Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Operating Systems Software

How Long is Too Long to Update? 415

Posted by Cliff from the tick-tock-tick-tick dept.
StWaldo asks: "I'm sure everyone knows the story about the life expectancy of an fresh, un-updated PC, once it's connected to the internet. What about a PC which just hasn't been updated in a while? I've been deployed in Iraq for the last 9 months, and haven't been able to hook up my laptop to the internet to get updates (I do HAVE access, just can't hook up a personal laptop, gov't only). Before I deployed, I would update my software (system, anti-virus, firewall, anti-spyware, etc) regularly, but as I get closer to coming back to the States and my broadband connection, I'm beginning to wonder what the life expectancy of my PC will be. What's the lifecycle of a security exploit, hack, virus, etc - between discovery/release, propagation, and extinction (or a state approaching extinction)?"
This discussion has been archived. No new comments can be posted.

How Long is Too Long to Update? More

How Long is Too Long to Update?

Comments Filter:

  • How long could it survive... (Score:5, Informative)

    by daveschroeder ( 516195 ) * on Thursday December 08, 2005 @05:45PM (#14214082)
    ...with an unprotected connection? Who cares?

    1. Put your computer behind literally any personal firewall/router (Linksys, DLink, etc.) that can be had - wireless and wired or both - for under $50.

    2. If you have Windows XP Service Pack 2 (SP2), just make sure the firewall for your network connection is still enabled; it is by default on SP2, and Security Center will warn you if it isn't. Unless you explicitly disabled it, it will still be enabled.

    If you don't yet have Service Pack 2, simply enable the Windows firewall (Internet Connection Firewall) for any network interface(s) you have. This can be done on the Advanced tab of each connection's Properties.

    3. There is no step 3.

    There's nothing you have to do other than ensure you have a software firewall enabled, and optionally have your machine behind a nice little personal firewall/router. Then it doesn't matter how long it's been or what exploits are out there[1].

    That's it. Even the built-in Windows software firewall on a machine with no patches or service packs installed will protect a Windows XP system. Seem simple? It is. One wonders why it took Microsoft *so long* to make it the default.

    [1] Sure, there may be exploits that affect browsers or other aspects of the system that could be exploited by *visiting malicious sites*, but the machine, just sitting there, won't be vulnerable. If all you're going to do is immediately update everything anyway, you have nothing to worry about.

    • Re:How long could it survive... (Score:5, Funny)

      by mikecito ( 777939 ) on Thursday December 08, 2005 @06:13PM (#14214331)
      While there may not be any virus or exploit that can get to you with this method, your laptop may still have contracted some nasty bacteria while abroad. I recommend boiling it for at least 1 hour before using it.

    • Good enough, anyway (Score:3, Informative)

      by abb3w ( 696381 )
      This isn't QUITE true; there are one or two older personal NAT routers where the initial factory firmware has had exploits published (especially with certain dumb default settings), and there are a few software packages with versions that both poked holes in the XP firewall and were exploitable. As far as I know, nothing in the wild specifically targets both, so unless you have reason to be worried about highly personalized targetting of your computer, it should be just fine. (If you do have reason, buy a n
    • I disagree. Simply using a NAT router DOES NOT protect your machine from e-mail worms (like Sober, for example). It also doesn't protect your machine from any other wom-infected machine behind the router. NAT routers are an absolute requirement as step one. Step two is to immediately update your system.
    • Comment removed based on user account deletion
    • And whatever you do, do not put a Sony/BMG title Silver Disk With DRM'ed Music Tracks On It* into your CD player.

      * I refuse to call it a CD.

  • make sure your firewall is running (Score:3, Insightful)

    by e_AltF4 ( 247712 ) on Thursday December 08, 2005 @05:46PM (#14214087)
    don't start any applications
    make sure your firewall is running
    do your updates

    bingo
    • don't start any applications
      yeah right, it takes my wife's WinXP longer to go from log-in screen to usable desktop than it takes to go from boot to login because of all the crap that gets installed into auto-start; cable-modem goes crazy!

