Just 12 minutes

[Daave]

I'm sure many here are very familiar with the notion that there is "a
50% chance of being infected by an internet worm in just 12 minutes of
being online using an unprotected, unpatched Windows PC." As many of you
know, this is a direct quote from a Sophos press release from July 1,
2005:

http://www.sophos.com/pressoffice/news/articles/2005/07/pr_uk_midyearroundup2005.html

Sophos got a lot of mileage from this press release. An interesting side
effect I've seen is newsgroup posts warning users of the dangers of
going online to patch an older, pre-SP2 version of Windows XP because it
will take more than 12 minutes, leaving many vulnerable to malware
infestation. Obviously, there are ways around this: download the entire
service pack (using another PC) and burning a disk so that SP2 may be
applied while the PC is offline and safe. Or users may get the
equivalent disk from Microsoft for a nominal fee.

But this begs the question: For the majority of people who choose to
obtain SP2 through automatic updates, *how* vulnerable are they exactly?
Of course, for those running SP1 or Gold, Messenger Service (which is on
by default) can be manually turned off. But again, for the majority of
people who have performed a clean installation without knowing to turn
off specific services, how vulnerable are their PCs?

I'm sure the study referenced in the press release talks about averages
and includes people who don't patch their systems and don't practice
other modes of safe hex. Messenger spam arriving informing a gullible
person that they have spyware or registry problems has happened many,
many times. People clicking on links in e-mails when they shouldn't be
doing so... well, you get the picture.

But what about a PC on the Internet that is not doing anything but
sitting there? Without the benefit of a firewall, hackers/bots can
attempt to do damage, for sure. But without any user input, is this
12-minute figure reasonable? Or is it more a case of marketing hype?
Specifically, what specifically can happen to an unpatched system,
assuming there is no user input (clicking on links, OK buttons in pop-up
windows, etc.)? Are there worms that can do damage this way, and if so,
what are they and what is the mechanism by which they infect a PC? How
common is real-time hacking in this sort of situation?

 

[David H. Lipman]

From: "Daave" <[email protected]>

| I'm sure many here are very familiar with the notion that there is "a
| 50% chance of being infected by an internet worm in just 12 minutes of
| being online using an unprotected, unpatched Windows PC." As many of you
| know, this is a direct quote from a Sophos press release from July 1,
| 2005:
|
| http://www.sophos.com/pressoffice/news/articles/2005/07/pr_uk_midyearroundup2005.html
|
| Sophos got a lot of mileage from this press release. An interesting side
| effect I've seen is newsgroup posts warning users of the dangers of
| going online to patch an older, pre-SP2 version of Windows XP because it
| will take more than 12 minutes, leaving many vulnerable to malware
| infestation. Obviously, there are ways around this: download the entire
| service pack (using another PC) and burning a disk so that SP2 may be
| applied while the PC is offline and safe. Or users may get the
| equivalent disk from Microsoft for a nominal fee.
|
| But this begs the question: For the majority of people who choose to
| obtain SP2 through automatic updates, *how* vulnerable are they exactly?
| Of course, for those running SP1 or Gold, Messenger Service (which is on
| by default) can be manually turned off. But again, for the majority of
| people who have performed a clean installation without knowing to turn
| off specific services, how vulnerable are their PCs?
|
| I'm sure the study referenced in the press release talks about averages
| and includes people who don't patch their systems and don't practice
| other modes of safe hex. Messenger spam arriving informing a gullible
| person that they have spyware or registry problems has happened many,
| many times. People clicking on links in e-mails when they shouldn't be
| doing so... well, you get the picture.
|
| But what about a PC on the Internet that is not doing anything but
| sitting there? Without the benefit of a firewall, hackers/bots can
| attempt to do damage, for sure. But without any user input, is this
| 12-minute figure reasonable? Or is it more a case of marketing hype?
| Specifically, what specifically can happen to an unpatched system,
| assuming there is no user input (clicking on links, OK buttons in pop-up
| windows, etc.)? Are there worms that can do damage this way, and if so,
| what are they and what is the mechanism by which they infect a PC? How
| common is real-time hacking in this sort of situation?
|

Using a NAT Router will mitigate the BOT/Worm threat as well as hacking attempts.

