Just 12 minutes

Ant wrote:
> "Daave" wrote:
>
>> but I'm just curious if someone who has an ordinary modem and is not
>> running a software firewall, etc. will be in danger of being infected
>> within 12 minutes as is commonly believed,
>
> I am that person! When the Swen worm first appeared some years ago I
> was infected within seconds of going online. I didn't know about it or
> the patch that had been released because I'd been abroad for a while
> and hadn't been keeping the system up to date.
>
>> and if so, what is the mechanism by which this can happen?
>
> It happens because in Windows NT, by default, there are certain
> network services running with ports open listening for incoming
> traffic. This is a very bad idea but as we know, Microsoft have
> tended to put ease of use ahead of security. Any vulnerabilities
> (bugs) in those services may be exploitable so that code is injected
> and run. There are machines (bots) constantly scanning IP address
> ranges looking for such opportunities.
>
> I have since closed all ports so that even without a firewall I am no
> longer open to these kind of attacks.

Good idea.

How do you close all ports without a firewall? Don't you need some ports
open if you want to use the Web, e-mail, etc.?

>> In my scenario, the PC is just sitting idle. Or sitting at Windows
>> Update.
>
> I also don't allow automatic updates; in fact I haven't updated past
> Win2k SP2 (no longer supported). However, I wouldn't advise this for
> most people.

Interesting. Windows 2000 is up to SP4, I believe. What is your main
reason for not keeping up-to-date with the patches?

"Daave" wrote:

> Ant wrote:
>> I have since closed all ports so that even without a firewall I am no
>> longer open to these kind of attacks.
>
> Good idea.
>
> How do you close all ports without a firewall? Don't you need some ports
> open if you want to use the Web, e-mail, etc.?

Those ports are for out-going data and solicited incoming data on a
temporary basis for the specific requests. The point is to not have
unnecessary services running which are listening for requests on a
specific port.

For example, if you run a web server you need to accept requests for
service from anyone on (usually) port 80, so that port is always open
to receive traffic. If you are browsing the web you are *sending* to
the server's port 80 and receiving the page through a port above 1025
temporarily opended for that purpose.

Likewise, when using email or news, you are sending and receiving data
only when requested -- the ports are only open for the session.

In other words, you should block all incoming traffic unless you
specifically asked for it. If you have nothing listening for it in the
first place then there is nothing to block because another computer
cannot make a connection.

>> I also don't allow automatic updates; in fact I haven't updated past
>> Win2k SP2 (no longer supported). However, I wouldn't advise this for
>> most people.
>
> Interesting. Windows 2000 is up to SP4, I believe. What is your main
> reason for not keeping up-to-date with the patches?

There are various reasons which I've explained here before. However,
the main one now is that I can't be bothered with it, especially on a
dialup connection. My system is basic and configured well enough that
I don't have to worry about exploits. The more Windows advances, the
more bloat, fluff, complexity and bugs are added. I know exactly what
is running with my setup, why and what faults exit. If anything did
get through I'd spot it straight away and know how to deal with it.
Dissecting malware every day and knowing how Windows works at a low-
level helps a bit.