  • Short answer... (Score:3, Informative)

    by DaHat ( 247651 ) on Thursday December 08, 2005 @05:46PM (#14214089)
    Make sure you are behind a nat router or decent firewall and do not have any redirected ports (or DMZ) to the private ip address you machine should be using... and you will be pretty safe... not entirely, but your chances of getting infected are relatively low provided you do not stray too far from the path while updating.
  • The key word there would seem to be "unprotected". A $49 firewall set to block all incoming traffic (which you can configure off-line) followed by direct surfing to appropriate update links before doing anything else (and installation of Firefox for most browsing if you don't already have it) should do the trick.

    sPh

  • Don't do it (Score:5, Informative)

    by yamla ( 136560 ) <chris@@@hypocrite...org> on Thursday December 08, 2005 @05:47PM (#14214108)
    Don't do it. For the love of bob, don't do it. Make sure your computer is behind a firewall and only then should you connect. The first thing you should do is get all the latest security updates for Windows. NOTHING ELSE. NO WEB BROWSING at this point.

    Once that install/reboot cycle is complete, grab the latest updates for your antivirus and antispyware system. For extra security, make sure you perform a complete scan for viruses and spyware after all the updates are complete.

    Once that install/reboot cycle is complete, update the rest of your applications.

    Under no circumstances should you attempt this without being behind a secure firewall. Even if you are, you still have to be very very careful (hence, no web browsing until your computer is up to date on Windows and antivirus updates).

  • Hardware firewall (Score:3, Insightful)

    by Kaa ( 21510 ) on Thursday December 08, 2005 @05:47PM (#14214112) Homepage
    Spend $50 to buy a hardware firewall and the life expectancy of your laptop will skyrocket :-)

    • Spend $50 to buy a hardware firewall and the life expectancy of your laptop will skyrocket

      Spend $0, install a GNU/Linux or xBSD distribution, your laptop will be immortal, and you will never have to devote another brain cell to this silly discussion. You'll be promoting the freedom of ideas as well.

  • Maybe overstating things (Score:5, Informative)

    by tkrotchko ( 124118 ) * on Thursday December 08, 2005 @05:48PM (#14214119) Homepage
    I think the doom and gloom may be overstating the dangers here.

    My wife hadn't touched her laptop computer in 6 months. She fired it up, it was updated in 5 minutes and she was fine.

    Two things helped:

    a hardware firewall
    It already had XP SP2

    If that's your situation, just fire it up and go.
  • ...if your update comes out before the next version of the Slashcode.

  • Survival Time History (Score:3, Informative)

    by slb ( 72208 ) * on Thursday December 08, 2005 @05:49PM (#14214127) Homepage
    Obligatory reference to Average PC survival time [sans.org]

  • Options (Score:3, Interesting)

    by phalanx ( 94532 ) on Thursday December 08, 2005 @05:50PM (#14214147)
    1) Get all the updates from a friend and burn them to a CD. Install updates before connecting to the internet.
    2) Connect to the internet behind a hardware firewall/NAT device. Then update everything.
    I would recommend doing both.

    • Re:Options (Score:3, Interesting)

      by waferhead ( 557795 )
      Or contact your local Geeks/LUG and borrow a Knoppix CD to DL updates with.

      A firewall (or at least a router) is a good thing tho, and recommended.

  • Lifetimes... (Score:2, Insightful)

    by rewt66 ( 738525 )
    Not updated in nine months? That's the same as never updated. You have to treat it as if the machine has never been online before.

    The machine will have a lot shorter lifetime than an American soldier in Iraq...

    We look forward to having you back, by the way! While there are those here on /. who opposed the war, politically, I think we all wished you (and all the other soldiers there) nothing but the best. Our thanks for a difficult job.

    • Not updated in nine months? That's the same as never updated.

      Windows XP SP2 came out in August 2004, IIRC. Not to say that that's perfect - but it does fix some problems, right?

      For updates since then, you might check the Microsoft Security Bulletin Search [microsoft.com]; I got that from a smithii page on slipstreaming [smithii.com], which also includes a file to download those files, up through November, anyway. That requires Cygwin, although you could just pull the URLs out of that & fetch them all. Either way, you could down

    • Re:Lifetimes... (Score:3, Insightful)

      by meringuoid ( 568297 )
      We look forward to having you back, by the way!

      I fully agree. We look forward to having you all back.

