Stop Christmas-Gift PCs From Feeding Worms 416
An Anonymous Reader writes "If you recently set up a new PC with Windows XP,
or if you had the pleasure to do a 'reinstall from scratch,' you probably found that many XP systems as they are shipped today are not patched against common issues like Blaster. Given that these worms are still going strong, it doesn't take long for a new system to be infected. In particular, if you have to connect it to the Internet to download all the patches.
Well, help is in sight. The SANS Institute released a paper entitled Windows XP: Surviving the First Day." (Read on below.) Update: 12/24 17:59 GMT by T : Thanks for reader Bill Curnow for the updated link. Update: 12/24 19:15 GMT by T : Besides the workaround suggested below, Roblimo has a good suggestion on avoiding the first-day-of-Windows altogether.
"With many screen shots, it will walk you through the procedure to enable the XP firewall and downloading the patches without getting infected while doing so. This could be the (free) stocking stuffer that may save Christmas for your folks ;-). Given that its probably to late now to start downloading your favorite Linux distro."
But if you do have the time and bandwidth, and you're stuck on Windows, a nice live-CD distro like Knoppix or Mepis means you can download patches without racing the worms, and install your patches while offline. (And if you have time to download 50MB, you have time to grab Damn Small Linux.)
Need for Microsoft patch CD (Score:5, Interesting)
People should return non-patched systems that are shipped from the manufacturer, and return systems where the install CDs don't put them to the same patch level they are shipped with.
while this isn't a cure-all solution to the patch mania that is necessary, but will go a long way to help bring up the baseline security of all these end-user hosts on the internet.
First day? (Score:3, Interesting)
Due to some oddities in the purchasing orders for new hardware this year, it ended up that some of us unix guys were tasked with hauling new windows boxes around the workplace for people. We weren't expected to set them up, just unpack, plug em in, and turn em on. Ignorant of how vulnerable windows boxen are, we did just that, doing the silly clicky crap that any OEM relase makes you do, and walked off.
Within ten minutes, the traffic sniffers the security team has up were getting alarms caused by the machines we had set up and their ports got blackholed in about 15 minutes. One of the machines was already being used as a spam relay, the rest all had whatever viruses are still floating around.
Was quite an eye opener, I'd thought those viruses were over and done with and weren't a cause for concern anymore. Made me wonder how much bandwidth is being wasted that we don't even acknowledge. Spam is easy because it generates email.. but there's this underlying background noise sucking up bandwidth that you don't even see.
Course us "unix guys" had a good laugh over it, patting ourselves on the back in true bigot fashion over how secure unices are. But later that afternoon the nfs server that serves our home directories puked it's guts up so it put us in our place pretty quick.
Sadly enough (Score:2, Interesting)
Re:Easy Alternative (Score:5, Interesting)
Linux CDs for checkout at the local public library (Score:3, Interesting)
No enough people have the broadband or fast enough download capabilities to handle file sets that above a few megabytes.
Having the inexpensive CD-R sets available for checkout at the local public library would go a long way to solving the distribution problem of the general public.
Plus the local Linux group could keep the circulating distributions current and the latest patches available.
I think that there was a discussion about this on Slashdot recently, but I don't recall.
Install from stratch... (Score:3, Interesting)
Here on the Hell Desk... (Score:5, Interesting)
It's sad and irresponsible to let these people wander onto the Internet with their unprotected Windows computers like dogs wandering onto the freeway.
My father had to fight to install XP (Score:2, Interesting)
He finally had to resort to getting the guy that gave him XP to make a CD up of the patches so he could actually use XP on the net.
Personally I just have to say thanks to my linux firewall.
Re:First day? (Score:3, Interesting)
Firewall (Score:3, Interesting)
Computers don't get viruses, users do.
Re:Easy (Score:3, Interesting)
Granted, this is on a work machine where I'm not allowed to change the settings, so maybe it can be fixed with twiddling, but I find the behavior to be extremely annoying. I much prefer ipfw on my FreeBSD box. Just my $0.02US
Re:[Somewhat OT] "Not up to linux yet" (Score:3, Interesting)
There are a LOT of people in this situation, and they are the perfect candidates for using Linux. They have a fixed set of needs. Give them a preinstalled and preconfigured Linux box, and they treat it like a fixed-function appliance.