 

[Daave]

Using a NAT Router will mitigate the BOT/Worm threat as well as
hacking attempts.

This is certainly true.

Not that I'm advocating that computer users not take proper precautions,
but I'm just curious if someone who has an ordinary modem and is not
running a software firewall, etc. will be in danger of being infected
within 12 minutes as is commonly believed, and if so, what is the
mechanism by which this can happen? In my scenario, the PC is just
sitting idle. Or sitting at Windows Update.

 

[Kerry Brown]

I'm sure many here are very familiar with the notion that there is "a
50% chance of being infected by an internet worm in just 12 minutes of
being online using an unprotected, unpatched Windows PC." As many of you
know, this is a direct quote from a Sophos press release from July 1,
2005:

http://www.sophos.com/pressoffice/news/articles/2005/07/pr_uk_midyearroundup2005.html

Sophos got a lot of mileage from this press release. An interesting side
effect I've seen is newsgroup posts warning users of the dangers of
going online to patch an older, pre-SP2 version of Windows XP because it
will take more than 12 minutes, leaving many vulnerable to malware
infestation. Obviously, there are ways around this: download the entire
service pack (using another PC) and burning a disk so that SP2 may be
applied while the PC is offline and safe. Or users may get the
equivalent disk from Microsoft for a nominal fee.

But this begs the question: For the majority of people who choose to
obtain SP2 through automatic updates, *how* vulnerable are they exactly?
Of course, for those running SP1 or Gold, Messenger Service (which is on
by default) can be manually turned off. But again, for the majority of
people who have performed a clean installation without knowing to turn
off specific services, how vulnerable are their PCs?

I'm sure the study referenced in the press release talks about averages
and includes people who don't patch their systems and don't practice
other modes of safe hex. Messenger spam arriving informing a gullible
person that they have spyware or registry problems has happened many,
many times. People clicking on links in e-mails when they shouldn't be
doing so... well, you get the picture.

But what about a PC on the Internet that is not doing anything but
sitting there? Without the benefit of a firewall, hackers/bots can
attempt to do damage, for sure. But without any user input, is this
12-minute figure reasonable? Or is it more a case of marketing hype?
Specifically, what specifically can happen to an unpatched system,
assuming there is no user input (clicking on links, OK buttons in pop-up
windows, etc.)? Are there worms that can do damage this way, and if so,
what are they and what is the mechanism by which they infect a PC? How
common is real-time hacking in this sort of situation?

I have seen XP computers infected the during the oobe on first boot.
Technically Windows isn't even installed until the oobe is finished. There
are many worms that will infect an unprotected Windows computer connected
directly to the Internet. Simply inserting a NAT router into the equation
stops them. Most of these types of worms exploit an old LSASS vulnerability
and require no user input to infect a computer.

http://www.google.com/search?hl=en&q=lsass+worm

 

[David H. Lipman]

From: "Daave" <[email protected]>


|
| This is certainly true.
|
| Not that I'm advocating that computer users not take proper precautions,
| but I'm just curious if someone who has an ordinary modem and is not
| running a software firewall, etc. will be in danger of being infected
| within 12 minutes as is commonly believed, and if so, what is the
| mechanism by which this can happen? In my scenario, the PC is just
| sitting idle. Or sitting at Windows Update.
|

Unfortunately -- yes.

There are various mechanisms.

When a Win32 PC is connected to the Internet TCP ports are open for various communication
reasons such as RPC, DCOM, NetBIOS over IP, etc.

When there is an unpatched vulnerability a worm infected PC on the Internet may "test" the
ports for vulnerbilities and then exploit them and thus "worm" their way into the computer.
Such bots as; RBot, SDBot, GAObot use mult-facted infection vectors. That is they won't
try to test one port and one vulnerability but will test a myriad of ports and
vulnerabilities.

Then there is the case of software that was installed on said computer and is loaded
automatically or by a service and the BOTs/worms may test for vulnerabilities in them as
well.

So, an unpatched PC just sitting idle and connected to the Internet will increase the
probability of an infection. Then there is the case of a patched PC that still has
vulnerabilities but a patch has not been release yet.

