpirate]

I remember when Microsoft allowed users to order a free security update CD from their website - a good 2 or 3 years ago, I think. They shipped it free of charge. I just searched their website but couldn't find anything similar - the closest was DVD images available for download - images of each of their Patch Tuesday files for all their operating systems - but it doesn't appear to include the previous updates (I didn't read the whole thing so I could be wrong)

Hooray for SP3, and more hooray for AutoPatcher.

Re:Funny thing is that Zone Alarm has had vulns

[jonbryce]

Windows XP pre SP2 didn't come with a firewall. So an unpatched system (ie one that didn't have SP2) would be vulnerable.

Re:Funny thing is that Zone Alarm has had vulns

[Anonymous Coward]

You're simply talking out of your ass and you're giving the typical knee jerk reaction against Microsoft products. You do not have a single example of where Windows XP SP2 firewall is vulnerable to a remote exploit and there isn't a single example of hackers getting through it if all ports are closed.

Microsoft disagrees with you:
http://www.microsoft.com/technet/security/bulletin/ms08-001.mspx

Note that XP SP2 and Vista are both vulnerable to those two exploits, THROUGH the default-enabled firewall, for a full remote exploit vulnerability, using only TCP/IP - AKA only the network cable needs connected to a network, with at least one other machine exploiting this. That is possible with a network of two computers!

Re:Funny thing is that Zone Alarm has had vulns

[zonky]

Mod Parent up!!

Re:Funny thing is that Zone Alarm has had vulns

[Allador]

I'm confused then. If what you say is so, and Microsoft's firewall is rock solid, then how could an unpatched Windows installation be pwned in less than four minutes as the summary says? I guess I need to RTFA (grumble mumble).

RTFA. :)

Seriously though, if you read it, the testing was done using a honeypot that _emulates_ many different OS's.

It's not clear from the writeup whether this also emulates the windows xp firewall.

My guess from the reading is that its effectively emulating a windows box WITHOUT a firewall, so is a fairly useless measure for real world use.

Re:Funny thing is that Zone Alarm has had vulns

[cbhacking]

Last I checked, XP's firewall wasn't capable of outbound filtering. Vista's is, but the default rule (easily changeable, but default nonetheless) is to allow all outgoing traffic. Since malicious software generally must reach the system before it can phone home, this is probably not a problem when considering situations with no user interaction.

Re:Funny thing is that Zone Alarm has had vulns

[ColaMan]

You can call them, if you want , and they'll send one out. I've never done it myself - one would hope that you could find your way to the right person by looking them up in the phone book. Knowing the labyrinthe process involved in Big Business, I'd set aside a good couple of hours.

Anyway, from the beginning of XP (that is, there was an update CD prior to the release of SP1),they've been free of charge. I can't recall offhand if there was such a CD with previous incarnations.

The problem with sending them out to all-and-sundry is that people often don't register (as opposed to "activate' - bah!) their copy of windows, so there's a lot of difficultly direct-mailing them. I suppose they could do as you ask, and keep them in major shops, but it is a lot of wastage, AOL-style. It's not the kind of thing that's useful if you don't have a copy of windows on hand, unlike an AOL CD, which can serve a (quasi)useful purpose by itself.

I guess there's no easy answer, hey? Unless they were rewritable CD's.... that'd be pretty good.

Re:Funny thing is that Zone Alarm has had vulns

[You ain't seen me!]

I'm sure computer manufacturers, especially the bigger ones like Dell, would sell their computers pre-patched

I got a new DELL desktop 2 weeks ago. Inside the box was a DELL Vista SP1 image install disk. It wasn't until 2 days later I checked and realised the PC didn't have SP1 installed. I guess they were shipping older pre-imaged disks on their new PCs! Maybe they were relying on auto-update to sort out their omission because the invoice definitely said Vista SP1 installed.

I'm surprised anybody at /. buys whole systems for themselves

I've brought 2 DELL PCs in the past year - and both worked out about 70GBP ($140) cheaper than getting the cheapest individual parts.

Re:Funny thing is that Zone Alarm has had vulns

[sm62704]

I'm surprised. I reuse hard drives, monitors, video cards, keyboards, mice, and everything else. When I upgrade I usually get a bare bones box; just a motherboard, case/power supply, CPU and memory. And it annoys me that I usually can't reuse any of those components because they're usually incompatible with earlier gear.

I wind up spending less than $200 for an upgrade. Time for me to do it again; the power supply (I think; I haven't opened the case yet) died in mine. I've been too busy/lazy to work on it and am using an old one someone gave me who upgraded his by replacing the whole thing.

Best thing to do is have a router with NAT enabled

[George_Ou]

Best thing to do is have a $20 router with NAT enabled by default. It allows you to share your Internet connection with NAT, automatically log in to your PPPoE account, give you a DHCP server, and give you a safe environment with all inbound ports blocked by default. Most Broadband services come bundled with a router/modem in a single device anyways and it's been a non-issue at least for AT&T DSL users since NAT is enabled by default. A lot of cable providers are also sending out routers with new service.

