Slashdot Log In
Clean System to Zombie Bot in Four Minutes
Posted by
michael
on Tue Nov 30, 2004 03:05 PM
from the takes-five-minutes-to-download-patches dept.
from the takes-five-minutes-to-download-patches dept.
Amadaeus writes "According to the latest study by USA Today and Avantgarde, it takes less than 4 minutes for an unpatched Windows XP SP1 system to become part of a botnet. Avantgarde has the statistics in their abstract. Stats of note: Although Macs and PC's got hit with equal opportunity, the XP SP1 machine was hit with 5 LSASS and 4 DCOM exploits while the Mac remained clean. The Linux desktop also was impenetrable, but only was only targeted by 0.26% of all attacks." See also our story on the survival time for unpatched systems.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Oh, now it makes sense... (Score:5, Funny)
Re:Oh, now it makes sense... (Score:5, Funny)
Parent
Re:Oh, now it makes sense... (Score:5, Funny)
Parent
NAT (Score:5, Insightful)
I know it works well enough for me, but I am not a typical user -- even my Windows box is locked down tight.
Re:NAT (Score:4, Informative)
Parent
Re:NAT (Score:5, Funny)
Which is why I was curious about its effectiveness for the typical user. I use Firefox, lock down the machine, don't install crap, and that machine is perfectly clean a year after its OS install.
My wife's machine, however, is the opposite. AdAware choked because there were thousands of items (of course each piece of spyware has hundreds of items, so AdAware's list is misleading) and some that tried to prevent AdAware from running. I gave her a good talking to about installing crap from msn.com and visiting porn sites using IE. So I wound up sacrificing sex for a week so I would get a break from cleaning her computer. Sigh. Women.
Anyway, my point is that I am not the typical user. NAT is an effective tool, but like any tool, it is only as good as the person wielding it.
Parent
Re:NAT (Score:4, Funny)
Okay, ZERO!
But how I wish she would....(sigh)
Parent
Re:NAT (Score:5, Interesting)
Talk her into a Mac, if you can.
I'm serious. As a child, I was an "Apple II for all" kid. Then I became one of those "Macs are too easy and wimpy" teens. In college, however, I became a "Hey, I can do work, I'm an addict!" person. Then I became a security wonk, and I'm a "Gee, why can't I find hardly any information on hardening OS X? [net-security.org] It's not perfect" kind of person.
I don't believe it's possible for the average user to run Windows cleanly. You have to know too much. I've heard my security-wonk coworkers joke about how much spyware they had after a scan (and yeah, they're not great security wonks, but they were well above me on the food chain). If yer average security wonk can't keep his stupid box clean, then there's a problem with both the box and the user, not just the user.
I don't believe that OS X is perfect. There are exploits that work. Safari has some of the same problems IE does [slashdot.org] (minus the whole hooked-into-the-OS-issue). You have to look really hard to find the issues, though. And for getting actual work done, they're a wonder. The built-in software does much of what regular users need. The interface is pretty and clean. And with BSD underneath, I've found that they a lot easier for linux-geek techie friends to suss out.
I've come to the conclusion that Macs really are the best computers for most of the population. You don't get owned out of the box. You can download your security patches on modem--they come separate from the OS updates. You can safely read The Register. [slashdot.org] Even my Classic-emulated Office doesn't crash on OS X.
Hardware costs are pretty much at parity for brand-name devices. The cost problem tends to be with replacing software. But there is a useful shareware community for Macs, Fink is pretty well-regarded, and commercial software can be found. Consider how much a password-sniffing Trojan might cost and cough it up.
Thus endeth annoying advice.
Parent
Only on broadband (Score:5, Interesting)
Our gateway box is a Win2k machine. It hasn't been patched in months upon months because it would tie up the connection for a long time. (Downloading patches over 28.8 is slow and we have eight computers in the house sharing that connection.) That gateway machine is totally clean. No spyware, no worms, etc. This is confirmed by proper antivirus and anti spyware software.
I'm just posting this an in interesting observation. This makes sense because a zombie on a dialup line is pretty damn worthles anyway.
