Survival Time for Unpatched Systems Cut by Half

UnderAttack writes "The Internet Storm Center published a graph showing historic trends for the "Survival Time" of unpatched, unprotected (windows) computers connected to the internet. Turns out, this number dropped from about 40 minutes last year, to 20 minutes this year. The survival time is calculated as the average time between reports for an average target IP address. If you are assuming that most of these reports are generated by worms that attempt to propagate, an unpatched system would be infected by such a probe. The data is collected from a large number of networks with different types of upstream protection. So if you are on an unprotected cable/DSL line, you may see probes much more frequently. Either way, 20 minutes is not long enough to download patches. The Honeynet Project did publish a paper with some stats back in 2001."

Patch CDs

Microsoft should make Patch CD ISOs available. You could swing by a friend's house and get one, drop into your local computer store and have them burn you one for a few bucks, or pick up a Microsoft produced copy at your local gas station, like AOL CDs.

Re:Patch CDs

They do. At least in europe retailers are giving out 'Microsoft Windows Security Update CD's. Works on any windows version, but sadly is not quite up to date on XP patches anymore. Next edition is coming soon (called 'Windows XP Service Pack 2 CD') - I fully expect MS to hand out those for free via retailers as well. You can already order one via MS webpage.

Re:Patch CDs

You know? That's actually a good idea . . .
which means it'll never happen
-nB

Re:Patch CDs

err...they do. Free. Not as continuously up to date as it might be, but they do have them.

hmm...or rather, they did. [microsoft.com]

Windows Update Catalog

For the truly daft and determined, it is possible to use the Windows Update Catalog (Windows Update, Personalize Windows Update, Show Windows Update Catalog) to download everything at once, to burn to DVD and make your own. If you limit yourself to a particular Windows flavor (98/ME/2K/XP), a CD will still hold it all, but IIR the whole shebang for all four goes over a CD these days. On the other hand, it's easier to download only one OS version the way the catalog is set up.

Figure out what the latest service pack for the OS is, and apply that. That should let you get on long enough to use windows update to scan and get a list of the other KB-patches you need. Disconnect, patch, rescan. Repeat. If you want to learn how to use QChain [microsoft.com], it can be faster, but that doesn't work on Win 98/ME.

For the truly paranoid, keep a list of what order you need to apply the patches in. Then wipe and reinstall the OS from scratch, and apply the needed patches in order without connecting to the net first.

However, it's a lot easier to use the Update CDs. It would be nice if there was a reliable torrent of the ISO somewhere....

Re:Patch CDs

I'm just trying to understand how you don't see the need to reinstall the OS 'every few months' as being a problem.

not trying to start a flame/OS/holy war, but I would deffinatly see this as a problem

WinXP SP2 slipstreamed CD for the win!

Install the Windows XP off a CD that includes SP2 slipstreamed in, and your survival time online 'unpatched' goes up dramatically. Something about a reasonably good firewall that is turned on by the default installation...

20 minutes??

Try 50 seconds :(

No, not joking. At work, somewhere, there is an infected computer and while rebuilding a computer I plugged it in to run the updates for 2K and antivirus. Less than a minute after pluging it in, I was crashing and burning.

Had to go to a patched computer, download the needed updates and burn them to CD and update the computer that way first before plugging it onto the network.

REALLY anoying.. and when I find the user with the infected computer.. well, lets say I'll have a new storage location for this dead notebnook hard drive...

Ditto

I had a a similar problem (albeit with a home box) under XP. The worst of it is that you can't just download the update installer and unplug the 'net connection because the installer itself does downloading. Since the other two boxes in my house run Gentoo and Redhat I couldn't download the patches from there (Does this [microsoft.com] look familiar?) and had to just race against time for 5 or 6 attempts before it worked.

Re:Ditto

Read the bottom of that page...

" If you prefer to use a different Web browser, updates to Windows may be downloaded from the Microsoft Download Center."

With a link within the text "Microsoft Download Center." I'm guessing you can at least get some necessary patches from there (SP's, some critical patches) before letting your machine full-bore on the 'net without a firewall.

I know there are some home users out there that still aren't natting or using some sort of stateful firewall, but come on - you have 2 linux boxes there and can't get a nat to work? Hell, I'll buy you a linksys, they're getting darn cheap after rebates nowadays.

Network Cable?