I do agree with you that downloading an offline SP3 installer is a good thing though I would suggest that using nLite to slip stream it in to a new ISO and CD is the best way to go.

You can't lay all this at Microsoft

[tjstork]

If the internet is so f--- up that plugging a new computer onto it brings it under immediate attack, then, well, the good guys have -lost-.

It's really time to start unplugging bad guys from the internet period, applying stricter filtering at the ISP level, and more rigidly filtering countries who don't police their networks.

Five minutes to be attacked? The internet is LOST.

Re:You can't lay all this at Microsoft

[You2]

nononono. it's not five minutes to be attacked. it's five minutes until I get a new machine.

Re:You can't lay all this at Microsoft

[FlyingBishop]

You do realize how many grandmothers are under the control of the bad guys, right?

Re:You can't lay all this at Microsoft

[tjstork]

You do realize how many grandmothers are under the control of the bad guys, right?

And who opened the door for that? Why should Grandma have to have her computer ripped up so that some 20 something kid can be all gushy eyed about some Star Trek future and say hey "what happens when we plug a lawless country into this thing."

Does Grandma want to talk to non-western nations? Why should she, via her PC operating system expense, be forced to pay the incremental cost of a security that she doesn't want to use.

That's like saying, geez, there would be no gun crime if everyone owned a gun. Note that I'm a big second amendment guy, but, the argument of saying that to protect the right to have a gun, everyone must buy a gun, is rather wrong in and of itself, and so is the argument that everyone must invest in virus protection, firewalls, buffer overrun checks in everything, and denial of service and timeout monitoring and patches and all of the other crap that we have to do to have criminals on the internet.

Re:You can't lay all this at Microsoft

[Joe Snipe]

You have to take a lot of bad to get alot of good. The sentiment of your post is similar to statements calling for Non-nuetralality, and in my opinion will be the argument that leads us to it. When you start saying "unfiltered internet, except the stuff I don't like," THAT is when the internet is lost. It's true that this is a bad situation, but I would hardly call the vulnerabilities of an oudated (but admittedly popular) OS a fault of the internet.

Does this include SP2 installs?

[Anonymous Coward]

I'm confused. No details given.

Re:How about a VM on NAT in a firewalled host mach

[EvanED]

It'd be behind a NAT, so you'd basically be safe. (Of course you're never completely safe, but you have to pound hard to get through a NAT that doesn't have ports opened administratively.) The fact that it's VMWare providing the NAT doesn't matter; you'd see the same if you were to plug in a cable modem router.

This is actually a good argument for open source.

[Anonymous Coward]

And the argument goes like this:

If you buy a Windows PC, you (hopefully) get a restore disc. This restore disc is locked in time and is your only avenue for reinstalling the OS, short of buying another copy of Windows. Every time you have to reinstall, you are more vulnerable because more exploits exist while your restore copy has not improved. You must go online to get up to date which will take longer as you get further behind in patches. So, your odds of ownage go up every time you have to reinstall.

With open source, you can always reinstall with a recent version of your OS at no extra charge.

Re:... and if you leave your car key in the igniti

[Anonymous Coward]

this is for an UNPATCHED version though, i fail to see how they "keep messing up" when in fact, a patched version of xp doesn't have this problem.

Re:... and if you leave your car key in the igniti

[Anonymous Coward]

Really? So if I install Red Hat 7.2 I will not get owned?

The software is over 6 years old and plenty of vulnerabilities have been found and patched.

The article is light on details, so I am assuming they are not using XP SP2, which has the firewall turned on by default.

XP Release Date October 25, 2001
Red Hat 7.2 Release Date October 22, 2001

Ever tried that with Red Hat 7.3

[Britz]

There are still hosting companies that offer virtual machines and even complete servers with Red Hat 7.3
So I would be interested in the time it takes for that one to be infected.

Do they even give patches for that any more?

I am not trying to say Linux or Windows is safer. I am just trying to say it might not be wise to put an unpatched machine on the net without a firewall to download patches. Regardless of the os.

Re:Ever tried that with Red Hat 7.3

[Nimey]

Good $DEITY. Whyinthehell would they offer something /that/ old? It's not like they have to pay extra for something more modern like CentOS.

Re:Ever tried that with Red Hat 7.3

[sciencewhiz]

The Fedora Legacy Project supported Red Hat 7.3 and many other Red Hat versions (until the entire project shut down earlier this year)

ISP Netblock

[ivan_w]

Hmm.. why "ISP Netblock" ? does this mean that if I'm behind a PA block I am more in danger than behind a routable PI block ?

--Ivan

Windows

[Anonymous Coward]

If you use windows you need to die.

5 Minutes?

[EmagGeek]

So basically, my Windows Box will be pwned before I even get to the login prompt?

nice..

No entry point on a Linux installation.

[DrYak]

an unlocked Car is liable to be stolen.

except when the car is in a locked garage.

Back to TFA :
- ISP should react and only provide routers with decent security : with built-in firewall enabled by default. No more dumb modems given out to clients.