Parent
Re:Only on broadband (Score:5, Insightful)
What I did was went through the list of patches and manually downloading them through Microsoft's download site. Some of them weren't available or had odd restrictions of installation, but whenever I set up a computer, I just got the list of patches it needed through Windows Update and installed the local copies.
I also had the luck of staying at a hotel the next city over, it had free wireless Internet service, so I downloaded as much of everything I could.
Parent
Re:Too late, maybe (Score:5, Informative)
Using a router to check bandwidth usage or even a firewall or rrdtools-type system of graph would show if an external user is using your box.
- dshaw
Parent
Re:NAT (Score:4, Informative)
The NAT won't help much with the client-side holes.
Parent
Re:NAT (Score:5, Interesting)
on my college network, you aren't allowed to use the outside internet untill you have the most recent patches installed, which are mirror on internal servers.If you computer is caught sending spam or DOS attacks, you are kicked of the network completly untill you get it fixed
I'm not sure how effective this is, knowing the kind of shit people download, but its a start.
Parent
no kidding (Score:4, Funny)
Next up: People who see a dollar bill on the sidewalk will pick it up and put it in their pocket. See our analysis
Conclusions make no sense. (Score:5, Interesting)
The Windows box was compromised multiple times. The Mac OS X box was never compromised. The Linux box was never compromised, but it only was hit a tiny fraction of the times the Mac OS X and Win XP SP1 boxes were.
Oddly, the authors conclude that the best systems are Linux, and Win XP SP2. WTF?
The obvious winner is the platform that sustained the highest number of attacks with the fewest number of compromises. That would be Mac OS X, with essentially half of all the attacks (just like Win XP SP1) but ZERO successful compromises.
The authors seem to be bending over backwards to come up with a "winner" that runs on intel compatible hardware (Linux and Win XP SP2) but the obvious choice is Mac OS X.
Why the biased interpretations?
Parent
Hey, cool. (Score:5, Interesting)
Re:Hey, cool. (Score:5, Interesting)
Parent
Re:Hey, cool. (Score:5, Informative)
Generally speaking, I'm pleased with SP2. As long as you're running XP, and it won't affect your critical functionality adversely, install it. It won't be exploit proof moving forward, but it's the easiest way to patch the current set of problems.
Parent
Re:Hey, cool. (Score:4, Informative)
Yes, the SP2 machine, SP1 w/Zonealarm, and Linspire machines all had software firewalls, which appear to do their jobs just fine. One of the reasons the Max registered so many attacks is because one of the enabled services was Samba. Rather funny to watch all the Windows worms try their exploits on Samba, actually.
Parent
Re:Hey, cool. (Score:5, Informative)
Parent
Re:Hey, cool. (Score:5, Insightful)
While I am a mac user (only for the last year though), I am a windows admin by trade. Why did you not state in your article that while the mac *was* getting attacked almost as much as windows, it was much more secure in that nothing broke through? You stated that "if they had been written to exploit OS X, they would have been successful". Find me something that will exploit samba successfully that can grant root (install) access on a mac, and I will agree with you. However, even with SMBd getting attacked, and even if there were an exploit that could take it over, it still would be unable to get admin access to make the mac a zombie, because of the secure nature of OS X.
You said yourself "it was fun watching all the windows attacks fail on OSX", which merely means that it was getting attacked so much BECAUSE the exploits thought it was windows. This is not a reason that OS X should be ranked "less secure". The real winner in your survey is OSX here, not SP2.
Parent
Re:Questions (Score:5, Informative)
Anyway...
Attacks were counted by Snort with a default ruleset, as of early September when I set it up. I.e. For the most part, I could only count attempts that could be delivered. That means that any of the hundreds of thousands of TCP connection attempts to the firewalled machine couldn't be completed, and so no TCP payload, and no attack signature matching. Hence, the attempts recorded on the firewalled machines represented mostly UDP and ICMP traffic. For UDP, think SQL Slammer. Yes, this included things that many people would consider fairly innocuous, like ICMP information leak-class packets.
