In the beginning, there was a bug...
Mar. 1st, 2005 09:45 am![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
janestarzIn the beginning there was a computer. And this computer got access to a certain around-the-globe network. But in the many years since telnet, things have changed on the Matrix this so-called "Internet". People changed. Operating systems changed...
Now, there is a computer. And it's hooked up to the net... And, no matter what OS you're on...
this is what happens next.
Article Published: Monday, February 28, 2005
How secure is your computer?
“Honey pot” experiment shows unprotected Windows SP 1 at risk
By Ross Wehner
Denver Post Staff Writer
A Windows computer without the latest security patches is in big trouble. That's the conclusion from a "honey pot" experiment conducted by StillSecure, a Louisville network security firm.
StillSecure attached six computers - loaded with different versions of the Windows, Linux and Apple's Macintosh operating systems - earlier this month to the Internet without anti-virus software.
The results show the Internet is a very rough place.
Over the course of a week, the machines were scanned a total of 46,255 times by computers around the world that crawl the Web looking for vulnerabilities in operating systems. Once the vulnerabilities were identified, the remote computers launched 4,892 direct attacks with a staggering variety of worms, Trojan Horses, viruses, spyware and other forms of malware. The test examined only what happens when computers are turned on and connected to the Internet. The test didn't evaluate additional dangers that computer users face when they use e-mail, surf the Web, click on Internet links or use file-sharing programs.
The good news is that none of the up-to-date, patched operating systems succumbed to a single attack.
The Windows Service Pack 2, or SP 2, system is the most up-to-date Windows operating system. It received 16 direct attacks. The Macintosh system received three attacks. Two of the Linux systems received eight attacks each, though Red Hat's version of Linux received no attacks at all. But in the end, none of the attacks were successful.
The Linux and Macintosh sytems were installed out of the box without any additional security patches. Windows SP 2 automatically downloads the latest security patches from the Microsoft website.
Windows Service Pack 1, or SP 1, however, was another story. It's an older version of Windows that was sold in computer stores until a few months ago. SP 1 was attacked 4,857 times. It was infested within 18 minutes by the Blaster and Sasser worms. Within an hour it became a "bot," or a machine controlled by a remote computer, and began attacking other Windows computers. Microsoft responded that the tests prove that any operating system is vulnerable when not patched. "The results don't surprise me at all," said David Brandt, principal technology architect at Microsoft in Denver.
Microsoft stopped shipping SP 1 in August and replaced it with the more secure Windows SP 2. Most computers with SP 1 had been sold from stores by Christmas, said Microsoft spokesman Sean Sundwall. SP 2 comes with a firewall and automatic security updates, said Sundwall. These features had to be manually turned on in SP 1, which meant that some users missed out on computer patches. Many computers around the world are still running Windows SP 1, though exact numbers are hard to come by. Gartner research director Michael Silver estimates that by the end of 2005, half of the world's desktops used in businesses will still be using SP 1. "But most companies are pretty good about keeping their PCs patched, and most have corporate firewalls," said Silver. Large companies are switching to SP 2 slowly because they have to make adjustments to thousands of different software programs first.
The honey pot test is a good indication that many small-business and home computers are still using older versions of Windows, according to StillSecure chief technology officer Mitchell Ashley. "Why are we getting hit by Blaster?" asked Ashley. "Because there are infected machines out there. Why are they infected? Because they don't have the updated patch." Microsoft is concerned about security issues surrounding Windows and Internet Explorer, and the resultant surge of Linux, which can be downloaded for free from the Internet. Most companies, however, chose to pay a Linux vendor in order to receive security patches. Experts also consider Linux less prone to viruses.
"(Security) is a huge pain point for Microsoft," said Silver. "Microsoft takes the threat of Linux very seriously." Over the last nine months, Microsoft has gone on the offensive with a "Get the Facts" campaign that argues that Windows is cheaper and more secure than Linux. Microsoft's leadership position means that more viruses are written for Windows, said Silver, who estimates that 96 percent of all desktops and laptops worldwide used Windows at the end of 2004. Macintosh has 2.5 percent of the market, while Linux is at 1.3 percent, Silver said. "There are going to be security holes in just about any operating system," said Silver. Silver predicts that Linux will climb to 3 percent of the market by 2008.