This actually got me thinking, even Linux has it's vulnerabilities from time to time, but I could argue it's MORE vulnerable because of all those Ubuntu Live CD's people have lying around. {...} Luckily, Linux is pretty good at not getting owned so it's a bit of a non-issue at the moment, but I dare say it's only a matter of time before someone starts targeting them as well.

- The fundamental difference is that on almost every linux cd, be it install CD or rescue CD.
Absolutely *ZERO* service are running and listening. The only contact between the box and the intertubes is done using a fucking simple downloading program that only downloads packages from (user-specified) repositories. Unless the network stack it self is bugged, there's no entry point for a potential exploit.
All installers first give you the opportunity to download upgrades (or even use update repository during installation) and first require you to setup user password, and only then let you open ports on the firewall (closed by default) and start services (even SSH).

And this has been the situation for several years.

You can plug a freshly installed and not yet patched Linux to the internet and nothing will happen because, well "the cable is plugged in" pretty much sums it and nothing else is happening. No exploitable deamons, not even ssh unless the users starts it.

A fundamental bug in the network stack it self is pretty much the hacker's last hope. But those doesn't seem that much frequent in the Linux kernel.

Re:No entry point on a Linux installation.

[neokushan]

I'm not disagreeing that Linux from 4 years ago is probably still leaps and bounds ahead of Windows today in terms of security, but bugs will be found that can give an outside user access to the system. It's not a case of if, but when.

Security should never be stagnant, just as nobody should ever think "ok I'm behind a router, I'm safe", nobody should ever think "I'm running Linux, I'm safe".
You should always assume that there WILL be an exploit out there that can own you and do what you can to prevent it - mostly, just patching and staying up to date is enough, even on a windows box, but if that's not an option then you should always be extra vigilant, no matter what OS you're running.

Re:No entry point on a Linux installation.

[Anonymous Coward]

an unlocked Car is liable to be stolen.

except when the car is in a locked garage.

I leave my LOCKED car in my UNLOCKED garage you insensitive clod!

Re:No entry point on a Linux installation.

[DKlineburg]

Yet I remember a story somewhere a while back that MAC users see no reason to have anti-virus software running. Maybe you should give them the memo.

Re:No entry point on a Linux installation.

[miro f]

I've been doing a lot of work with CentOS and it has at least SSH running by default. I believe Fedora is the same.
Ubuntu does well by having no services listening by default but not all linux distros are the same

Re:No entry point on a Linux installation.

[Kamineko]

Thank you for that piece of information. Stand by while I steal your garage with your car in it.

I've seen spam in 5 minutes

[Thyamine]

I was setting up my home system after reinstalling Windows (probably SP1 as this was a while back), and had the system connected to my cable modem directly. And almost immediately after booting my system I started receiving messages through the alert (messenger?) service about all the wonderful things I could buy from someone or somesuch thing. So I can completely understand how something worse could happen.

Re:I've seen spam in 5 minutes

[Dr_Barnowl]

That's not pwnage though, that's a normal feature of the OS being abused.

My advice to anyone on this matter is to never connect any desktop OS directly to the internet. Always put it behind a firewall with an OS specifically designed to be a firewall.

Windows in particular has too many things enabled out of the box though. I think some of the network-listening services are required for normal operation, even if the box is a standalone workstation.

And that's Own

[Trogre]

... with a capital 'P'

Re:wholesale jewelry

[jank1887]

That's just irresponsible netizen-ry. How could you suggest such a thing. In fact suggesting such a thing could be seen as trying to coordinate a DDoS.

I, on the other hand, was more than happy to visit their home page and see what they had available. For some reason, however, I had to keep reloading to try to get proper page display. This could have been my browser or their site, not sure. After... 50-100 attempts at reload correction, I gave up. Oh well. I sure hope no one else has this problem.

Re:... and if you leave your car key in the igniti

[dontPanik]

The problem is that people know that not leaving their keys in the ignition is a no-brainer. What they don't know is how to be safe online, because it's not as intuitive.

Been there, seen that

[djsath]

Yep, I own a very old XP pre-SP2 install CD. I was reformatting an old box of mine and forgot to download SP2 (this was before SP3). No big deal, I'll just get the network install off Microsoft's site. Bad idea, within minutes I was infected with all kinds of stuff. I ended up reformatting and downloading the patches off my linux box. I really need to learn how to slipstream my install disc...

:-) I agree! Kick unpatched XP users off the net

[Ox0065]

If the internet is so f--- up that plugging a new computer onto it brings it under immediate attack, then, well, the good guys have -lost-. It's really time to start unplugging bad guys from the internet period, applying stricter filtering at the ISP level, and more rigidly filtering countries who don't police their networks. Five minutes to be attacked? The internet is LOST.

!SIGH! The machines running the attacks are unpatched Windows XP boxes that have already been infected

This is happening because Microsoft shipped a version of Windows with services (designed with little or no consideration of security) turned on by default, but without providing any form of firewall.

!YES! This was a long time ago, but the effects are stil being felt. This is not your ISP's fault. It IS your beloved Microsoft's fault.

How would you feel if your ISP kicked you off the internet because you are using a badly made operating system? That's what the end result of your proposal would be. Unpatched Windows XP users would get kicked off the internet. That would probably solve the problem, and I can definitely see an argument for it, but I don't think that was what you really meant, was it?