As for the firewalling... The "base" test case was Windows XP. Overall, they were going for SOHO-class machines, as you might get them out of the box. In the XP case, there's relatively little point in having the same config multiple times. Instead, we compare XP SP1 (no firewall) with XP SP1 (w/Zonealarm) and XP SP2. Because there would obviously be questions about the other OSes, the Mac, Linspire, and Win2K3 SBE were included. Linspir has a firewall by default, Win2K3 and OS X don't.
The OS X machine registered so many attempts because it was running Samba, and all the Windows attacks could deliver a payload (and have the attack registered.)
It would have been better described as "number of succesfully delivered attack attempts", but I guess that isn't good copy.
Parent
How do you patch a system? (Score:5, Informative)
Re:How do you patch a system? (Score:5, Informative)
Does that mean I have to install XP, download SP2. Burn the SP2 archive onto a CDROM, reinstall XP with the network cable disconnected, and then patch? Geez that'll get old fast
You can slipstream the SP2 patch into SP1 or a plain Windows XP CD. This will allow straight installation of Windows XP + SP2 already integrated. This basically involves running the SP2 installer on a copy of CD files, and then burning the resulting files to another CD. This page [winsupersite.com] has more information on slipstreaming SP2. This comment has reached its end.
Parent
Re:How do you patch a system? (Score:5, Informative)
Parent
Re:How do you patch a system? (Score:4, Informative)
Parent
I'd love to see... (Score:4, Interesting)
Ok, before the bitching begins: (Score:5, Interesting)
Yes, yes, we know this is not surprising, since the exploits in question target Windows specifically, and therefore obviously will not affect Macs.
But the larger points you should take away from this is twofold:
1. The simple fact of the matter is that, for whatever reason, Macs are clearly affected far less than PCs by all types of exploits. This is not because of just marketshare. But whatever the reason, it is true nonetheless. But this brings be to:
2. Even a completely unpatched Mac OS X 10.0.0 machine would not be vulnerable to any kind of remote attack, because no ports whatsoever are open to the outside world, and on most consumer Mac OS X systems, never will be. The fundamental and intrinsic security design and considerations of Mac OS X are just better, period. Even local exploits, such as might travel freely and easily on Windows via email, aren't as possible or practical on Mac OS X (e.g., a potential Mac exploit of this nature that spread via email would have to have its own MTA or a lot more complexity than a simple script on Windows where Outlook and the OS does all the work for you). Yes, marketshare, i.e., the chances of the next host encountered being a Mac, certainly doesn't hurt, but that is not the sole or primary reason Macs aren't vulnerable. No effective automatic vectors of infection or spread, either local or remote, exist, period. When external ports are opened, they usually represent open source services such as apache and OpenSSH, which as a matter of course are usually updated long before theoretical exploits become reality because of the intense scrutiny and peer review such products receive by the community.
When will people learn, that after three and a half years of Mac OS X, with the market growing, it's not just because of "marketshare" that Macs are rarely affected by these types of issues? Can people admit that it's possible that security decisions that were simply and fundamentally better than those of Microsoft were made? I get a kick out of articles that trumpet "MACS JUST AS INSECURE AS WINDOWS" when a text shell script is "discovered", one that must be run by someone with root or physical access no less, with no worthwhile vector or method of automated propagation of any kind![1] This is in the face of completely remote and automated exploits that can hit a Windows machine in minutes of being on the network, or exploits that own your machine by simply visiting a web page, or viewing an email message in Outlook (yes, these have continued to exist, some even very recently).
[1] For the nit-pickers out there, copying itself to other remote Mac OS X system volumes to which the local user has root-equivalent access and has manually connected to doesn't exactly rise to the level of the unprivileged, automatic propagation we see in the Windows world.
Re:Ok, before the bitching begins: (Score:5, Interesting)
Parent
Re:Ok, before the bitching begins: (Score:4, Informative)
However, the article summary only mentioned Macs (which is why I did), and also, many of these other systems are used as servers, and do in fact have many more open ports than a typical Mac OS X system, which often has none. This isn't to say they're "insecure" because of it; just that there are channels of potential access.