 

[Ant]

but I'm just curious if someone who has an ordinary modem and is not
running a software firewall, etc. will be in danger of being infected
within 12 minutes as is commonly believed,

I am that person! When the Swen worm first appeared some years ago I
was infected within seconds of going online. I didn't know about it or
the patch that had been released because I'd been abroad for a while
and hadn't been keeping the system up to date.

and if so, what is the mechanism by which this can happen?

It happens because in Windows NT, by default, there are certain
network services running with ports open listening for incoming
traffic. This is a very bad idea but as we know, Microsoft have
tended to put ease of use ahead of security. Any vulnerabilities
(bugs) in those services may be exploitable so that code is injected
and run. There are machines (bots) constantly scanning IP address
ranges looking for such opportunities.

I have since closed all ports so that even without a firewall I am no
longer open to these kind of attacks.

In my scenario, the PC is just sitting idle. Or sitting at Windows
Update.

I also don't allow automatic updates; in fact I haven't updated past
Win2k SP2 (no longer supported). However, I wouldn't advise this for
most people.

 

[Daave]

I am that person! When the Swen worm first appeared some years ago I
was infected within seconds of going online. I didn't know about it or
the patch that had been released because I'd been abroad for a while
and hadn't been keeping the system up to date.


It happens because in Windows NT, by default, there are certain
network services running with ports open listening for incoming
traffic. This is a very bad idea but as we know, Microsoft have
tended to put ease of use ahead of security. Any vulnerabilities
(bugs) in those services may be exploitable so that code is injected
and run. There are machines (bots) constantly scanning IP address
ranges looking for such opportunities.

I have since closed all ports so that even without a firewall I am no
longer open to these kind of attacks.

Good idea.

How do you close all ports without a firewall? Don't you need some ports
open if you want to use the Web, e-mail, etc.?

I also don't allow automatic updates; in fact I haven't updated past
Win2k SP2 (no longer supported). However, I wouldn't advise this for
most people.

Interesting. Windows 2000 is up to SP4, I believe. What is your main
reason for not keeping up-to-date with the patches?

 

[Daave]

Unfortunately -- yes.

There are various mechanisms.

When a Win32 PC is connected to the Internet TCP ports are open for
various communication reasons such as RPC, DCOM, NetBIOS over IP, etc.

When there is an unpatched vulnerability a worm infected PC on the
Internet may "test" the ports for vulnerbilities and then exploit
them and thus "worm" their way into the computer. Such bots as;
RBot, SDBot, GAObot use mult-facted infection vectors. That is they
won't try to test one port and one vulnerability but will test a
myriad of ports and vulnerabilities.

Then there is the case of software that was installed on said
computer and is loaded automatically or by a service and the
BOTs/worms may test for vulnerabilities in them as well.

So, an unpatched PC just sitting idle and connected to the Internet
will increase the probability of an infection. Then there is the
case of a patched PC that still has vulnerabilities but a patch has
not been release yet.

Thanks for the explanation.

Is a PC running with a limited user account just as vulnerable?

 

[David W. Hodgins]

Is a PC running with a limited user account just as vulnerable?

Yes, because the exploitable processes, are running with admin
privileges. If you want a secure computer, do not run any software
from Microsoft!

Regards, Dave Hodgins

 

[Kayman]

How do you close all ports without a firewall? Don't you need some ports
open if you want to use the Web, e-mail, etc.?

Use Windows Firewall in conjunction with:
Seconfig XP 1.0
http://seconfig.sytes.net/
Seconfig XP is able configure Windows not to use TCP/IP as transport
protocol for NetBIOS, SMB and RPC, thus leaving TCP/UDP ports 135, 137-139
and 445 (the most exploited Windows networking weak point) closed.)
OR
Configuring NT-services much more secure.
http://www.ntsvcfg.de/ntsvcfg_eng.html

Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html
Hundreds Click on 'Click Here to Get Infected' Ad
http://www.eweek.com/article2/0,1895,2132447,00.asp

 

[Daave]

Use Windows Firewall in conjunction with:
Seconfig XP 1.0
http://seconfig.sytes.net/
Seconfig XP is able configure Windows not to use TCP/IP as transport
protocol for NetBIOS, SMB and RPC, thus leaving TCP/UDP ports 135,
137-139
and 445 (the most exploited Windows networking weak point) closed.)
OR
Configuring NT-services much more secure.
http://www.ntsvcfg.de/ntsvcfg_eng.html

Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html
Hundreds Click on 'Click Here to Get Infected' Ad
http://www.eweek.com/article2/0,1895,2132447,00.asp

Thanks for the info, Kayman!