Did you ever learn anything about computer security? On a machine that you do not want to be compromised, absolutely do not connect it to the network/internet. have all relevant patches available on removeable media - that has been verified authentic - and install sans network.

Then once you are certain that everything is hunky dory, plug it into the network or internet with a firewall (for both incoming and outgoing).

And this isn't an issue with Windows or Linux or FreeBSD for all the fanboys out there. This applies to all OS's. Windows is targeted more because there are more people using it. There are plenty of exploitable vulnerabilities in any OS. It's a matter of work / payoff ratio.

Re:Network Cable?

Did you ever learn anything about computer security?

Did you ever learn anything about end users?

It's all well and good to say don't connect it to the network before patching, but end users don't know that. Nor should they have to know that. It is totally unreasonable to think that the first thought through Joe User's head should be "Right, I bought this brand new machine, but I shouldn't connect it to the network since it might be compromised."

End users are only very recently learning about service packs and patching, etc. Remember, prior to Windows XP, service packs were for business operating systems. How many end users did you see running NT 4? Even those folks running 2K at home were clueful folks - home PCs sold at CompUSA and the like shipped with 98SE or ME. You can't expect them to gain all this knowledge overnight.

have all relevant patches available on removeable media - that has been verified authentic - and install sans network.

And you obtain them how? In an IT environment, sure, it's trivial, beacuse you have N different computers, and probably N different platforms to use to create this media. Most folks still only have one PC. Sure, some people can burn CDs at work (but many workplaces severely limit what users can do on their machines, and lots of places prevent CD burning on work machines for corporate espionage reasons), and others might have friends with CD burners, but that's still a lot of effort, and it doesn't cover everyone.

It's totally unreasonable to expect a consumer to jump through all these hoops. (I'm not saying they shouldn't take these steps, just that they shouldn't *have* to take these steps in order to make a consumer electronics device work) Several changes need to be made. MS should produce a crapload of service pack CDs and give them to OEMs and every new computer should come with a current one. (They did this with NT4 SP3 and haven't done it since to my knowledge). They should also ship them to large stores (BestBuy, CompUSA, etc) and sell them for a low price (ie: $0.99) enough to prevent people from taking more than they need, but not terribly expensive. MS is notoriously tight-fisted when it comes to stuff like this, despite the fact it's their fault the product is insecure. Carmakers wouldn't get away with charging for recalled parts. For example, MS refuses to ship CDs to colleges. They'll ship one for every 50 or 100 students, but that's it, and that's ONLY if you have a Select license. Given that in that quantity the CDs cost fractions of a cent each, there's no reason for this. I can understand them being reluctant to make a CD with hotfixes, since those come out so frequently, but once a service pack is out, it's out, there's no reason not to make a CD except to penny-pinch.

Re:20 minutes??

Before you plug in the net cable turn on windows firewall. Its minimal protection but its better than nothing. One thing to make sure of after you have the firewall up is to not go to any sites or connect to any online services other than windows update until you are fully patched. I've never had a problem getting a machine patched once I adopted this method.

Re:20 minutes??

Also, it's trivial to download a better firewall on another computer, smack it onto USB drive/CD and install that. Unlike downloading all the patches, which is not trivial at all.

Re:20 minutes??

Try 50 seconds :(
No, not joking. At work, somewhere, there is an infected computer and while rebuilding a computer I plugged it in to run the updates for 2K and antivirus. Less than a minute after pluging it in, I was crashing and burning.

I think there is a major difference between network and internet time frames. A friend of mine works for a huge corporation, 5000+ desktops at one location, and their LAN team noticed a significant increase in rate of infection when they changed the workstations from 10mbit to 100mbit.

Also, worms are programmed to infect their own subnet before branching out.

Is anyone else...

...not suprised at all? This isn't intended to be a troll, but back when blaster was "new" and I was formatting, I was hit three times within two minutes of booting, which gave me a whopping 3 minutes to download (not an issue) and install (BIG issue) the corresponding patch.

In the end I had to swap some CD burners around, download+burn the patch, and then unplug the box from the internet while booting.

Dodgy assumptions

The name "survival time" suggests that it's the average amount of time an unpatched system would last before being compromised. That assumes that every single worm targets every single unpatched system, and is always successful. That's not exactly realistic - many worms target specific programs which may well not be on the unpatched system, or target specific operating system versions.

It would be much more interesting to see average compromise times for a vanilla install of various different OS versions (with no ISP protection, of course). In the mean time, the name should be changed, in my view.

