Tick-tock...

I was looking at Information Security Magazine's November 2004 and noticed the following stat that they obtained from ISC/SANS:

Quote:

---

The average time from connection to the Internet before an unpatched, unprotected Windows PC is infected by malware is 20 minutes, down from 40 minutes in 2003

---

It would have been interesting however to see what "malware" specifically constitutes and would have been worthwhile to see if there are any other OS comparisons.

It'd also be interesting to see how long before someone (rather than a something) goes after a machine (that is, how many "attackers" are actually actively looking for a machine to compromise because of a vulnerability that OS has rather than because it's a final target like Microsoft itself -- it makes me think of Lance Spitzner's first experience with building a honeypot).

I am sure your aware of this MsM, but the Internet Storm Center posts the "Average Survival Time" between attacks. They define their stats as:

Quote:

---

The survivaltime is calculated as the average time between reports for an average target IP address. If you are assuming that most of these reports are generated by worms that attempt to propagate, an unpatched system would be infected by such a probe.
The average time between probes will vary widely from network to network. Some of our submitters subscribe to ISPs which block ports commonly used by worms. As a result, these submitters report a much longer 'survival time'. On the other hand, University Networks and users of high speed internet services are frequently targeted with additional scans from malware like bots. If you are connected to such a network, your 'survival time' will be much smaller.

---

As of today, they are listing the average survival time at 17 minutes.

Cheers:

At this rate it's not whether or not you're going to be own3d, but rather who is going to own you.

This is the perfect argument for those who shudder at the idea of spending $50 on a linksys or similar. The survival time statistic is the longest time between scans/probes that could infect. The norm would be closer to 8.5 minutes and the unlucky ones will be as low as less than a minute. The point being you don't have time to go online, download ZoneAlarm or whatever and install it all the while guaranteeing safety. But you just spent $600+ on that shiney new box and if you aren't careful it'll cost a trip to the store to have it fixed for you - minimum cost $70.... Hmm... You are out at least $20.... The linksys would have been worth it.... Ahhhh... yes... you super geeks that can fix it yourself..... Where will you get the trusted ZoneAlarm executable from?... But more importantly, how much is your time worth?

Quote:

---

It would have been interesting however to see what "malware" specifically constitutes and would have been worthwhile to see if there are any other OS comparisons.

It'd also be interesting to see how long before someone (rather than a something) goes after a machine (that is, how many "attackers" are actually actively looking for a machine to compromise because of a vulnerability that OS has rather than because it's a final target like Microsoft itself

---

I agree that it would be a better guide of TTL [ :)], if they did break the data down into constituent parts.
However, I feel that this might water down the FUD effect of this kind of headline.

I'm not against this info, far from it. I would just prefer a more varied diet. :)

The catch 22? It takes much longer than that to patch the system by internet. Pray that your ISP blocks common worm ports or have a friend burn the patches. Oh or how about turning on that built in windows firewall then update update update.

So,
If we take all of the above into consideration. Is it not about time that Microsoft withdrew all copies of it's OS's pre known vulnerabilities and replaced with updated versions?? (including oem).

Let's face it, in what other sector of the manufacturing, supply of goods and service industries could trade successfully the way Microsoft do.

What would you do if, your brand-spanking-new car got a flat tyre every few days. And everyone who had the same car had the same problem??

At this point with stats like that, I'm super glad I got both copies of the security cds MS was sending people for free. I have both SP1 and SP2 on separate disks so I can ignore the internet entirely.

Quote:

---

I have both SP1 and SP2 on separate disks so I can ignore the internet entirely

---

So how does joe blow learne he can contact Microsoft and get these for free, if he can aford the international call.

Quote:

---

Is it not about time that Microsoft withdrew all copies of it's OS's pre known vulnerabilities and replaced with updated versions?? (including oem).

---

***cough*** and SuSe and RH are doing the same? get bloody real.. the OEM..the system builder is at the edge here and needs to have the systems patched b4 sale.. but that won't happen.. the home PC market is so tight on margins, no retailer will risk wasting the half hour to install updates.. and pass that cost on to customers.. mr Joe Average is getting what he pays for.. cheep computers..
As for system Admins.. setting up a box with in their network or for their road warriers.. if they are stupid enough to put a virgin machine straight onto the net with out any patches or a firewall, they should apply for a salemans job at Walmart

Quote:

---

So how does joe blow learne he can contact Microsoft and get these for free,

---

by not being a bloody lazy cheap skate when buyimng the computer and paying a little extra for the right advice..
Everyone wants the equipment and software as cheap as possable.. but none are willing to pay for the oil to keep the machinery running.. technical support..