 

[Ant]

Good idea.

How do you close all ports without a firewall? Don't you need some ports
open if you want to use the Web, e-mail, etc.?

Those ports are for out-going data and solicited incoming data on a
temporary basis for the specific requests. The point is to not have
unnecessary services running which are listening for requests on a
specific port.

For example, if you run a web server you need to accept requests for
service from anyone on (usually) port 80, so that port is always open
to receive traffic. If you are browsing the web you are *sending* to
the server's port 80 and receiving the page through a port above 1025
temporarily opended for that purpose.

Likewise, when using email or news, you are sending and receiving data
only when requested -- the ports are only open for the session.

In other words, you should block all incoming traffic unless you
specifically asked for it. If you have nothing listening for it in the
first place then there is nothing to block because another computer
cannot make a connection.

Interesting. Windows 2000 is up to SP4, I believe. What is your main
reason for not keeping up-to-date with the patches?

There are various reasons which I've explained here before. However,
the main one now is that I can't be bothered with it, especially on a
dialup connection. My system is basic and configured well enough that
I don't have to worry about exploits. The more Windows advances, the
more bloat, fluff, complexity and bugs are added. I know exactly what
is running with my setup, why and what faults exit. If anything did
get through I'd spot it straight away and know how to deal with it.
Dissecting malware every day and knowing how Windows works at a low-
level helps a bit.

 

[David H. Lipman]

From: "Daave" <[email protected]>


|
| Thanks for the explanation.
|
| Is a PC running with a limited user account just as vulnerable?
|

Yes. It can occur with NO user logged on.

 

[David H. Lipman]

From: "David W. Hodgins" <[email protected]>


|
| Yes, because the exploitable processes, are running with admin
| privileges. If you want a secure computer, do not run any software
| from Microsoft!
|
| Regards, Dave Hodgins
|

Exploitation of vulnerabilities via a buffer overflow conditions do NOT need
"adminprivileges" as these expoitations will elevate privileges.

 

[Art]

How do you close all ports without a firewall?

Here's something I wrote last year:
http://home.epix.net/~artnpeg/Win2KPro.html

Art

 

[Lord Turkey Cough]

From: "Daave" <[email protected]>

| I'm sure many here are very familiar with the notion that there is "a
| 50% chance of being infected by an internet worm in just 12 minutes of
| being online using an unprotected, unpatched Windows PC." As many of you
| know, this is a direct quote from a Sophos press release from July 1,
| 2005:
|
|
http://www.sophos.com/pressoffice/news/articles/2005/07/pr_uk_midyearroundup2005.html
|
| Sophos got a lot of mileage from this press release. An interesting side
| effect I've seen is newsgroup posts warning users of the dangers of
| going online to patch an older, pre-SP2 version of Windows XP because it
| will take more than 12 minutes, leaving many vulnerable to malware
| infestation. Obviously, there are ways around this: download the entire
| service pack (using another PC) and burning a disk so that SP2 may be
| applied while the PC is offline and safe. Or users may get the
| equivalent disk from Microsoft for a nominal fee.
|
| But this begs the question: For the majority of people who choose to
| obtain SP2 through automatic updates, *how* vulnerable are they exactly?
| Of course, for those running SP1 or Gold, Messenger Service (which is on
| by default) can be manually turned off. But again, for the majority of
| people who have performed a clean installation without knowing to turn
| off specific services, how vulnerable are their PCs?
|
| I'm sure the study referenced in the press release talks about averages
| and includes people who don't patch their systems and don't practice
| other modes of safe hex. Messenger spam arriving informing a gullible
| person that they have spyware or registry problems has happened many,
| many times. People clicking on links in e-mails when they shouldn't be
| doing so... well, you get the picture.
|
| But what about a PC on the Internet that is not doing anything but
| sitting there? Without the benefit of a firewall, hackers/bots can
| attempt to do damage, for sure. But without any user input, is this
| 12-minute figure reasonable? Or is it more a case of marketing hype?
| Specifically, what specifically can happen to an unpatched system,
| assuming there is no user input (clicking on links, OK buttons in pop-up
| windows, etc.)? Are there worms that can do damage this way, and if so,
| what are they and what is the mechanism by which they infect a PC? How
| common is real-time hacking in this sort of situation?
|

Using a NAT Router will mitigate the BOT/Worm threat as well as hacking
attempts.