As of this month, 25 million people around the world have downloaded a free Web browser, Mozilla Firefox, which a variety of security experts have trumpeted over Microsoft's Internet Explorer. Microsoft is racing to roll out its new Longhorn operating system in 2006. But for the moment, it's sticking with Windows, for which it rolled out a new patch Tuesday.
"SP 1 is not a current operating system," said Sundwall. "It doesn't surprise me that it only took 18 minutes to get infected."
People, please. Do everyone a favour. Keep your OS updated. Download the security patches.
First and foremost of all: if your computer gets infected, it'll affect you. It'll get slow, maybe some files disappear, or some adware will be installed. Secondly: you will be a pain to other computer-users. If you use e-mail, viruses can spread themselves from your computer to the next, by just looking at your inbox and scrounging all the e-mail adresses. Sometimes your computer will be taken over by hackers, if you're really unlucky. This means your computer will do stuff you didn't tell it to do. It'll be a zombie, attacking another person's computer or network. You won't have any control over it.
You know what the scary bit is? That no matter what you do with your computer, you're at risk. As soon as you plug into the net, you're going to be attacked. You don't have to do nothing with it. It only gets worse if you use your e-mail or surf.
Now, there is a computer. And it's hooked up to the net... And, no matter what OS you're on...
this is what happens next.
Article Published: Monday, February 28, 2005
How secure is your computer?
“Honey pot” experiment shows unprotected Windows SP 1 at risk
By Ross Wehner
Denver Post Staff Writer
A Windows computer without the latest security patches is in big trouble. That's the conclusion from a "honey pot" experiment conducted by StillSecure, a Louisville network security firm.
StillSecure attached six computers - loaded with different versions of the Windows, Linux and Apple's Macintosh operating systems - earlier this month to the Internet without anti-virus software.
The results show the Internet is a very rough place.
Over the course of a week, the machines were scanned a total of 46,255 times by computers around the world that crawl the Web looking for vulnerabilities in operating systems. Once the vulnerabilities were identified, the remote computers launched 4,892 direct attacks with a staggering variety of worms, Trojan Horses, viruses, spyware and other forms of malware. The test examined only what happens when computers are turned on and connected to the Internet. The test didn't evaluate additional dangers that computer users face when they use e-mail, surf the Web, click on Internet links or use file-sharing programs.
The good news is that none of the up-to-date, patched operating systems succumbed to a single attack.
The Windows Service Pack 2, or SP 2, system is the most up-to-date Windows operating system. It received 16 direct attacks. The Macintosh system received three attacks. Two of the Linux systems received eight attacks each, though Red Hat's version of Linux received no attacks at all. But in the end, none of the attacks were successful.
The Linux and Macintosh sytems were installed out of the box without any additional security patches. Windows SP 2 automatically downloads the latest security patches from the Microsoft website.
Windows Service Pack 1, or SP 1, however, was another story. It's an older version of Windows that was sold in computer stores until a few months ago. SP 1 was attacked 4,857 times. It was infested within 18 minutes by the Blaster and Sasser worms. Within an hour it became a "bot," or a machine controlled by a remote computer, and began attacking other Windows computers. Microsoft responded that the tests prove that any operating system is vulnerable when not patched. "The results don't surprise me at all," said David Brandt, principal technology architect at Microsoft in Denver.
Microsoft stopped shipping SP 1 in August and replaced it with the more secure Windows SP 2. Most computers with SP 1 had been sold from stores by Christmas, said Microsoft spokesman Sean Sundwall. SP 2 comes with a firewall and automatic security updates, said Sundwall. These features had to be manually turned on in SP 1, which meant that some users missed out on computer patches. Many computers around the world are still running Windows SP 1, though exact numbers are hard to come by. Gartner research director Michael Silver estimates that by the end of 2005, half of the world's desktops used in businesses will still be using SP 1. "But most companies are pretty good about keeping their PCs patched, and most have corporate firewalls," said Silver. Large companies are switching to SP 2 slowly because they have to make adjustments to thousands of different software programs first.
