Just 12 minutes

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
I'm sure many here are very familiar with the notion that there is "a
50% chance of being infected by an internet worm in just 12 minutes of
being online using an unprotected, unpatched Windows PC." As many of you
know, this is a direct quote from a Sophos press release from July 1,
2005:

http://www.sophos.com/pressoffice/news/articles/2005/07/pr_uk_midyearroundup2005.html

Sophos got a lot of mileage from this press release. An interesting side
effect I've seen is newsgroup posts warning users of the dangers of
going online to patch an older, pre-SP2 version of Windows XP because it
will take more than 12 minutes, leaving many vulnerable to malware
infestation. Obviously, there are ways around this: download the entire
service pack (using another PC) and burning a disk so that SP2 may be
applied while the PC is offline and safe. Or users may get the
equivalent disk from Microsoft for a nominal fee.

But this begs the question: For the majority of people who choose to
obtain SP2 through automatic updates, *how* vulnerable are they exactly?
Of course, for those running SP1 or Gold, Messenger Service (which is on
by default) can be manually turned off. But again, for the majority of
people who have performed a clean installation without knowing to turn
off specific services, how vulnerable are their PCs?

I'm sure the study referenced in the press release talks about averages
and includes people who don't patch their systems and don't practice
other modes of safe hex. Messenger spam arriving informing a gullible
person that they have spyware or registry problems has happened many,
many times. People clicking on links in e-mails when they shouldn't be
doing so... well, you get the picture.

But what about a PC on the Internet that is not doing anything but
sitting there? Without the benefit of a firewall, hackers/bots can
attempt to do damage, for sure. But without any user input, is this
12-minute figure reasonable? Or is it more a case of marketing hype?
Specifically, what specifically can happen to an unpatched system,
assuming there is no user input (clicking on links, OK buttons in pop-up
windows, etc.)? Are there worms that can do damage this way, and if so,
what are they and what is the mechanism by which they infect a PC? How
common is real-time hacking in this sort of situation?



Re: Just 12 minutes


| I'm sure many here are very familiar with the notion that there is "a
| 50% chance of being infected by an internet worm in just 12 minutes of
| being online using an unprotected, unpatched Windows PC." As many of you
| know, this is a direct quote from a Sophos press release from July 1,
| 2005:
|
|
http://www.sophos.com/pressoffice/news/articles/2005/07/pr_uk_midyearroundup2005.html
|
| Sophos got a lot of mileage from this press release. An interesting side
| effect I've seen is newsgroup posts warning users of the dangers of
| going online to patch an older, pre-SP2 version of Windows XP because it
| will take more than 12 minutes, leaving many vulnerable to malware
| infestation. Obviously, there are ways around this: download the entire
| service pack (using another PC) and burning a disk so that SP2 may be
| applied while the PC is offline and safe. Or users may get the
| equivalent disk from Microsoft for a nominal fee.
|
| But this begs the question: For the majority of people who choose to
| obtain SP2 through automatic updates, *how* vulnerable are they exactly?
| Of course, for those running SP1 or Gold, Messenger Service (which is on
| by default) can be manually turned off. But again, for the majority of
| people who have performed a clean installation without knowing to turn
| off specific services, how vulnerable are their PCs?
|
| I'm sure the study referenced in the press release talks about averages
| and includes people who don't patch their systems and don't practice
| other modes of safe hex. Messenger spam arriving informing a gullible
| person that they have spyware or registry problems has happened many,
| many times. People clicking on links in e-mails when they shouldn't be
| doing so... well, you get the picture.
|
| But what about a PC on the Internet that is not doing anything but
| sitting there? Without the benefit of a firewall, hackers/bots can
| attempt to do damage, for sure. But without any user input, is this
| 12-minute figure reasonable? Or is it more a case of marketing hype?
| Specifically, what specifically can happen to an unpatched system,
| assuming there is no user input (clicking on links, OK buttons in pop-up
| windows, etc.)? Are there worms that can do damage this way, and if so,
| what are they and what is the mechanism by which they infect a PC? How
| common is real-time hacking in this sort of situation?
|

Using a NAT Router will mitigate the BOT/Worm threat as well as hacking attempts.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Re: Just 12 minutes

David H. Lipman wrote:
Quoted text here. Click to load it
http://www.sophos.com/pressoffice/news/articles/2005/07/pr_uk_midyearroundup2005.html
Quoted text here. Click to load it

This is certainly true.