Re:How is this measured.. My experience

[Nichole_knc]

I have seen the same thing. Sometimes it is almost "instant". As soon as the computer is recognized, within a minute, attacks begin. As indicated usually does not require any interaction at all.. Gee gives PnP a new meaning. I would give an educated guess that your connection has a lot to do with it.. Static vs Dynamic, known services running on the same IP.. It is fun to build a machine, install a windows flavor and DMZ it just to see what happens. It is also a great "show and tell" tool for the virtue of a Linux distro over windows.. "Watch this"

Re:... and if you leave your car key in the igniti

[VorpalRodent]

I did that once...except my car was running at the time. I walked inside to take in the groceries, forgot that it was still idling. I came back out the next morning to go to work, and my car was already warmed up for me (minus quite a bit of gas).

But yeah, while I lived in a seedier area of town at the time, "seedier" doesn't mean much in a rural Midwestern city.

Doh!

[Anonymous Coward]

MS should just save everyone time and sell Windows pre-infected.

Re:How about a VM on NAT in a firewalled host mach

[Creepy Crawler]

Not true at all. It's a common misconception that NAT protects anything at all. Why so?

NAT uses translation routing based upon multiple inside computers to one outside address. The key here is the NAT device does NOT reconstruct packets if they are heavily fragmented. Even upper end Ciscos and Junipers are vulnerable to fragment based attacks.

The key is you construct a IP-IP tunnel to target victim, try to guess the internal IP addressing scheme, and then use a program called Fragrouter to properly "make mal-fragmented packets". Once you do this, it will hop over damn near every router.

I think there's a setting in IPF that forces reconstruction before passing packets. That's the only defense, along with a proactive filtering in both directions.

Thanks, I'll let Grandma know

[Anonymous Coward]

nt

Re:Thanks, I'll let Grandma know

[Toreo asesino]

:D

But! The adverts are true! AD/WSUS are so easy, even SHE could set it up!

Zonealarm won't save you anymore...

[Anonymous Coward]

A year ago, the time it took to download ZoneAlarm was shorter than the time it took to own your box.

Luckily, I carry the latest version of ZA in my mp3 player just for this reason.

Re:XP3 Service Pack

[Anonymous Coward]

Thanks for those links - I'm burning an image to CD right now. But where does Microsoft publish the md5 hash so I can make sure what I downloaded is what it should be?

It's the network admin's fault.

[tjstork]

This is happening because Microsoft shipped a version of Windows with services (designed with little or no consideration of security) turned on by default, but without providing any form of firewall.

My point is that we should have a national infrastructure where someone could plug their computer into the internet, regardless of operating system, and suffer no attacks at all. Consumers should not be forced to buy anti-virus software or firewalls or even have to worry about security. Your argument essentially says that consumers who pay for operating systems, be it indirectly via services or EU taxation, in the case of Linux, or through a PC tax in the case of Microsoft, should be required to pay in both inconvience, and costs.

Any why is this so? This is happening because a minority of users want to have an Internet that is universally open and world wide, and that they want to have all internet traffic remain essentially anonymous.

So, so that a minority of users can anonymously talk to Russia (which originates many of the bots), we have an entirely internet where the western world has to have every citizen under continual assault.

I would argue that, many people would be willing to trade anonymity for internet security in a heartbeat, and so, to an extent, the internet policy we have is entirely undemocratic.

So no, it is not Microsoft's fault that Windows is under assault, any more than it is the fault of a man walking down the street without a pistol for getting robbed. It is the fault of the people that built the internet, and say, hey, let's plug in a bunch of countries that have no laws and no values into it, and we've been paying for it ever since.

Imagine how many more choices we might have in operating systems and network services, if in fact, we did not have to worry about security up and down the entire stack.

It's too much money. Kick Russia off of the internet.

Re:It's the network admin's fault.

[Ykant]

My point is that we should have a national infrastructure where someone could plug their computer into the internet, regardless of operating system, and suffer no attacks at all.

So... you basically want like, a Great (Fire)Wall of China?

Re:It's the network admin's fault.

[tjstork]

So... you basically want like, a Great (Fire)Wall of China?

Yes, but with the twist that people can get their systems certified to allow open access. Basically, if you run a device with a particular OS, the ISP would offer a direct access service and a surcharge to basically allow your computer to be open so long as it had a secure operating system and firewall combination. So basically, yeah, ironically, what the original poster said was true, is that, I would be kicking every old computer off the general internet and put them into safety internet land, and then let people who actually take care of the computing environment get open access. The downside of this, of course, is that it does create an internet rife for abuse by the government, and that I'm not particularly with, but, if, we're downloading virii and bots faster than we can circulate patches, you kinda need the government to step in and trust that your democratic processes are enough to keep it open and honest. Free enterprise doesn't build 20 aircraft carriers and an atomic bomb to go get them japs after Pearl Harbor, that's government work.

"What is Service Pack 3?"