Do you really believe this? I think you are deluding yourself here.
I don't really see what protection your router is giving you.
Would you care to explain how it protects you?
Explaintions such as "Well I am using a NAT router" don't really qualify as
the
arguement is kind of circular."

 

[Lord Turkey Cough]

I am that person! When the Swen worm first appeared some years ago I
was infected within seconds of going online. I didn't know about it or
the patch that had been released because I'd been abroad for a while
and hadn't been keeping the system up to date.


It happens because in Windows NT, by default, there are certain
network services running with ports open listening for incoming
traffic. This is a very bad idea but as we know, Microsoft have
tended to put ease of use ahead of security. Any vulnerabilities
(bugs) in those services may be exploitable so that code is injected
and run. There are machines (bots) constantly scanning IP address
ranges looking for such opportunities.

I have since closed all ports so that even without a firewall I am no
longer open to these kind of attacks.

LOL yes as long as your are not connected to the internet which kind of
defeats the object.
Why not get well protected and unplug your modem etc???

I also don't allow automatic updates; in fact I haven't updated past
Win2k SP2 (no longer supported). However, I wouldn't advise this for
most people.

You have gazillions of other software acessing the interenet when you
you do use the internet that can be infected.
You are just bocking one hole in a culander. Rather pointless.

 

[David H. Lipman]

From: "Lord Turkey Cough" <[email protected]>


|
| Do you really believe this? I think you are deluding yourself here.
| I don't really see what protection your router is giving you.
| Would you care to explain how it protects you?
| Explaintions such as "Well I am using a NAT router" don't really qualify as
| the arguement is kind of circular."
|

My IP address is in my reply.
Prove otherwise.

 

[Lord Turkey Cough]

From: "Lord Turkey Cough" <[email protected]>


|
| Do you really believe this? I think you are deluding yourself here.
| I don't really see what protection your router is giving you.
| Would you care to explain how it protects you?
| Explaintions such as "Well I am using a NAT router" don't really qualify
as
| the arguement is kind of circular."
|

My IP address is in my reply.
Prove otherwise.

Thats like saying your house is burgal proof and inviting me to burgal
it to prove you wrong.

My IP address has been in my reply for the last ten years, and I have
not suffered any infections really, one or two possible incidents but
these were no doubt caused by my careless use of the internet or were
merely over zealous antivirus software reports.
I am sure there are many people using NAT routers who had serious problems
with viruses. I certaintly have not and certaintly nothting that a NAT
router would have
prevented. I can guarantee you that.

But anyway you have avoided the question as to how you are
protected, asking me to prove you are not an adaquate answer, it
suggests you don't know.

All you router is doing is routing the traffic to your computer, it has no
more
idea whether that traffic is a 'virus' or not.

Anyway there are a lot of 12 minutes in the time I have been connected to
to the interenet, and I don't appear to have acquired my yearly alloction
of 43,000 viruses, in fact I should be up to the 1/2 million mark my now!!
Or maybe I have!! Maybe that is why my hard drive is nearly full :O)

 

[David W. Hodgins]

Do you really believe this? I think you are deluding yourself here.

Worms that spread by taking advantage of exploits in software listening to
tcp/udp ports are blocked by the router.

I don't really see what protection your router is giving you.
Would you care to explain how it protects you?

When you use a properly configured router, all incoming traffic is blocked,
unless it's in response to an outgoing packet. The router has to be configured,
to allow traffic for the ports where you do want incoming traffic, to be allowed.

For example, if you are running an http server, you would have to setup the
router to forward all data coming in to port 80, to forward it to the
computer with the server running.

Your web browser will still work, because it is initiating the connection,
by sending a tcp syn packet, that the router will allow responses to.

You'll still have to keep your software, that accesses the internet updated,
but you no longer have to worry about printer&file sharing, for example.

You can think of the nat router, as a hardware firewall, for incoming
traffic. Like the windows firewall, it does nothing to help with connections
established by software, on your computer.

Regards, Dave Hodgins