Infected in 20 Minutes
Posted: August 25, 2004, 2:36 pm
Infected in 20 minutes
I was reading an excellent article about the out of the box state of Windows XP and the big bad Internet. Basically the average time that it will take for an unpatched version of XP to become infected if not behind any type of firewall and if attached to the Internet is... 20 minutes.
The article mentions that SANS.org has provided an excellent guide for new XP users titled, "Windows XP: Surviving the First Day" which is designed to assist users in getting their PC set up with minimal problems. The information in the document is easy to read, and well-written, but largely mitigated if you purchase a PC that has XP-SP2.
I was reading an excellent article about the out of the box state of Windows XP and the big bad Internet. Basically the average time that it will take for an unpatched version of XP to become infected if not behind any type of firewall and if attached to the Internet is... 20 minutes.
Oh, that's how long your average unprotected PC running Windows XP will last once it's connected to the Internet ... before it's compromised and effectively 0\/\/n3d.
The SANS Institute Internet Storm Center released those eye-opening numbers a few days ago. Go take a look at their graph, and you'll note that the current time of 20 minutes is half that of what it was a year ago, although, to be fair, the average has been both higher and lower - over an hour last Christmas and only about 15 minutes in the spring. That hour at Christmas seems like an aberration, and the overall trend has definitely been downward, towards far shorter times before your Windows box is not really yours any longer.
As the SANS Institute notes, 20 minutes is not long enough to update your Windows PC before it is too late. If you take a new PC out of the box, plug it in to the Internet, and power it on, most people (most people? OK - a lot of people. Uh, alright - some people. Erm ... *sigh*. A few people. Happy?) know enough to immediately hie thee over to Windows Update and get the latest patches from Microsoft. Then reboot. And get more patches. And reboot. Ad infinitum. Oh, and don't leave out the latest anti-virus updates either. Gotta have those. Oh oh oh - don't forget Windows XP Service Pack 2, the gotta-have update from Microsoft, which "may be as small as 70 megabytes (MB) or as large as 260 MB".
The author goes on to say that you should install Firefox and Thunderbird from Mozilla, but I strongly disagree and as such I didn't include that.New PCs sold in a few months should have less of an issue with this whole mess, since they'll come with XP Service Pack 2 already installed, which means that the firewall will finally be turned on by default, which should help somewhat. In fact, I'd much rather have a friend call and ask why she can't play Star Trek StarFleet Command III 1.0 than have her call and ask me why her computer is running so slowly, and why she has these popup windows opening up all the time, and my goodness but they're nasty. But Service Pack 2 is only for XP, and 25% of users are still running Windows 98 ... or something older. Heck, 25% of all Windows servers are still on NT 4. Service Pack 2 sure isn't going to help those people.
For the good of the Net, and therefore for the good of all Net users, I'm glad that Microsoft's new service pack turns on the firewall by default. If applications break, too bad. If a user isn't educated enough to know how to open up a port he needs to run a particular program that needs a hole punched in the firewall, then that user shouldn't have unfettered access to the Net anyway. I'm almost getting to the point where I think that the best thing security pros could do for their friends and family still running pre-XP systems would be to tell them that they're going to upgrade their computers to the latest super-duper Microsoft service pack, and then do the following:
- Set Windows Update to automatically update the computer, without asking questions.
- Install a personal firewall that blocks almost everything by default.
- Buy a 2- or 3-year subscription to an anti-virus program and set it up to automatically download all updates.
- Buy an anti-spyware tool and set it up to automatically update, scan, and remove spyware.
The article mentions that SANS.org has provided an excellent guide for new XP users titled, "Windows XP: Surviving the First Day" which is designed to assist users in getting their PC set up with minimal problems. The information in the document is easy to read, and well-written, but largely mitigated if you purchase a PC that has XP-SP2.