    • We look forward to having you back, by the way! While there are those here on /. who opposed the war, politically, I think we all wished you (and all the other soldiers there) nothing but the best. Our thanks for a difficult job.

      One can oppose the war without opposing the individuals fighting in it. The soldiers are in Iraq because they were ordered to be. They are given orders, and do their best to carry them out. They should not be disrespected for that, indeed, they should be commended.

      However, if the le

    • Re:Lifetimes... (Score:3, Insightful)

      by thatguywhoiam ( 524290 )
      We look forward to having you back, by the way! While there are those here on /. who opposed the war, politically, I think we all wished you (and all the other soldiers there) nothing but the best.

      Those two things are not mutually exclusive; I oppose the war(s), and I wish all the American troops nothing but the best. Honestly.

    • Re:Lifetimes... (Score:3, Insightful)

      by mnmn ( 145599 )
      I on the other hand have trouble wishing that soldier the 'best'. I DO hope he gets back to his family in one piece though.

      See, I'm not American, so theres none of the 'my country right or wrong' thing. Its more like 'right, not wrong' for me.

      I admire the courage of the American soldiers going into a difficult place and for the job they do. I also happen to admire the courage of the Iraqi soldiers (the ones under Saddam) going to war against a far stronger enemy in the same thinking of 'my country right or

  • Hmmmm... depends.. been 4 years for me (Score:3, Funny)

    by Sleepy ( 4551 ) on Thursday December 08, 2005 @05:53PM (#14214171) Homepage
    What kernel version are you running? Even on an old OS, if you do not expose any unnecessary functions to the Internet (such as BIND DNS), you should be relatively safe.

    I have an old Redhat 8 system running on a AMD K63-500. It hasn't been rebooted in 4 years (yes, the kernel is horribly out of date... but there are few outside services, and no untrusted users). I'm afraid to upgrade such an old beast... I can't imagine Fedora Redhat and the QA folks spending much time on these ancient chipsets.

    You aren't running Windows, are you?

  • Someone answer the quest. (Score:3, Informative)

    by NotoriousGOD ( 936922 ) on Thursday December 08, 2005 @05:53PM (#14214173)
    Your life expectancy, depending on what sites you go to, is about 4 minutes before you have 60 pieces of spyware, which then turn into 200 in about a half-hour. At least, that's my test on my Dual Xeon, with Windows XP SP2.
    • My new Dual Xeon Server with W2K Server installed was just fine firewall-less while I was getting all of the Windows updates. I don't know what you people are doing to get all of this crap installed on your machines...
      • Interesting... I reinstalled W2K Pro on a customer's box today and accidentally left it connected via dialup for about 15 minutes. By the time I came back to my workbench there were about 20 popups and AVG had found several viruses.
  • Order the Windows Updates on CD now, so it'll be there when you return. Run the updates before connecting to the net. Then check for even newer updates from MS. Immediately update anti-virus and anti-malware products.

  • Survival (Score:3, Informative)

    by Shads ( 4567 ) <shadusNO@SPAMshadus.org> on Thursday December 08, 2005 @05:54PM (#14214180) Homepage Journal
    Behind a firewall: Until you do something stupid.
    On the net raw running windows: 30m.
    On the net raw running linux: depends on the daemons.

    • Re:Survival (Score:3, Informative)

      by yamla ( 136560 )
      30m? Record shortest time to compromise for an unpatched Windows computer at the University of Alberta used to be four seconds. In 2003. Now, it is under one second.

      It's probably not reasonable to expect an unpatched Windows machine would survive more than a very few minutes.
    • I've seen a system with sp0 (nothing at all) be fine long after SP2 was out, I was really surprised
      As long as you have a firewall it's usually alright, they were behind a router
  • Well a good NAT Firewall will help, as many people have stated. However, with the level of paranoia that I'm at (and I'm a security architect for a large corp... so my paranoia is pretty high), I would load all major updates onto a thumb drive or CD or some other media and update before connecting to the web.

    • Paranoid? (Score:5, Insightful)

      by ScrewMaster ( 602015 ) on Thursday December 08, 2005 @06:01PM (#14214247)
      Call it "anxiety" or "concern". It's not paranoia if they really are out to get you.
      • It's not paranoia if they really are out to get you.