Update during Install

Microsoft should have an auto-update during install feature. (If you have broadband). During the install process it could run the windows update, blah blah blah once your nic was initialized for the first time and IP granted etc.

Re:Update during Install

chances are you will get infected before the install is finished then

the trick is easy tho :
1) unplug network
2) install xp
3) install firewall or activate build-in FW
4) plug and config network
5) patch the system

there 5 easy steps for a "safe" install

C'mon now! The patch is out!

Now we're going to sit and talk about how bad things were BEFORE the patch? Get a life!

Put an old red-hat system up and see how long it takes before you're r00t3d!

Or watch an OS-9 system crash!

Re:C'mon now! The patch is out!

Thing is, Both MacOS and Linux have had numerous RELEASE updates in the time that Microsoft haven't changed anything with the default XP install CD. Which means that if you need to reinstall XP now, you run the risk of being pwned, but if you install Linux or MacOS, you will be doing it from a much more recent CD that is far less susceptible.

I don't know how often Mac users reinstall, but if they had to, and their hardware was good enough, I'm sure that they'd upgrade to the latest version at the same time. You simply can't do that with Windows, you have your 3 year old install CD. Of course, you didn't have to pay $120 each year since like with MacOS X, although you did get extra features with that as well as bug fixes.

I doubt that many people would burn a specialised SP2 CD and do it right. Human nature - their current system has it installed via Windows Update, why download it again as a whole? They probably wouldn't even know about it.

What do they mean by survival time?

What do they mean by survival time?

Time before worm infection?

Time before the computer is brought down?

Re:What do they mean by survival time?

What do they mean by survival time?

I'm guessing here, but time between when machine is first brought online and when it's first discovered/probed/found alive by a worm or hax0r scanners - in other words, time before worm infection or other kind of intrusion, because after it dawns to the world that there's an unpatched system right before their noses, there sure isn't much time left before that system is owned.

yes, but...

the important thing to note here is that that this ISN'T the time from an announced exploitable hole (and patch), it's the time an exploit actually takes once it starts propagating.

the time it takes for an exploit to be crafted has usually been sufficient to allow sysadmins to patch- 1 to 2 months usually.

doesn't mean it happens, obviously. and the time it takes for an exploit to be created is shrinking, too.

at this point, the clue should be received: firewalls. updates. secure systems.
(and microsoft, please fix your stuff pro-actively.)

Tutorials with new computers

Every time I read about computer security compromises resulting from failure to patch/setup firewalls/etc, I can't help but think there's a better way to educate the public than to wait for them to be victims. With all the MS tutorials and "helpers" (stupid paperclip...how I hate you!), it never ceases to surprise me that when you first start up a new MS-based computer, you don't get a security tutorial. Really, how hard would it be to take users through the basics of computer maintenance (and scare them into compliance) when they go to set up a broadband connection, etc?

Two cents

1. As previously noted (I think on /.) the one thing you do not do with an unpatched WinXP system is to go onto the 'Net. Indeed, ISO's with patches or prepatched install CD's might be a solution but I think that the virus/worm/malware writers can also get these and patch their wares. Given MS's track record it'll be weeks at least before the problem is recognized or solved. It might be better to not take any WinXP system onto an open network.
2. I note that despite increased awareness and MS's increased focus on security the average survival time shows a downward trend, with slight peaks shortly after high profile worm events. How come? Is the average user slacking off? Or are the worms/viruses/trojans/whathaveyou getting smarter? Or are there ever more on the loose, resulting in an ever increasing number of probes? Looking at my firewall, the number of probes I receive remains more or less constant (although I had a few more than usual on port 8000 today) so maybe that is not a good explanation (for the Netherlands at least). Anyone?

Hardware firewall

This is why the average broadband connection should be behind at least a consumer router, even if it's the only machine connected. Routers are too cheap and easy to skip.

Re:Hardware firewall

This is why the average broadband connection should be behind at least a consumer router, even if it's the only machine connected. Routers are too cheap and easy to skip.

I've almost begun purchasing Linksys routers for my friends and family. At $40 a piece it's just ignorant not to have one. The basic firewalling that they do is pretty handy. And there are models that include client software controled firewalls. It's also nice to have a switch already at their house for when someone comes over with a laptop or such. Home networks, though still geeky, are becoming a nice thing to have with more networkable devices like game consoles (XBox, PS2) and media devices like a ReplayTV or TiVo. Also, if there are more than two people in the house you can almost be garounteed that there will be more than one computer.