I'll skip the long details, but my 57 year-old mother got so fed up with Windows' unreliability back in 2000 that she pestered me for weeks to wipe Windows and install Linux. I'd been running it for years and raving to her about its stability and reliability, so she was ready.
Her needs were and are simple. She wants web access for online purchases, she wants email, and she wants word processing. She also wants my nephew to be able to use her computer to play the games that I have on my computer.
I did the backup Windows data/install Linux/restore Windows data to Linux routine with Mandrake 9.0, configured her icons, set up her Internet connection and showed her how to activate it, transferred her email to Mozilla (at her request; she likes the all-in-one feature of Mozilla), showed her how to use AbiWord (which she loves) and put the necessary icons on her desktop.
After a few brief explanations on where Linux was different from Windows (in terms that were useful to her) and how that benefitted her, she was able to use Mandrake for her everyday tasks.
I keep intending to upgrade her to Mandrake 9.1 (and now 9.2) because the old sound driver from Mandrake 9.0 is flakey, but I keep forgetting to do it. Her system is 100% reliable for her, and Mandrake 9.0 is still chugging along now as it was back in 2000.
I haven't had to deal with and computer problems on her system, while my dad's Windows system still needs frequent babysitting. If Yahoo Messenger weren't using a proprietary audio CODED, but used something like Ogg Vorbis instead, he would dump Windows in a heartbeat. He used to be a die-hard Windows user, but even he has finally been broken by Microsoft. He just has that one application.
I used to think like you (Score:2, Interesting)
I plugged a 98 box into a freshly installed cable modem (Time-Warner RoadRunner if it matters). Within 20 minutes the box was rooted. It was my mistake. I had brought the machine from a network that was behind a hardware router, and placed it directly on the cable modem. I had sharing enabled directly to the c: drive, password protected.
The worm reset the password to null and enabled sharing of other drives.
It then tried to write itself to all the fixed disks on the machine (that is how I detected it: I was transferring photos from a compact flash card, thru a USB, when it hanged. A copy of the virus was found on the card.
It is possible that the infection would not have been detectable without running trojan scan [trojanscan.com] and online antivirus [antivirus.com] particularly when the speed of cable is considered.
The worm installed a backdoor on a Windows box, and then tries to locate and infect and windows shares on the block.
Needless to say, surfing without a condom on a windows machine is dangerous indeed.
Blaster within minutes of a fresh install. (Score:3, Interesting)
Since this was a recent purchase and the after thought SP1a sticker was there, I mistakenly assumed that it would be safe against Blaster.
Regardless, I enabled the built in firewall on the external interface NIC before I connected to the internet via her ADSL.
I couldn't get it going. I was using the ISP PPPoE driver which was supposed to work, but the ISP suggested I use the built in XP PPPoE driver, which worked fine. The phone tech also said that I must disable any firewall due to the use of a heartbeat initiated at their end.
So, I reluctantly did...
Her PC had Blaster literally within a minute or two of connecting.
But here comes the funny part... to get around the 60 seconds to shutdown, I double clicked the time to set the year back to give me a chance to remove the virus and patch her system. Unfortunately, during this, I had to reboot. At this stage the 30 day registration period was still in effect because I had not registered. Upon reboot, the 30 day period was up, XP was demanding I register now without giving me the desktop! Luckily it seems that it automatically connected.
Next time I'll just set it back an hour!
This kind of crap just has not happened to me on my Apple. In the end, I enabled the firewall and she has not had a problem. It might not have happened if I knew XP better (first install), but then I gave up on Microsoft long ago.
Re:Roblimo fud (Score:2, Interesting)
Strange, I *just* played GTA: Vice City on my slackware box, with zero problems. The entire process involved an "installpkg winex.tgz", running "winex3 setup.exe", and navigating to the game in the kde menu. If Little Johnny wants to play Vice City, he should be able to figure out at least this much.