        I object!
      • But wouldn't an ureasonable response to the real threat could still indicate paranoia?

        Or a belief that they are out to get YOU specifically when in a group. Like you may be on the battle field,and they certianly are out to get the people in your uniform, but that doesn'y mean they are looking for you specifically. Or the belief they are out to get you because you have been visited by aliens and have 'special powers'.
  • If your computer sits behind a NAT based consumer router at home (all consumer routers are nat based) you only have to worry about getting a virus through e-mail, for the most part. You are safe enough to install windows updates right away.

    If you connect your Cable/DSL modem directly into the computer then you are at risk without a firewall and the most recent service packs. All of the big exploits occure on machines without SP1 and there are a few for machines without SP2.

    If you download Service Pack 2 sta [microsoft.com]

  • Google for AutopatcherXP (Score:5, Informative)

    by sorphin ( 14046 ) on Thursday December 08, 2005 @05:56PM (#14214207)
    AutopatcherXP is released pretty much monthly an is a conglomeration of all security updates, patches, etc.. any time i've had to install/reinstall XP onto someone's machine, i've grabbed the latest autopatcher and slapped it on my thumbdrive, and took it with me. requires no getting online on the new system until you're all done. safer that way, and i've had no issues doing it that way.

  • You are just doing an update... (Score:5, Informative)

    by (H)elix1 ( 231155 ) <slashdot.helix@nOSPaM.gmail.com> on Thursday December 08, 2005 @06:01PM (#14214252) Homepage Journal
    You are trying to update an existing system, not build a fresh one. Using a cheap hardware firewall (like a linksys router) will keep most evil at bay while you do the update. Better to download the big security rollups and service packs from a current machine, burn to cd or thumbdrive, and install those on your box before you connect to the net.

    Check out http://www.msfn.org/board/index.php?showtopic=3188 6 [msfn.org] for a nice pointer to all the patches you should snag. Get the major ones and you should be OK to just do an update.
  • You know, we're never going to again have the heady days of huge Windows viruses that propogave over the network and infect every Windows system in sight. The days of massive viruses like those are over.
    What killed them? Windows Firewall. I think MS learned their lesson on that one.

  • Do what everyone else does. (Score:5, Funny)

    by agm ( 467017 ) * on Thursday December 08, 2005 @06:02PM (#14214267)
    Wouldn't you just do what everyone else does?

    su
    emerge sync
    emerge -pv world
    emerge world

    ??

  • as I get closer to coming back to the States and my broadband connection, I'm beginning to wonder what the life expectancy of my PC will be

    Now that's a geek.

  • How does this look? (Score:3, Interesting)

    by atari2600 ( 545988 ) on Thursday December 08, 2005 @06:12PM (#14214327)
    OS Name: Microsoft Windows XP Professional
    OS Version: 5.1.2600 Service Pack 2 Build 2600
    OS Manufacturer: Microsoft Corporation
    OS Configuration: Standalone Workstation
    OS Build Type: Multiprocessor Free
    Original Install Date: 9/27/2004, 12:49:15 PM
    System Up Time: 184 Days, 4 Hours, 3 Minutes, 16 Seconds


    The only time i had to bring it down was to replace hardware (i am behind a corporate firewall, the XP firewall is active) and i don't care about patches. No, i am not trolling - windows machines enjoy decent uptimes too. Let me know if anyone wants too look at a screenshot.
  • I use a program that locks the computer's data and system in place while it's turned on, so each reboot is like a new computer. I try to patch every couple of months anyway, but behind a router if you don't have infcted machines coming in, there's little reason to patch under most cases.

    The downside to Steadfast is that you can't use Antivirus updates with it unless you figure out which files need direct access to the disk, and spyware updates are hard to apply too. These days it's more important on publi

  • Have patches available on CD (Score:3, Informative)

    by DigitalCrackPipe ( 626884 ) on Thursday December 08, 2005 @06:20PM (#14214394)
    I have a CD handy with XP service pack 2, as well as antivirus, antispyware, firewall, FireFox, etc. That way, I can get a computer up to speed before even reconnecting it to the internet. After the basics are covered, it's much safer to connect and do the fine-tuning. The same would apply to other versions of windows.