But there is a secure microsoft system!

Microsoft Replies: In light of this new data, we would like to announce a new, more secure operating system. It is based on our Windows ME technology. By simply accelerating the timer for the essential bluescreen feature we feel confident that NO hacker will be able to make use of a corrupted machine.

Further, we are offended by all the FUD spread about our products by the open source community. Our security features include and expanded install size, which severly limits the space available on disk available to anyone who co-opts your computer for use as an illicit server.

Also, the times recorded by this survey are non-relevant and obviously flawed. They claim that their machines were only compromised after more than 15 minutes of CONTINUOUS uptime. This simply does not occur on our new ME+ varient. We cannot accept responsibility for those who remove our essential security features by removing 'buggy' components, or running a 'stable' GUI.

End Sarcasm;

Low survival time

The record shortest survival time, last time I checked, at the University of Alberta [ualberta.ca] is four seconds. That's from the time they plugged in an unprotected Windows XP machine until the time it was compromised.

That's not enough time to engage your software firewall pre-SP2. I'm not sure of the condition post-SP2.

Re:Low survival time

Walk down the street in downtown Detroit counting $20 dollar bills and see how long it takes for you to get mugged. Then do the same on mainstreet in West Bumblefuck, Iowa (population 15, if'n Pastor Smith isn't out of town). Betcha you last longer in Iowa. In other words that time is probably dependant on how nasty the computing environment is.

IIRC Sasser and Blaster chose their target IP's at random, starting with IP addresses in the same subnet then moving to random IP's. So if a machine gets infected four seconds after it's plugged in, that's not just a product of how poorly secured windows is, it's also a product of U of Alberta having a network chock full of RPC 'sploiting goodness. Now, if they'd have plugged in the same in an environment that had been properly patched, firewalled, etc. The box would've been fine for hours, days, or maybe it would've never been comprimised at all.

Firewall and Snort logs can give you the true tale of the tape. Some days my home firewall (SBC residential DSL) is turning away worm attempts like a goalie on speed. Other days I go 10-12 hours without so much as a nibble or a port scan.

But it is so much fun to talk about how "WIUNDOWS IS TEH GHEY! IT GOTS PWN3D IN TEH SECONZ!!LOL!!!11ONE@!!!@!

Re:Low survival time

Actually, the University of Alberta has a pretty good network as far as security and patches are concerned, though your point is undoubtedly valid. The Computing Science [ualberta.ca] department, particularly the undergraduate part thereof, is a huge supporter of OpenBSD [openbsd.org] and that is generally what the undergrad public machines run.

Fundamentally, I'm not sure what they could do differently. There's no doubt that it is a hostile environment, but the only alternative seems to be to simply shut down network access, something that just isn't reasonable at a university.

I should point out, of course, that the 4-seconds-to-0wn time is from the results of testing they did. None of the system administrators there would ever plug in a unpatched machine they weren't planning on immediately wiping.

10 minutes? Pfft.

Ive personally seen XP machines get infected with Blaster, Sasser, etc, during the install of Windows. These days, if you install Windows with an active connection to the internet, or to a network of infected machines, your nuts.


I generally install Windows with the box disconnected from the network, install all the latest updates of a CD, then attempt to connect to the network. Most of the time, that works...

How about the foolproof way I use?

• Make sure all networking cables are disconnected (but if you have an external ADSL modem like me, make sure it's plugged into the computer at least)
• Install windows
• Either install ZoneAlarm which you have handy on disk, or enable the windows firewall on your internet connection.
• Go to windows update and start the patching process.
• Go out for the day
• Get back in to find out that it's only installed 1 patch and needs to reboot
• Swear profusely
• Reboot
• Lather
• Rinse
• Repeat
• and repeat
• and repeat
• Download/install anti-virus software
• Go in and disable all those services that you don't need (themes support for one), for a good list google elder geek, he's got a nice handy guide.

That's all there is to it, I've installed my fair share of XP machines and never ever had any problems with getting patched before getting pwned.

No big deal - just install behind a firewall

I do all my machine builds and initial updates with the box sitting behind a netgear router, fully NATted and with no port forwarding - i.e. the box is invisible to the net. I've merrily built and updated many machines in this way and have never been compromised (and my last step is to virus, spyware, and trojan scan with several of each type of tool).