Now, a Mac OS X (or Mac OS X Server) machine used in a "server" role is likely to share a similar level of exposure.
But my reference is to a typical consumer or desktop machine, which represents by far the largest proportion of machines out there, and which is primarily what this article is referring to. And in the cases of these machines, Windows has remote avenues of attack, and Mac OS X does not - at all.
Parent
Re:Ok, before the bitching begins: (Score:4, Insightful)
This is the version that's been shipping on new machines and sitting on store shelves for half a year now.
But these facts are a bit inconvenient and don't make for exciting headlines, so we'll run the test with SP1, which everyone knows had some juicy exploits.
Parent
Re:Ok, before the bitching begins: (Score:5, Insightful)
1. And this still doesn't represent a large portion of machines running XP.
2. There have been some major exploits, albeit not necessarily remote, that have still affected XP post-SP2.
Microsoft's almost criminally (considering how many billions of dollars and manhours that have been lost due to this) late sudden "awareness" of security does not change the basic premise of this article, nor what I said.
Parent
Our experience (Score:5, Interesting)
OS X/Macintosh has proven to be the absolute most productive environment for us to date, least susceptible to malware/hacking has the lowest support costs and is why we have been in the process of replacing most machines with OS X boxes.
I call phooey. (Score:5, Funny)
NO CARRIER
You can't play the 'luser' card! (Score:5, Insightful)
A machine isn't supposed to act this way. It is very simple, but we forget that proper behaviour for the machine is to NOT get infected in seconds. I have abandoned windows some time ago, but still help friends with their machines. But it is a battle they're losing. Nothing seems to help, mostly due to the extremely bad security paradigms. They now think its normal having to run 2 - 3 different anti-adware programs, virusscanner, be on eternal vigilance at every corner of the internet.
It is not supposed to be like this. Don't forget that.
Re:You can't play the 'luser' card! (Score:5, Insightful)
Correction: "Way of life for us in the Windows world." Other operating system's don't have these problems and associated costs and loss of productivity.
Parent
2:30 (Score:5, Informative)
My advice to anyone with Windows XP SP1 planning a clean install - get the SP2 CD (free from Microsoft) and install it before connecting to the internet.
Re:2:30 (**cough**) BS (Score:5, Informative)
You can get an unpatched windows 2000 machine to connect to the internet [without being comprimised] to download updates just fine, (from my experience, your milage may vary) Just enable TCP/IP filtering in advanced networking and set TCP to permit only (nothing). Can do this on XP as well.
Parent
Rule number 1 for doing an XP install: (Score:4, Insightful)
Perfectly secure. (Score:5, Funny)
Of course... (Score:5, Interesting)
They act like how often it's attacked is a detractor from how secure it is ("it's not exploited because no one ever attacks it!") In fact, I'd say the systems that are attacked the least is *because* they are so difficult to exploit. Well, that and they only are about 2 or 3 out of every 100 systems you'll ping.
not just worms (Score:5, Interesting)
I started getting reports of malware being attached to a program I work on [slashdot.org] and discovered the affected parties had obtained their copies of the program from Download.com. I had never submitted the program to them, but someone else had -- and they'd contaminated it with malware while they were at it. I complained, and the program was removed. (Actually, they first switched the links to the official server, but removed it when I complained further that they needed to tighten up their submission procedures.)
While Download.com is no longer distributing my program, they are still distributing malware attached to other programs (just went to their site to confirm it) via xeol.net and probably others. They don't seem too interested in fixing the problem. I also sent a complaint to the FBI's cybercrime division, and they apparently weren't interested, either.
Delta Compression! (Score:4, Informative)
For the record, using FreeBSD Update [daemonology.net] and my binary diff [daemonology.net] tool, downloading all existing security patches for FreeBSD 4.8 (released April 2003) only requires 568kB of files to be downloaded -- which takes under 3 minutes even with a 28.8kbps modem.