The honey pot test is a good indication that many small-business and home computers are still using older versions of Windows, according to StillSecure chief technology officer Mitchell Ashley. "Why are we getting hit by Blaster?" asked Ashley. "Because there are infected machines out there. Why are they infected? Because they don't have the updated patch." Microsoft is concerned about security issues surrounding Windows and Internet Explorer, and the resultant surge of Linux, which can be downloaded for free from the Internet. Most companies, however, chose to pay a Linux vendor in order to receive security patches. Experts also consider Linux less prone to viruses.
"(Security) is a huge pain point for Microsoft," said Silver. "Microsoft takes the threat of Linux very seriously." Over the last nine months, Microsoft has gone on the offensive with a "Get the Facts" campaign that argues that Windows is cheaper and more secure than Linux. Microsoft's leadership position means that more viruses are written for Windows, said Silver, who estimates that 96 percent of all desktops and laptops worldwide used Windows at the end of 2004. Macintosh has 2.5 percent of the market, while Linux is at 1.3 percent, Silver said. "There are going to be security holes in just about any operating system," said Silver. Silver predicts that Linux will climb to 3 percent of the market by 2008.
As of this month, 25 million people around the world have downloaded a free Web browser, Mozilla Firefox, which a variety of security experts have trumpeted over Microsoft's Internet Explorer. Microsoft is racing to roll out its new Longhorn operating system in 2006. But for the moment, it's sticking with Windows, for which it rolled out a new patch Tuesday.
"SP 1 is not a current operating system," said Sundwall. "It doesn't surprise me that it only took 18 minutes to get infected."
People, please. Do everyone a favour. Keep your OS updated. Download the security patches.
First and foremost of all: if your computer gets infected, it'll affect you. It'll get slow, maybe some files disappear, or some adware will be installed. Secondly: you will be a pain to other computer-users. If you use e-mail, viruses can spread themselves from your computer to the next, by just looking at your inbox and scrounging all the e-mail adresses. Sometimes your computer will be taken over by hackers, if you're really unlucky. This means your computer will do stuff you didn't tell it to do. It'll be a zombie, attacking another person's computer or network. You won't have any control over it.
You know what the scary bit is? That no matter what you do with your computer, you're at risk. As soon as you plug into the net, you're going to be attacked. You don't have to do nothing with it. It only gets worse if you use your e-mail or surf.
![[identity profile]](https://www.dreamwidth.org/img/silk/identity/openid.png){kind=small}
no subject
Date: 2005-03-01 02:04 am (UTC)I'm having a difficult time convincing them that the advantages of a "connected" computer outweigh the hazards. These things described in the article make me waver.
I am technically reasonably clued up, but even for me it's hard to keep stay a step ahead, albeit due to the fact that I don't like spending much time on security issues.
How should my family then protect themselves, they who already have difficulties sopelling the word 'computer'?
I think I'll stick to writing letters...
no subject
Date: 2005-03-01 02:36 am (UTC)The problem is, if you're stone age, and you start to use a computer, you will probably start on Windows. Which is actually the more targeted machine because it's 96% of the market. So because it's easy, it's more commonly used. And because it's more commonly used, it's unsafe.
Still, updating your computer can be learned quite swiftly. Also, never trust anything the computer wants you to download by pop-up. And check the URL of the page you're updating your Windows from. If it says eu.microsoft.com you've got a pretty good chance it's the right page.
Just those simple tips that can keep you a lot safer. Print it out and tape it to the computer so they can't forget.
no subject
Date: 2005-03-01 02:08 am (UTC)It also helps that i don't have Outlook installed. I only use webmail. If by any change i do get infected, it wont spread to other computers...
no subject
Date: 2005-03-01 05:06 am (UTC)Basically, it all starts with a few basic rules:
- Update regularly.
- Scan regularly.
- Do not fall for it.
- Never, EVER, openly post someone's emailaddy on a forum or other public medium.
- Never, EVER, forward.
Stick with those, and you will be fine.
no subject
Date: 2005-03-01 09:32 am (UTC)Some of them cannot reach me by email any more because I refuse give them any email address (if you don't know how to use technology - don't).
I do still send them mail sometimes, but the sending address is then usually a deleted email alias. I simply tell them to use one of my web mail forms if they want to contact me.
no subject
Date: 2005-03-06 03:04 pm (UTC)Haha. Considering that the OSX and Linux boxes were not auto-updated at all... Jaguar is almost 3 years old.
And then there's outlook (about 1/4 of my spam is somebody in hong kong infected with netsky).