Slashdot Mirror

← Back to Stories (view on slashdot.org)

Estimating the Time-To-Own of an Unpatched Windows PC

Posted by kdawson on from the 5-minutes-16-hours-whatever dept.

An anonymous reader notes a recent post on the SANS Institute's Internet Storm Center site estimating the time to infection of an unpatched Windows machine on the Internet — currently about 4 minutes. The researcher stipulated that the sub-5-minute estimate was valid for an unpatched machine in an ISP netblock with no NAT or firewall. The researcher, Lorna Hutcheson, called for others to post data on time-to-infection, and honeypot researchers in Germany did so the same day. They found longer times to infection, an average of 16 hours. Concludes the ISC's Hutchinson: "While the survival time varies quite a bit across methods used, pretty much all agree that placing an unpatched Windows computer directly onto the Internet in the hope that it downloads the patches faster than it gets exploited are odds that you wouldn't bet on in Vegas."

6 of 424 comments (clear)

  1. Offline updates by Fallen+Andy · · Score: 5, Informative
    For XP/Office/Vista, you owe it to yourself to use the Heise offline updates.

    Back in '04 the time to live was (claimed to be) around 20 minutes. I wonder what the time is for an unpatched Vista (the figures in the article are for XP). Heh - I bet '98SE survives forever (nobody would want to exploit that).

    Andy

  2. Re:How is this measured by Mistlefoot · · Score: 5, Informative

    Absolutely. SP2 firewall is enabled by default.

    And from the article "This older guide was written based on Windows XP pre SP2. One of its main feature
    was step by step instructions on how to enable the Windows XP firewall."

    XP SP2 was released in August of 2004. Why are we talking about 4 year old software? Heck, Firefox 1.0 hadn't even been released yet. And Ubuntu's first release was in October 2004.

    Why is an OS older than Ubuntu or Firefox being tested? And I mean 4 years older then Ubuntu - even with SP2 it would still be older then Ubuntu or Firefox.

  3. Re:How is this measured by CastrTroy · · Score: 5, Informative

    Because the last OS put out previous to Vista was Windows XP. That's why we are talking about such old software. It's only 1 version behind current. The biggest problem, is that there's a lot of people who have XP discs with no service pack incorporated. When you reinstall from these discs, and try to connect to the internet to download SP2, your computer is owned before you can even download the service pack. That's a major problem.

    --

    Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
  4. Funny thing is that Zone Alarm has had vulns by George_Ou · · Score: 5, Informative

    Funny thing is that Zone Alarm has had some serious remote exploit vulnerabilities where if you hadn't installed a 3rd party FW in to your Windows XP computer, you'd be safe. Here's an example of one http://secunia.com/advisories/10921/. Windows XP, Vista, Server 2003 and 2008 Firewall has been rock solid and secure. You're simply talking out of your ass and you're giving the typical knee jerk reaction against Microsoft products. You do not have a single example of where Windows XP SP2 firewall is vulnerable to a remote exploit and there isn't a single example of hackers getting through it if all ports are closed.

    1. Re:Funny thing is that Zone Alarm has had vulns by KGIII · · Score: 5, Informative

      To add to this I have helped write both the Outpost Personal Firewall and Kaspersky's Anti-Virus application. As the NDA is up I can admit to the latter. Simply put, you're full of shit. (Not the parent but the grandparent. George is right on.) The reality is that if one doesn't try to pretend they are smarter than the system than the Windows firewall works really well at INBOUND protection. Let me state this another way... If you have a clean system AND don't go screwing with the system's settings the Windows firewall will do just fine at getting you online safely. If your OS installation media predates this than you should really look at slipstreaming or a newer OS. Windows firewall sucks at outbound protection, a lot... As for inbound? It is fine and I will happily toss an image and an IP address up to those who disagree [no carrier] (Just kidding of course, it really DOES do the job of inbound protection. Safe hex and JUST the Windows firewall behind a NAT enabled router has served me well for a long time though outside of that I simply use Outpost.)

      --
      "So long and thanks for all the fish."
  5. Re:How is this measured by Gumbercules!! · · Score: 5, Informative

    I know it was pwned because during the installation I got an angry phone call from the Cisco Comms boys, who wanted to know why one of our servers was suddenly flooding the network with traffic matching the signature of the Code Red worm.

    Once the installation finished (now with the cable unplugged), sure enough, the box was infected with Code Red. No doubt because IIS installs by default (set to on) and my leaving the cable in allowed it to get infected.

    I was then embarrassingly the reason for a new policy stating all installations must be done with the network cable unplugged.