[westlake]

Sadly this is not very well known especially amongst those who need it the most, and MS doesn't go out their way to make it very clear either.
.

I don't think it gets much easier than this:

What Is Service Pack 3?

Read the XP SP3 white paper.
Steps to take before you install SP3
Download SP3 from Windows Update
Order SP3 on CD-ROM
Download and deploy SP3 to multiple computers [Network Installation for the IT Professional]
Free [basic] unlimited installation and compatibility support
---your choice of e-mail, online chat, or toll-free telephone.
TTY/TDO service for the hearing-impaired

durrrr....

[Real1tyCzech]

"The researcher stipulated that the sub-5-minute estimate was valid for an unpatched machine in an ISP netblock with no NAT or firewall"

No firewall? Like the one *built in* to windows?

No NAT? Like the one's used for damned near *every* DSL connection and easily over 80% of Cable connections?

Ahh... nothing like some totally unrealistic anti-MSFT BS to get the morning started....

TC0

[xtracto]

Bah,

We all know that Microsoft Windows has a lower Total Cost of 0wnership

Make Them Default Closed Except to Microsoft.com

[Doc Ruby]

If Microsoft set every fresh Windows install to connect to only Microsoft.com on the Internet until either Microsoft.com, or the console, or some other specific named/numbered host said that Windows is "safely* patched", then this race condition would not be a problem. They could allow the "patch lock" on network access to be released by the installing operator at the console, or that operator could set a pointer to some other machines allowed access, or Microsoft.com's patch servers could send a list of servers. All other network access would be locked out until someone authorized said the machine was ready to connect to the general network/Internet access.

Such a revision should take a couple of Microsoft programmers a week or so to implement and test. Of course, if Windows were OSS, then anyone in the Microsoft developer community could patch Windows to work right. And anyone could inspect that patch to ensure that it worked right, before trusting it not to be just another security hole.

But of course, Microsoft is so far from anything approaching real openness or modern security practices that its fundamental insecurity in an Internet environment is one of its basic features. Its most prized feature on the hundreds of millions of machines compromised worldwide, many the first time they're connected to the Internet, among the bad guys out there who love Microsoft's closed and counterproductive "security" practices even more than Microsoft loves them.

(* OK, Windows is never "safely patched", but it's a start.)

Firewalls work.

[Anonymous Coward]

I just patched my wife's XP box last week - the previous update was applied January 10th, 2006. It has been continuously hooked up to DSL or cable broadband for the last 7 years.

My wife browses the web via Firefox for about 3 hours a day on average, and has received tens of thousands of e-mails (spam content in the 10-20% range) into Eudora in that time (more in Yahoo mail - spam content 99%+ in yahoo). I used to run Zone Alarm occasionally if I got paranoid, but it has been disabled most of that time - it never found evidence of active malware. I have only run Trend-Micro's housecall web-based virus checking software on that machine a couple of times in the last 7 years (including last week) - it has never found an active infection, though it did turn up hundreds of viruses in e-mail attachments, and bitch about the missing patches. No other virus protection software is used, and windows software firewall is always disabled.

We have three Wordpress blogs, and one of them got minorly 0wn3d by a worm (and subsequently flagged as a malware site by Google) - that's what got me paranoid and checking the XP box for infections - none found.

If you have a simple hardware firewall, and you're not an idiot about downloading executables or opening strange attachments (as my wife apparently is not) - the time to 0wnage is measured in years.

How long for unpatched, 1.0 version of Teh Lunix?

[Anonymous Coward]

I'd be curious to see the same issue done on, say, version 1.0 of Ubunghole Lunix or something, perhaps even Leoptard 1.0 (if they can get it to work without blue screening).

Re:wholesale jewelry

[ultranova]

Really ? But how can I be sure this is not fraud ? Maybe these people are thieves ? Maybe they sell counterfeit glass beads ? And can you prove they're not funding terrorists in order to assassinate president Bush with a radiactive dirty bomb, or perhaps even poison ?

Those filthy spammers ! I sure hope they'll get the bad reputation they deserve !

Installation procedure with XP Pre SP2 CD:

[mikeasu]

Last XP install I did was last fall on the home computer. Even before working behind a router, the usual procedure for me, with the pre-SP2 XP install CD is:
1. Keep computer unhooked from the internet during installation from CD
2. "Activate Windows Later" - not even trying this yet:
3. Under local area connection > properties > advanced > Windows Firewall (I think) - enable this sucker. Again, pre SP2 firewall.
4. Go directly to microsoft.com, do not pass go, do not collect $200 - start updating, get the SP2 firewall up. You can also activate windows at this point.
5. Update everything else.

Again, YMMV, but this has worked just fine for me.

Re:... and if you leave your car key in the igniti

[sjames]

So what procedure requires me to leave my key in the ignition?

If you can't connect to the net without updates, and you can't update without connecting to the net, what is your suggestion? Surely not keep trying till you hit the lottery.

Re:wholesale jewelry

[JCSoRocks]

Did you try holding down "Ctrl" while you reloaded? That way you know you're getting the latest version of the page instead of just checking against the cache.