Sorry jinxy, I just checked and:

Quote:

---

The Windows Security Update CD is no longer available
We're sorry, but the Windows Security Update CD is no longer available for ordering. Please visit our Protect Your PC page for more information about improving your computer's security.

---

From: http://www.microsoft.com/athome/secu.../cd/order.mspx

Quote:

---

and SuSe and RH are doing the same

---

There linux distros, they are free, you only pay for the support package.

Quote:

---

get bloody real.. the OEM..the system builder is at the edge here and needs to have the systems patched b4 sale.. but that won't happen.. the home PC market is so tight on margins, no retailer will risk wasting the half hour to install updates

---

You miss what I said here, Microsoft should re-call all copies of it's Os's that are under parr. Then replace with upto date. Oem or any manufaturer would not have to waiste time as they would have the correct level of patch to install.

Don't give me, it could be in stock for months befor the sell bollocks. That model does'nt make that much money and very few use it, Dell comes to mind here

Quote:

---

by not being a bloody lazy cheap skate when buyimng the computer and paying a little extra for the right advice

---

Good advice should cost nothing and should be freely given. It never happens. You go by a new pc in any shop, the chances are you will speak to a spotty faced **** who does not know one end of a pc from the other. But he will shore as **** know what system gives him the most commision.

I have seen your post's here Undies, for a fair amount of time and I respect you for your knowledge. I can also believe that you will be truely honest with a customer, I get the impression you are involved in the trade. However I have first hand knowledge of the total incompetence, in general of the idiots who sell pc's, at least over here.

Thats why I order all the latest patches instead of dling them. I recently reloaded my parents PC and as soon as I got online the Antivirus started popping up with new viruses that it was removing. I got tired of that happening so I ordered the disk from Microsoft for free. on top of that its better to have the disk on hand than run to the site every time. I saw in borders a PC mag was selling the SP2 patch with the mag for $14.00, I thought that was crazy.

Whoooooo ****.... blew my stack at Jinxy sorry. mate.. Time for und3rtak3r to take a break..

yes..i have deleted the contents of this post... and if Jinxy read the original.. I am truley sorry..

no excuses..

Quote:

---

PC mag was selling the SP2 patch with the mag for $14.00, I thought that was crazy.

---

except in Australia.. all the mags supplied the SP2 WITH their regular cover disks, and some that don't normaly have Cover CD's supplied it AT NO EXTRA COST to the regular Cover Price..

Quote:

---

Originally posted here by jinxy

So how does joe blow learne he can contact Microsoft and get these for free, if he can aford the international call.

---

Your average "Joe Blow" isn't up-to-date on technology, isn't savvy nor ever will be on computer software, doesn't have the first iota of a clue considering the internet and definitely isn't wanting to spend one dollar more on anything involving that computer he/she/it just got from Best Buy.

And in light of all that...which took me the entire 17 years I've been in the field overall, I have no sympathy for them. I educate those around me who pay attention to what I say and ignore those who say "yeah yeah, but how can I get X easier or without paying anything". Let the internet sort them out, as it will...

Quote:

---

Thats why I order all the latest patches instead of dling them

---

Dont rely to heavily on those CD's. By the time they get to the outbound mail room they are allready out of date. Im not saying they arent good to have but by the time they get to you when newly released it could very well be too late.

An alternative is making your own CDs from a secure, already patched machine. The issue of patch management is still one that's out there and it's still a matter of playing catch-up. There are a couple of things however that should be noted: 1) While most home users who aren't technically savvy might attach a system that's not patch, no corporate environment should be affected by this 2) as noted earlier, a simple but effective SOHO router/switch (for about $50USD) can help mitigate some of the risk for even an unpatched system.

Has anyone actually setup a "honeypot" (that is, just built a box, unpatched) to see if the system is compromised within the time identified?

Quote:

---

Originally posted here by MsMittens
[B]An alternative is making your own CDs from a secure, already patched machine. The issue of patch management is still one that's out there and it's still a matter of playing catch-up.