Not that I'm advocating that computer users not take proper precautions,
but I'm just curious if someone who has an ordinary modem and is not
running a software firewall, etc. will be in danger of being infected
within 12 minutes as is commonly believed, and if so, what is the
mechanism by which this can happen? In my scenario, the PC is just
sitting idle. Or sitting at Windows Update. :-)



Re: Just 12 minutes



|
| This is certainly true.
|
| Not that I'm advocating that computer users not take proper precautions,
| but I'm just curious if someone who has an ordinary modem and is not
| running a software firewall, etc. will be in danger of being infected
| within 12 minutes as is commonly believed, and if so, what is the
| mechanism by which this can happen? In my scenario, the PC is just
| sitting idle. Or sitting at Windows Update. :-)
|

Unfortunately -- yes.

There are various mechanisms.

When a Win32 PC is connected to the Internet TCP ports are open for various
communication
reasons such as RPC, DCOM, NetBIOS over IP, etc.

When there is an unpatched vulnerability a worm infected PC on the Internet may
"test" the
ports for vulnerbilities and then exploit them and thus "worm" their way into
the computer.
Such bots as;  RBot, SDBot, GAObot use mult-facted infection vectors.  That is
they won't
try to test one port and one vulnerability but will test a myriad of ports and
vulnerabilities.

Then there is the case of software that was installed on said computer and is
loaded
automatically or by a service and the BOTs/worms may test for vulnerabilities in
them as
well.

So, an unpatched PC just sitting idle and connected to the Internet will
increase the
probability of an infection.  Then there is the case of a patched PC that still
has
vulnerabilities but a patch has not been release yet.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Re: Just 12 minutes

David H. Lipman wrote:
Quoted text here. Click to load it

Thanks for the explanation.

Is a PC running with a limited user account just as vulnerable?



Re: Just 12 minutes

wrote:

Quoted text here. Click to load it

Yes, because the exploitable processes, are running with admin
privileges.  If you want a secure computer, do not run any software
from Microsoft!

Regards, Dave Hodgins

--
Change nomail.afraid.org to ody.ca to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)

Re: Just 12 minutes



|
| Yes, because the exploitable processes, are running with admin
| privileges.  If you want a secure computer, do not run any software
| from Microsoft!
|
| Regards, Dave Hodgins
|

Exploitation of vulnerabilities via a buffer overflow conditions do NOT need
"adminprivileges" as these expoitations will elevate privileges.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Re: Just 12 minutes



|
| Thanks for the explanation.
|
| Is a PC running with a limited user account just as vulnerable?
|

Yes.  It can occur with NO user logged on.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Re: Just 12 minutes

"Daave" wrote:

Quoted text here. Click to load it

I am that person! When the Swen worm first appeared some years ago I
was infected within seconds of going online. I didn't know about it or
the patch that had been released because I'd been abroad for a while
and hadn't been keeping the system up to date.

Quoted text here. Click to load it

It happens because in Windows NT, by default, there are certain
network services running with ports open listening for incoming
traffic. This is a very bad idea but as we know, Microsoft have
tended to put ease of use ahead of security. Any vulnerabilities
(bugs) in those services may be exploitable so that code is injected
and run. There are machines (bots) constantly scanning IP address
ranges looking for such opportunities.

I have since closed all ports so that even without a firewall I am no
longer open to these kind of attacks.

Quoted text here. Click to load it

I also don't allow automatic updates; in fact I haven't updated past
Win2k SP2 (no longer supported). However, I wouldn't advise this for
most people.



Re: Just 12 minutes

Ant wrote:
Quoted text here. Click to load it

Good idea.