Firewall on the ISP side for a charge. (Score:5, Interesting)
Like imagine when you sign up for compnay's X DSL
they offer a firewalled connection, or a non firewalled.
For the simple users ( my mom ) you could have a default firewall that just blocks windows ports that have know exploits. Does 445 really need to come in from the outside world
For the more advanced user you could have an interface that allows them to choose which ports.
How hard would it be to setup a dynamic firewall solution like this? People would pay 5 to 10 bucks a month extra for it. Even someone like me so I don't have to use a router. I just don't trust a desktop firewall.
Re:First Zombie. (Score:5, Insightful)
ARG! The patches! They do nothing!
Erm, if you look at the article summary and the article itself, it says that Attackers successfully compromised the Dell Windows XP computer using Service Pack 1 nine times, and the Dell Windows 2003 Small Business server once. Windows XP SP2 is what many would consider a collection of patches, so yes, it seems to have done something.
Parent
Re:Wow... (Score:5, Funny)
Parent
Re:This doesn't surprise me. (Score:4, Informative)
Cars. Getting a driver's license requires months of education, plus passing two tests (one written, one actually driving). This doesn't teach you how to build or maintain a car, just how to drive it safely.
Guns. In at least some states, you have to take safety classes to teach you how to use (and store!) a gun safely and responsibly.
There may be others, but those are the two that came to mind immediately...
Parent
Re:This doesn't surprise me. (Score:5, Insightful)
Well, I've been around the "Internet" since the early 80's and remember when you had to manually route email across the UUCP network. I also know people who have been on the "Internet" ever since it was only the ARPANET. And you know what? I started complaining around the early nineties when this "Mosaic" thing showed up and started to screw up the Internet. And the guys who were on the ARPANET bitched when our machines started routing USENET and email through their network. Bottom line, whenever new people come in and change things, the "old timers" say that it sucks. Old immigrants always dislike new immigrants. Welcome to reality, where things always will suck more next year because kids these days just don't know how to behave.
But in the end, you know what? I wouldn't have changed a thing. It was what it was, it will be what it will be because people try to make it better and it's still a hundred times better than if it would have been if it had stayed the same. Stop thinking about how great things were in "the good old days" and trying to keep people from doing interesting stuff (and, yes, even worms and viruses are interesting in a malevolent way). Instead, figure out how to improve things without cutting off access and help build "the good new days".
Parent
Re:Myth of the Suckiest OS (Score:5, Insightful)
This is like the New Pig Times reporting that if brick ever becomes as popular as straw then wolves would just start blowing them down as easily. In other words you are arguing under the Fallacy of the General Rule; namely that all platforms have exactly the same vulnerabilities, if only someone would bother to look for them.
Windows has large, exploitable holes that other platforms don't. Period. End of sentence. It is the height of tunnel sighted arrogance to think today's hackers wouldn't each love to be the one that finally writes the mighty virus that gets through OS X or Linux.
Yes, a large percentage of problems are from copy cats. But you will not convince me there aren't those who take pride in their hacking that wouldn't love to be the one to break the OS X/Linux barrier and aren't working at doing so just to show it can be done.
Parent
Marketshare != Security (Score:5, Interesting)
Simply put, Linux does have a better security model than Windows does.
Even Firefox has a better security model than IE. Firefox starts with the deny everything that is not specifically allowed by the user.
IE starts with the allow everything that isn't specifically denied by the user.
Now, a very knowledgable person can achieve the same level of protection with both of these systems. But that does not mean that both models are equally secure.
Linux vs Windows is the same. Particularly since IE is "integrated" with the OS.
Read the other responses. The Mac was targetted so often because it was running Samba and the attacking machines' scans saw that port and tried to exploit the vulnerabilities associated with Windows.
On the Internet, it doesn't matter if you only have 1 million boxes to Microsoft's 100 million. A scanner can find them. If they are vulnerable, they will be cracked. Maybe not in 4 minutes
But the Linux box in the article was being attacked a couple of times an hour.
If you're vulnerable, one attack will crack you.
If you are not vulnerable, a million attempts won't crack you.
It's Security. Not Marketshare.
Parent