---

Interesting discussion, especially because the media are so focused on virii, trojans and those oh! so pesky script kiddies but don't focus on the real threat (to an unpatched, unfirewalled system): worms. My knowledge on the subject is hazy, although I've read a primer or two and need to sit down and read a fantastic PDF from a link on AP all about virii and worms. The thought that there are worms and bots looking for unpatched, vulnerable boxes is frightening - since they are automated - because at least the other vectors require some degree of interaction.

Nice idea, MsMittens, and something I was thinking as I was reading the thread. Buy some brand quality CD-R's and download OS patches, Ad-aware, Spybot, Hi-Jack Thisk, AV and a firewall (update for each application iteration) and should one's box ever require a format or purchases a new box (or a friend or relative), then you have a solution to hand. Providing one has broadband connection, I reckon maybe half an hour of one's time? Someone with an entreprenurial spirit could even offer a service in their local neighbourhood.

Quote:

---

Has anyone actually setup a "honeypot" (that is, just built a box, unpatched) to see if the system is compromised within the time identified?

---

Again, would be interesting to see the results to ascertain not only time of compromise but also vectors of attack and types of attack.

Regards,
Riotgirl

Quote:

---

Has anyone actually setup a "honeypot" (that is, just built a box, unpatched) to see if the system is compromised within the time identified?

---

Could of sworn HTRegz or someone posted that a few weeks ago?

Quote:

---

Your average "Joe Blow" isn't up-to-date on technology, isn't savvy nor ever will be on computer software, doesn't have the first iota of a clue considering the internet and definitely isn't wanting to spend one dollar more on anything involving that computer he/she/it just got from Best Buy.

---

This is somewhat, what I was trying to say.

All of us here, have an interest in, what is happening on the internet. As such we learn............. Alot of us have learnt from experiance that if we take a brand new box, install XP, that we brought with our hard earned cash a while ago. Then install and go on line, we will be infected with some ****. This will happen befor we can even get to winupdate.

Why should joe blow have to suffer this???

Computers are just another retail item, no different than a television, hifi, car, potatoe, tomato, i think you get my point.

Jinxy:

I have $10, right now, says you can't mess with my stereo, my car, my TV... or even my sweetie....

Wanna try it from there?????

Just watch my truck break down tomorrow now I opened my big mouth..... OK, and leave the sweetie alone!!!! :eek:

Quote:

---

I have $10, right now, says you can't mess with my stereo, my car, my TV... or even my sweetie....

---

Tiger,
I could not even get close enough for $10. Give me enough and i could mess with all the above. :D

My point is, we all live in a world. We interact with people on a daily bases. Through life experience we learn who to trust and who not to. Cyberspace takes more than..............He looks like a dodgy basterd, i'll walk the other side of the road. You cant see him for a start.

But if I buy a television and have to keep re-aligning the antenna, I would take the dam thing back. Microsoft keep moving the goalposts and I cant take it back>

Quote:

---

Originally posted here by MsMittens
Has anyone actually setup a "honeypot" (that is, just built a box, unpatched) to see if the system is compromised within the time identified?

---

If someone can provide me with an unpatched copy of something like an XP Pro Evaluation (even an ISO of the Eval CD + Eval key will do), I will set it up on a partition and try this with my laptop when I get it in December. Maybe if a few of us do this we can provide a "local forecast" of how long it took in our respective regions, as well as where the attacks came from?

Anyone interested in collaborating on this?

Quote:

---

Originally posted here by chsh
Maybe if a few of us do this we can provide a "local forecast" of how long it took in our respective regions, as well as where the attacks came from?

Anyone interested in collaborating on this?

---

This sounds like a good experiment. I have to send one of my laptops in for service and am planning on a complete reformat and reinstallation when I get it back. I would be willing to put an unpatched, basic installation of XP home on the net (Verizon DSL) to see how long it will stay uncomprimised.

But, some one would have to set up guide lines on when and how to check, if it is to be used to surf the net, or just left connected.

Note: I could put this laptop in the DMZ of my router so that the router firewall wouldn't interfer with the test.

Just for giggles when i get my new router in a week or two i will set up a xp home machine with default install see how it holds up then compare to win2k pro and win2k advanced server with IIS running just to see what happens. I'll post the results as soon as i have them

I have put (about 2 months ago) an unpatched fresh install of XP on the net and I had the blaster virus withing 10 minutes