Re:... and if you leave your car key in the igniti

[sjames]

Really? So if I install Red Hat 7.2 I will not get owned?

I can't think of any version of linux current enough to even still have security support that will get owned between the time you connect it to the net and the time the security updates are complete.

A much fairer test: New-in-box behind NAT

[davidwr]

A much fairer test:

Unbox machine.

Plug it into a NATted network.

Turn it on and log into Windows. If your computer asks you questions during setup, take all default options and enter reasonable but naive replies to questions that don't have defaults.

Start the stopwatch.

Walk away.

If the system fully patches before you are owned then it's a good sign.

And Yet

[fast turtle]

Microsoft has released SP3 as an ISO image that can be conveniently burned to disk for offline installation and "YES" I have a copy of the ISO along with several copies of the burned disk to give to friends on dial-up.

Re:wholesale jewelry

[WNight]

Irresponsible? They contacted you using your bandwidth and Slashdot's. I think that's a pretty clear invitation. No language in the invite indicated that there were rules to follow or that you were expected to purchase anything.

In fact, they told us about their web. If it's anything like the other (WW)web then there's a ton of stuff there, including porn, if only we did deeply enough. We can't disappoint them by not playing with it.

BTW How long until people buy crappy ads for the competition (anonymously, like spam must be paid for) just to make them look bad?

Re:How about a VM on NAT in a firewalled host mach

[Buelldozer]

I was prepared to argue with you until I thought about it for a minute. What you're saying is really worrisome and it sounds plausible on the face of it. However if it was really that easy almost every machine on the Internet could be rooted with almost no effort.

Where can I learn more about what you are talking about?

Re:Make Them Default Closed Except to Microsoft.co

[PPH]

Such a revision should take a couple of Microsoft programmers a week or so to implement and test.

I don't do Windows, but I'll venture a guess that this could be done with firewall settings and would take a couple of hours.

Of course, if Windows were OSS, then anyone in the Microsoft developer community could patch Windows to work right. And anyone could inspect that patch to ensure that it worked right, before trusting it not to be just another security hole.

And then they'd spin off their own Windows distro. Microsoft would either have to catch up or go broke when the new, secure version hits the market.

Ain't the free market great?

Re:How about a VM on NAT in a firewalled host mach

[MLS100]

According to this site, IPTables has

# Automatic fragmentation reassembly - Connection tracking automatically reassembles fragmented packets for examination.

negative value...?

[modul8]

Hey all...

During the blaster/codered days, I witnessed a win2000 (yeah, slightly off topic, i know) workstation fall victim DURING THE INSTALL (prior to install completing / prior to the first real boot into OS). This occured shortly after the network configuration etc screen that is displayed after TZ / regional configuration...

reminds me of some multiplayer-game respawn location exploitism (don't remember which game[s])

Re:How about a VM on NAT in a firewalled host mach

[Creepy Crawler]

There really isnt any "manual" you can learn about this kind of stuff. However, we all have the toolkit to test and investigate with it at our homes.

1. Search fragrouter in google first. All hits on front page are on topic. Get it and compile cleanly. I prefer Debian, but works for all Linux.

2. Go buy a router from any ol box store. I prefer the WRT54G ones that can be modded to run either DD-WRT or OpenWRT.

3. Get some test machines up and running, including a separate machine running DHCP on the "Internet" side of the router. You'll want to fake a internet connection with this, so tell the router to pull DHCP from the "Internet" box. The Internet Box is your attacking machine. You will want to set up NAT if it's not already.

4. Set up fragrouter and proper routing utils on the attacking box ("Internet" machine). You can use your real network as the attacked network, as you wont cause damage. fragrouter has something like 14 options of bad routing. You can use this in conjunction of other routing daemons and others that exploit active services already existing on the el'cheapo router.

5. Since you have inside knowledge about your network, you can easily guess the subnet mask and ip addressing scheme and "hack through" the NAT.

I've done precisely that on many routers, including mid-range ciscos. And as I said before, the only machines that are immune from fragmenting attacks are ones that piece back together packets before they are passed on to the internal network. OpenBSD, FreeBSD, and Linux can do this reliably ONLY with a large amount of ram and fast CPU.

Good Luck.

Re:This is actually a good argument for open sourc

[buswolley]

not to burst your bubble, but M$ offers ISOs for SP3. Download it, and burn it on a disk. Alternatively, pay for shipping, and they will send you the CD.

Better strategy

[DrYak]

Security should never be stagnant, just as nobody should ever think "ok I'm behind a router, I'm safe", nobody should ever think "I'm running Linux, I'm safe".

I'm not saying that Linux has some magical power protecting it from ever being pwned.

What I'm saying is that, should the possibility of an exploit arise, the strategy employed in Ubuntu, openSUSE and SystemRescueCD (but apparently not in Fedora/CentOS, according to others in this thread) which doesn't open any service before the user has had an opportunity to set up and patch the installation, makes the box much less susceptible to being pwned during or straight after the installation.

The OP above was basically saying that it's an unfair test, because an un-patched machine is, well, unpatched and vulnerable, and that Linux could be vulnerable too given the big amount of old boot disk laying around.