If you just throw a cheap hardware router/NAT/firewall in front of your box when you build, this isn't really big deal I've found.

Re:No big deal - just install behind a firewall

Exactly. Those little router boxes are so cheap, even if you only have ONE machine there is no excuse not to use one.

Maybe they are not proof against all hacks, and a determined and skilled cracker might be able to get around it with ease, but the boxes will protect you against worms. Problem solved.

This again?

Either way, 20 minutes is not long enough to download patches.

Perhaps a "TURN THE GODDAMN FIREWALL ON BEFORE YOU CONNECT TO THE NETWORK!" notice somewhere on the front page would get the point across? I've done exactly two Windows installs in my life and I know how how to safely set up a new XP system.

Much better than my company

I work for a Fortune 5 company and we've had to alter our standard load server procedure to go offline and apply some patches because we have estimated that one in six unpatched computers that we work with will get the Sasser worm (that annoying reboot prompted by LSASS).

If this happens in an enterprise environment, I pity all those clueless web users.

Put a Redhat 5.1 Server up, see how it does...

Honestly, isn't it obvious by now that if you put a old machine on the net it's going to get exploited? That's the case with Windows and Linux, put a Redhat 5 box up on a cable line and see how long before it's serving up the warez...

False Analogy

RedHat 5 is how many generations behind the latest?

We're talking about people who want to install from the absolute latest Windows CD, and they have to take severe steps to avoid getting 0wned.

How significant?

How much of that can be attributed to faster technologies ? Greater CPU speed, Connection Speed etc?

Nick...

Untrue

That's not true at all.

I have a bone-stock winXP system here, and have been running online for almost an hou*(&^@ SD#&7*$^)_*( #$%@#&*() #

NO CARRIER

Beating the probers

Breathe in, breathe out. This can be overcome!

1. Unplug your network connection before you install the OS.
2. Install the OS
3. Before you connect to the network, shut down every service you can shut down and make sure they don't start automatically.
4. Connect the computer to the network.
5. Run windows update until you're fully patched
6. Set up the firewall
7. Start enabling any service you might want to run.

This approach will hopefully keep you safe from harm - and it will definitely reduce your exposure!

But which versions

I'd be interested to know the average survival rates for a whole bunch of unpatched operating systems. I'd start with:

- Win95/98/Me
- WinNT4/2K/XP
- Win3.1 (with Trumpet Winsock)
- Mac OS (whatever the first version with a TCP/IP stack)
- Linux (various distros)

ALL unpatched.

Paradoxically, I reckon the newer Windows systems would go first (more services open to the world), along with older Linux distros (same problem).

20 minutes? you mean, more like 20 seconds?

I recently reinstalled winXP on my 'puter (shame on me) to be able to use the NetMD software. Well, I knew what was going to happen as soon as I plugged the ethernet in. So, as usual, I installed winblows, then McAfee Antivirus 7 + firewall, then plugged the cord to get the updates. 20 seconds later, mcafee stopped functionning. I received tons of windows messages about earning college degrees online, a couple porn ones and whatnot. Ok, so far, nothing (too) surprising. So, I take my courage with both hands, open up IE to go to windows update. BIG mistake. Instead of windows update, I ended up on some obscure casino website with so many popups I thought my system was going to jam. A few hundred clicks later, I finally see the new windows update page. Then, I start downloading the updates, like everybody else does. Of course, in the meanwhile I left a total security black hole open for every hacker in Beijing to try and read the lack of data on my drive. I can understand how some people overcome the integrated winXP firewall. But HOW in the world did they hack McAfee's to stop working? I had to download updates manually, and McAfee, just like windows update, REQUIRES IE, for some obscure non-standard non documented function. So... is M$ the only one at fault here? probably not, though I'm willing to bet it's because of winXP security failures that McAfee was disabled. Sometimes I think of WinXP of a sponge. So many many many holes... And they have to be filled one by one. No wonder winblows will never be secure. But, the reason lots of people use it, as my gf says: sponges are nicer, you don't wanna use a rock unless it's to crack heads. So, moral of the story? It's the opensource world's role to crack the big fat happy M$ head.

Windows Patch Process..it takes too long

A few weeks ago, I installed Win2k. I then proceeded to Windows Update and started the patching process.