How do you close all ports without a firewall? Don't you need some ports
open if you want to use the Web, e-mail, etc.?

Quoted text here. Click to load it

Interesting. Windows 2000 is up to SP4, I believe. What is your main
reason for not keeping up-to-date with the patches?



Re: Just 12 minutes

On Sun, 3 Feb 2008 23:16:51 -0500, Daave wrote:

Quoted text here. Click to load it
 Use Windows Firewall in conjunction with:
 Seconfig XP 1.0
 http://seconfig.sytes.net /
 Seconfig XP is able configure Windows not to use TCP/IP as transport
 protocol for NetBIOS, SMB and RPC, thus leaving TCP/UDP ports 135, 137-139
 and 445 (the most exploited Windows networking weak point) closed.)
 OR
 Configuring NT-services much more secure.
 http://www.ntsvcfg.de/ntsvcfg_eng.html

Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html
Hundreds Click on 'Click Here to Get Infected' Ad
http://www.eweek.com/article2/0,1895,2132447,00.asp

Re: Just 12 minutes

Quoted text here. Click to load it

Thanks for the info, Kayman!



Re: Just 12 minutes

"Daave" wrote:

Quoted text here. Click to load it

Those ports are for out-going data and solicited incoming data on a
temporary basis for the specific requests. The point is to not have
unnecessary services running which are listening for requests on a
specific port.

For example, if you run a web server you need to accept requests for
service from anyone on (usually) port 80, so that port is always open
to receive traffic. If you are browsing the web you are *sending* to
the server's port 80 and receiving the page through a port above 1025
temporarily opended for that purpose.

Likewise, when using email or news, you are sending and receiving data
only when requested -- the ports are only open for the session.

In other words, you should block all incoming traffic unless you
specifically asked for it. If you have nothing listening for it in the
first place then there is nothing to block because another computer
cannot make a connection.

Quoted text here. Click to load it

There are various reasons which I've explained here before. However,
the main one now is that I can't be bothered with it, especially on a
dialup connection. My system is basic and configured well enough that
I don't have to worry about exploits. The more Windows advances, the
more bloat, fluff, complexity and bugs are added. I know exactly what
is running with my setup, why and what faults exit. If anything did
get through I'd spot it straight away and know how to deal with it.
Dissecting malware every day and knowing how Windows works at a low-
level helps a bit.



Re: Just 12 minutes

On Sun, 3 Feb 2008 23:16:51 -0500, "Daave"

Quoted text here. Click to load it

Here's something I wrote last year:
http://home.epix.net/~artnpeg/Win2KPro.html

Art

Re: Just 12 minutes


Quoted text here. Click to load it

LOL yes as long as your are not connected to the internet which kind of
defeats the object.
Why not get well protected and unplug your modem etc???

Quoted text here. Click to load it

You have gazillions of other software acessing the interenet when you
you do use the internet that can be infected.
You are just bocking one hole in a culander. Rather pointless.
Quoted text here. Click to load it



Re: Just 12 minutes

"Lord Turkey Cough" wrote:

Quoted text here. Click to load it

Read the original question again.

Quoted text here. Click to load it

Read my other post in this thread.

Quoted text here. Click to load it

No I don't. Those that do are configured properly.

Quoted text here. Click to load it

I block other things too.



Re: Just 12 minutes


Quoted text here. Click to load it

REad my posts gain.
Quoted text here. Click to load it

REad my previous posts first.

Quoted text here. Click to load it

Your intelligene apparently?
Quoted text here. Click to load it



Re: Just 12 minutes

"Lord Turkey Cough" wrote:

Quoted text here. Click to load it

No point. There was nothing of value there the first time. You're
obviously a newbie and a troll.



Re: Just 12 minutes


Quoted text here. Click to load it

No quite the opposite, you are either an idiot or a troll, if I had
to put my money on either I think I would tend to go for the fromer
but it's obviously a tough call and chances are you are a bit of both.
Quoted text here. Click to load it



Re: Just 12 minutes



Quoted text here. Click to load it

That was obvious from the outset.


Jim.


Site Timeline