I'm just point the fact that *there are strategies* that almost completely (minus the in-kernel stack bug) remove risk of such "pwned straight after installation" scenarios, simply by patching the machine first before exposing any pwnable service on the intertube.
Most Linux distributions and/or boot disks *are* following such strategies and are fundamentally hard to break.
Microsoft *is not* following these strategies and thus those "from install to pwn in 4 minutes" story are direct consequence of their poor choices.

Lack of proper package management

[DrYak]

An additional rant :

Microsoft can't bend time and space and retroactively patch ALL XP disks every time they release an update?

No, they should have provided a way to easily get the updates *while* the system is installing.

Of course Microsoft will never ever be able to deliver a "download patches while installation is underway" installer, simply because this require them to have a good nice decent package manager in the first place.
Not some brain-damaged system which is barely able to just add and remove icons on the desktop, and completely unable to actually remove unused components (like the several GiB worth speech technology in Vista). Their excuse is probably that the OS is so much tangled that probably it won't function anymore if the libraries happened to be removed and probably huge amounts of 3rd party applications rely on obscure COM provided by those un-removable applications.

For now, using nLite/vLite is your best solution to remove components (and even has some limited form of dependency tracking).
And slipstreaming the updates into the install files before even burning them and using them to install a machin is the only solution to add patches before the system has finished installing.

That's hardly something an inexperienced user could do.

Meanwhile, under Linux, it basically amounts to *not* clicking the "cancel" button when the installer proposes to add updates into the list of repositories from which the package will be downloaded.
One more proof that good package management is something that is definitely missing in the Windows world.

Because they used pre-SP2

[George_Ou]

"I'm confused then. If what you say is so, and Microsoft's firewall is rock solid, then how could an unpatched Windows installation be pwned in less than four minutes as the summary says? I guess I need to RTFA (grumble mumble)."

Because they used pre-SP2 which is more than 4 years old.

Re:Because they used pre-SP2

[KGIII]

Now George... You count as a reporter. *grins* (Sorry but I recall some people ranting that you sucked and so I figured I'd toss that in as an effort to be, well, me...) What did you notice? I was claimed, by the above, to have said that the Microsoft firewall is "rock solid." When, I think, my quotes are available for all to see. I could just be mistaken and have really said such a thing but they took "just fine" and interpreted it how they wanted. Something about water and the back of a duck? People will read and think as they wish without regard to facts.

I use most any OS out there as a part of business. I take a ration of crap for actually making a choice sometimes here. The reality is that I like Microsoft products and manage to use them securely and I'd like to *think* that the rest of the world could too if they took the time to actually know what they were doing instead of just buying something and bitching or not buying something and then bitching.

Criticism has its place but it has reached the point where a certain status quo has to be maintained. Any article, however mistaken or biased, that bashes a company that is not in favor is considered good. Any action that promotes whatever the current groupthink agenda is good. The irony is that the majority of the people who believe in these things will then mock Bush and his "if you're not with us you're against us" gibberish. (Yes, I call his stuff gibberish too. I think I'm the last person on the planet who believes in moderation as opposed to zealotry or extremism but I digress...)

You're wrong, SP3 does include SP2, but not SP1

[George_Ou]

You're wrong, Windows XP SP3 update does include SP2 stuff, but not SP1. When you use nLite, you have to roll in SP1 first and then SP3.

While they're at it, they should also try it with

[melted]

While they're at it, they should also try it with Windows 3.11. Hello! It's 2008 out there. How about you do the same test with Vista?

Win2K, anyone?

[Anonymous Coward]

Try putting a raw Windows 2000 machine on the Internet. Pwnd in 10 seconds at my home IP addresses. It's not pretty.

Yeah, go ahead, crack that live CD

[Nicolas MONNET]

1. Live CD don't have scores of services running

2. Live CDs run off of CD-ROMs. Hence the name: Live CD. You know what's great about CD-ROMs? They're READ ONLY.

Exploring The Windows Firewall

[westlake]

Windows firewall sucks at outbound protection, a lot
.

This is what Microsoft's Steve Riley had to say about outbound protection:

There's an important axiom of security that you must understand: protection belongs on the asset you want to protect, not on the thing you're trying to protect against. The correct approach is to run the lean yet effective Windows firewall on every computer in your organization, to protect each one from every other computer in the world. If you try to block outbound connections from a computer that's already compromised, how can you be sure that the computer is really doing what you ask? The answer: you can't. Outbound protection is security theater--it's a gimmick that only gives the impression of improving your security without doing anything that actually does improve your security. This is why outbound protection didn't exist in the Windows XP firewall and why it doesn't exist in the Windows Vista(TM) firewall.

Earlier, I said that the typical form of outbound protection in client firewalls is just security theater. However, one form of outbound control is very useful: administratively controlling certain types of traffic that you know you don't want to permit. The Windows Vista firewall already does this for service restrictions. The firewall allows a service to communicate only on the ports it says it needs and blocks anything else that the service attempts to do. You can build on this by writing additional rules that allow or block specific traffic to match your organization's security policy. Exploring The Windows Firewall

In one page, Riley covers quite a bit of ground.