I went for the big updates first (like Service Packs and IE upgrades) - but most of those require that they be installed alone with no other updates until the machine is rebooted. So you have this long drawn out process of download a single patch, reboot, download another single patch, reboot, download another patch, reboot, repeat ad-nauseaum and finally download all the straglers. I not sure how many reboot cycles I had to go through, but the whole install and patch process (including partitioning and formating) took over an hour. And that was attended.

My point here is that during the patch process with the constant reboots, it would be easy for somebody to walk away from a machine while it is downloading or rebooting and thereby leave it open to attack while it is idling. Of course, you ought to download all the patches on a secure machine and then patch-up you new box while inside your own secure net before exposing the box, but most people (like me) are going to connect direct to the internet to get "windows update". Luckily, I am behind a firewall, but you can easily imagine how ugly it could get if somebody were doing this outside a firewall. The single downloads and constant reboots are not going to help.

20 minutes my arse.

Usually when I install a fresh copy of Windows I disconnect the ethernet cable before I've at least installed a firewall (if the computer isn't already behind a router/firewall) and done any updates.

The other day I was at my sister's house and installed her a fresh copy of w2k. For some reason I completely forgot to disconnect the network connection and not two minutes after Windows initially started, the machine had become infected with Nimda.

this stuff has been said in other posts, but...

First of all, if you buy a new machine with the OS pre-installed, it will probably be patched almost up to date out of the box.

Second of all, if you're installing your own OS, you're taking on the responsibility to do things in a minimally competent way. That might mean a NAT router, a slipstream installed CD, or just a CD with the service pack burned on it, so you can install it before you plug into the net.

Third of all, you should be using a hardware firewall anyway.

People should learn how to patch windows systems

Firewall

Firewall

Firewall

XP has a built in firewall, did you know this? When it it turned on, even an unpatched system is protected from attempts at remote intrusion. You are still vulnerable to IE exploits, but if you're using IE on an unpatched system you need to be smacked. Actually if you're using IE at all you deserve to be smacked, just not as hard.

So, the next time you do a clean install of XP and need to download patches, turn on the firewall BEFORE you connect it to the network. Then immediately begin installing patches from windows update. Each time you need to reboot during this process, yank the network cable until the system has finished booting. The reason is that an unpatched and partially-patched Windows system is vulnerable during boot-up. It seems that the windows firewall is one of the last things to be turned on during boot up instead of the first, which creates a window of opportunity for attacks to succeed.

Once the system has installed all of the patches that are available, LEAVE THE FIREWALL ON unless you have a very good reason not to and know what the fsck you are doing.

If you'll follow this simple proceedure, patching your windows system is safe and easy.

I'm sick and tired of reading slashdot headlines that claim there are all kinds of problems patching a windows system. Windows may suck, but that is no excuse for lying about it. Propaganda and FUD are best left to the professionals in Redmond.

Lee

Wnidows XP: Surviving the First Day

From the SANS inst - a PDF file giving step by step, detailed instructions (suitable for newbies!) on how to setup a brand new, un-patched XP box, connect to the I-net, get it all patched and updated *WITHOU* getting it all FUBAR'd in the process.

Good read and should be a mandatory inclusion with every Smith's Club, Wally-World, Shack de Radio, Dell, HP/Compaq, ET-ware, Gamer's Hack Shack or any other end user PC appliance sold.

http://www.sans.org/rr/papers/index.php?id=1298 [sans.org]

SANS server is amazingly slow today - here's an alternate:
http://www.cablemodemhelp.com/xpsurvivalguide.pdf [cablemodemhelp.com]

Maybe the real problem is...

... that the high-speed Cable internet installation CD instructs the user to turn off all anti-virus and fire-wall software during installation. Talk about a security flaw! It's like telling somebody to remove all contraceptives before ... you know ... for the first time.

Get a router, or ZoneAlarm

My first recommendation is that you get a router with a hardware firewall--for the price, there's really no reason not to. And any ISP who discourages the use of routers is just plain irresponsible.

If you don't have a router, have the free version of ZoneAlarm handy, and a list of the services you can shut down on Windows (everything you don't need that uses ports or acts as a server.) Shut down these services and install ZoneAlarm before you plug the machine back into the internet. When you do connect to the web, no one will even know you're there.

Between my router, ZoneAlarm, Ad-Aware, and some good anti-virus software, I haven't been touched by anthing out there for 10 years, even when installing and patching.