Re:Exploring The Windows Firewall

[KGIII]

You can't ever be sure. There's the rub with any security on any system that connects to the internet. You can only make choices based on what you do know and what you need to accomplish. Some security systems use process identification in an effort to tag that process and tie it to it and then insist on user intervention to ensure that you're making an informed choice. Most end-users don't like it because it is too annoying for their taste. That too is subject to problems on a rooted machine or the ability for malware authors to run a spoofed process in the same memory space but it is a step in the right direction if we can condition people to be aware of their actions.

Re:Make Them Default Closed Except to Microsoft.co

[evilviper]

If Microsoft set every fresh Windows install to connect to only Microsoft.com on the Internet until either Microsoft.com, or the console, or some other specific named/numbered host said that Windows is "safely* patched", then this race condition would not be a problem.

...until someone found an exploit for whatever system it is that restricts connections to other sites.

Windows XP SP2 and up already enables the Windows firewall by default, and disallows any incoming connections, which is the most that can be expected.

Re:Make Them Default Closed Except to Microsoft.co

[Doc Ruby]

The system that restricts connections to other sites is the firewall. Exploits of that are already underway. What I describes doesn't add any new vulnerabilities. It only reduces them. That's how security decisions work. They don't work by throwing up your hands and saying that any change, even one that just reduces access, increases vulnerability. And saying that the status quo is better than the improvement, when the status quo is unacceptable, isn't a legitimate security analysis either.

Re:Make Them Default Closed Except to Microsoft.co

[evilviper]

Throwing in a feel-good measure, that doesn't actually improve security, isn't a legitimate security measure. Just because the status quo isn't good, doesn't mean ANY and all changes you can come up in 5 minutes on a napkin is an improvement.

Re:Make Them Default Closed Except to Microsoft.co

[Doc Ruby]

Maybe so. But instead of your purely theoretical abstractions, I actually described a security system that is what I personally designed for Northern Telecom and Microsoft almost a decade ago, before Windows Update copied the convenience features but not the closed system that's secure by default. We actually deployed our system in hundreds of public access terminals across Canada. So when I say that it would work for Microsoft, and what they'd have to do to make it work, it's because I spent a lot more than 5 minutes designing it (though we did use our share of napkins).

Compare that actual security analysis to the under 5 minutes you spent, without even a napkin, complaining about it without any factual or analytical basis.

Congratulations! You win the unacceptably bad status quo.

Re:... and if you leave your car key in the igniti

[Anonymous Coward]

Such pessimism..
You also live in the best neighborhood too! Me and BillG sent our packets to the same high school.

Re:Make Them Default Closed Except to Microsoft.co

[evilviper]

The fact that you've deployed a system to install updates, doesn't remotely imply it was or is secure. Certainly, online threats have become far more advanced in the past decade.

Re:Make Them Default Closed Except to Microsoft.co

[Doc Ruby]

The fact that you're complaining without any specific details or other qualifications means that I'm not reading any more of your posts. I've become far more advanced in the past decade.

Re:Make Them Default Closed Except to Microsoft.co

[evilviper]

The fact that you're complaining without any specific details or other qualifications

What is there to explain? The inherent limitations of "software firewalls" are very well-known. Without a separate (hardware) firewall, you simply can not possibly stop machines from being exploited.

Forcing someone to update as soon as the network is connected is still much too late. Your system gains nothing except a false sense of security, and monopoly lock-in (see alternatives like windizupdates.com).

Re:Make Them Default Closed Except to Microsoft.co

[cbhacking]

The newer Windows Server versions do something very much like this. Even if the didn't, all versions of NT since 2004 have a firewall enabled by default - but yeah, XP SP1 and down were pretty bad.

Re:Make Them Default Closed Except to Microsoft.co

[Geminii]

I can see this being a problem. Personally, I wouldn't want any systems under my watch blocking off internet connectivity until it'd phoned Microsoft and downloaded whatever crapware Microsoft thought I 'needed' to have before it would allow me onto the net proper.

A correct version would be to ask the startup questions "Do you want Windows to upgrade itself to the latest version during installation (Y/n)" and, on a Yes, ask "Where do you want to get the upgrades from? (Microsoft.com/other)". The defaults would behave like you asked, while still allowing people to patch from a local server or disk instead, or skip the updates entirely.

I do wonder why the activation of any network connection _during install only_ isn't delayed until appropriate basic firewall software is running and ready to monitor said connections. Once the install is completed, however, I don't want the boot process automatically killing all network connectivity if it gets its panties in a twist about version numbers or what software it thinks should be installed. That's my call to make, not Microsoft's.

Re:Make Them Default Closed Except to Microsoft.co

[Doc Ruby]

That is why I said that the operator could control the access lockout from the console while running the installer.

Re:Make Them Default Closed Except to Microsoft.co

[Doc Ruby]

They should go all the way, and make it simply like I said.

Funny how everyone screeching that this approach is impossible and useless doesn't even know that it's shipping right now. I guess some of the screechers are inside Microsoft, or it would just work the simple and open way that I described.