Violated when reinstalling XP SP1

In my case, when I reinstalled XP about a month ago, my computer was compromised 5 minutes after XP was running. That was not enough time to get SP1 downloaded (over a cable modem). Some mystery process was running that kept popping up dialogs.

Surviving first day checklist from PDF

Windows XP: Surviving the First Day (Checklist)

• Disconnect Network Connection.
• Setup a secure administrator password.
• Disable Client for Microsoft Networks
  To verify: Start -> Control Panel -> Internet and Network
  Connections -> Network Connection -> select your network
  connection
• Disable File and Printer sharing
  verify using the same dialog as 'Client for Microsoft
  Networks'
• Enable Internet Connection Firewall
  same dialog as 'Client for Microsoft Networks'. Select
  'Advanced' tab.
  Connect Network
• Run Windows Update until there are no more critical updates.
  Start -> Control Panel -> Windows Update -> Scan for
  Updates

PS: If I remember correctly turning on the firewall (Pre SP2) will prevent you from communicating with other computers on your LAN. But you definitely want to turn it on until you get patched or download/buy another firewall.

Internet Weather

.::: So basically we now have a sort of 'Internet weather', which tells wether your computer can go play outside or not?
Nice, I can see the evening news getting an extra report then.

"In North America we have some nasty worms raging across the Net spreading all the way to Europe, better close up those ports. Asian PC's may want to wear an extra layer of firewall as we got some heavy probes coming in. South-Afrika meanwhile has some lovely patchy weather."

What I'd like to see

Is a country-by-country study of this kind. I say that, because I read lots of comments here and on similar sites about all the probes and other unwanted network activity that people see, and yet my machine is usually on every waking moment, and is connected to the net via ADSL, yet I see almost no activity. Once every few days my software firewall (Sygate Personal Firewall) will tell me that a small handful of ports have been scanned. For example, I've actually had the machine on and connected for almost 3 days now, and my firewall is showing no unusual activity.

Now, either I'm just not logging enough (entirely possible), or I'm sat on a very, very quiet part of the net. I have to wonder how much one's country of residence influences this sort of thing, given that I'm in the UK and I'm guessing most people here are in the US.

Point still holds

If you noticed, I didn't start with the Windows user completely re-installing the OS. Here's a typical after-install security sequence for Windows:

1. Reboot and verify network card drivers loaded.
2. Configure the network, including the firewall.
3. Reboot for changes to take effect.
4. Reboot.
5. Install AV software.
6. Reboot.
7. Download anti-spyware and anti-adware programs. Install them.
8. Reboot.
9. Disable the firewall so you can use Windows Update.
10. Reboot.
11. Get infected by Blaster or other assorted worm while downloading Windows Update, or SP2, if you prefer....
12. Re-enable the firewall, have the AV software "clean" your machine.
13. Reboot.
14. Wait another hour as AV software scans and cleans your machine. 155 viruses found. All cleaned.
15. After 15 minutes of blank pages, you realize you no longer have a network connection. Somehow, Windows "lost" your network card drivers...
16. Reinstall network card drivers.
17. Reboot.
18. Reconfigure networking, including the firewall.
19. Browse the Microsoft site, attempting to figure out which services you can disable, and which ports you can block. 10 hours.
20. Disable said useless services, block unnecessary ports - 15 minutes.
21. Reboot.
22. Oops! - you've accidentally disabled a key service that Windows needs to boot. Get out your recovery disk and attempt to fix your machine....
23. Reboot.
24. Finally, you can now start to reinstall all of your applications. Hope and pray that you have the original CD keys.
25. Disable the firewall so you can register your copy of MS Office. Get infected by another internet worm in the process.
26. Run the AV scan again: cleaned 12 viruses and trojans.
27. Reboot.
28. Now continue to reinstall your Windows-only software. Curse when you realize that you've misplaced some of your CD's; curse more as you realize you've lost some of the CD keys....
29. Spend another 5 hours trying to figure out why your favorite app doesn't run. Oops - SP2 is not compatible with it!
30. Congratulations - you've restored your machine to almost the way it was before. You didn't need those other applications anyway.... It's been a hard week - kick back and have a beer.
31. Next week, you'll reinstall Windows again, and repeat the process. But this time, you'll only download a few of the key updates, in an attempt to get your favorite app to work.

And two months later, you'll repeat the process yet again. It seems you forgot to apply the latest patches while on vacation, and some internet worm has taken over your machine....

Is this really any worse than installing Linux, once?