    If you can't burn a CD from another computer, and you're pre-XP SP2, you might be better off operating behind a hardware firewall until the updates are completed.

    Also remember that if you have a minor bug before completing updates, you can usually clean the system after you're up to speed (antivirus, antispyware, etc). The main issue with the auto-infect feature of new systems is that most users won't take the time to clean the system or even investigate if it's infected.

  • It's all about the Service Packs. (Score:4, Insightful)

    by itomato ( 91092 ) on Thursday December 08, 2005 @06:20PM (#14214396)
    Quick checklist:

    * Does it have SP2? - If no, get it and forget it.

    * Is there constant hard disk activity? - If yes, reinstall.

    * Do you visit online gambling/porn sites? - If yes, reinstall periodically (evidence? what evidence?)

    * Does it take longer for you to be able to do something productive with the 'Start' button than it did to boot? - If yes, reinstall.

    After reinstalling, install AVG antivirus, Google up some Windows hardening/protection techniques (msconfig, services to disable, etc) **INSTALL NO SHAREWARE OR THIRD PARTY "WINDOWS FIXING" UTILITIES**, enable Windows firewall, and set Windows Update to perform weekly updates with no intervention.

    If things get weird after that, you have nobody but yourself to blame. After having resurrected Windows installations dating back to 95/3.11, I can say that the only sure-fire fix is a fdisk/reinstall.

    It's Windows - it *will* break in an inaccesssible or unrecoverable fashion.

    Make your time, and don't get taken in by supposedly friendly utilities, banners, offers, websites, emails, etc. This advice is applicable everywhere - life included.

  • I've been deployed in Iraq for the last 9 months...

    BTW: We hope you get to look forward to something as mundane as Windows viruses real soon now. In case anyone hasn't mentioned it yet, "Thank you for the job you're doing."

  • How many people really think that a Windows PC, when attached to a cable/DSL internet connection, is susceptible to viruses, infiltration, malware, spyware - JUST BY BEING CONNECTED?

    How many people do you think there are out there scanning IPs looking for unprotected Windows boxes to molest? And out of those, who actually attempts to sploit the sploit? How many of *those* are successful?

    It takes clicking, installing, running. It's not like bareback fucking a hooker in Bangkok.

    Sure, you may be open to som

    • Re:Paranoia? (Score:2, Interesting)

      by sedman ( 210394 )
      I'm guessing you have not put an unpatched windows box on the net lately. Last person I talked to who got infected with an unpatched PC only did the windows update and was using a modem (not sure why he thought the download would finish this decade, but that's another issue).

    • Re:Paranoia? (Score:5, Interesting)

      by djmurdoch ( 306849 ) on Thursday December 08, 2005 @06:57PM (#14214685)
      My wireless router logged connection attempts at a rate of around one every 10 seconds when I was on a DSL line. I'm on cable now, and get fewer attempts - just every couple of minutes.

      Not all of those attempts are trying to break in to Windows vulnerabilities, a lot were looking for other kinds of holes, or were looking for already-infected machines. But the attempt I see logged from one minute ago was attempting to get into the Windows RPC service, which an unpatched machine might have left open.

      So I don't really think it's paranoia, and I do like being the only machine behind my router.

    • How many people do you think there are out there scanning IPs looking for unprotected Windows boxes to molest? And out of those, who actually attempts to sploit the sploit? How many of *those* are successful?

      I take it you've never looked. Try looking some time, you'd be surprised. My Apache server is constantly bombarded with attempted IIS exploits, and that's only one port! Looking at the router log, I see an absurd amount of incoming probes to random ports. Even today, you'd be surprised how many Windo

  • About 16 minutes (Score:4, Informative)

    by Mordant ( 138460 ) on Thursday December 08, 2005 @07:03PM (#14214730)
    according to SANS [crn.com].

  • Buy a Broadband router (Score:3, Informative)

    by topham ( 32406 ) on Thursday December 08, 2005 @07:32PM (#14214930) Homepage
    Buy a broadband router.

    Since it naturally acts as a NAT gateway it will prevent 98% of exploits that can be initiated remotely.

    hook up the computer and go through the update process for windows, and your antivirus software. (I would do windows updates first as it is entirely possible the anti-virus updates may require some of the patches too. especially if they are a few months old.)

    Then after you've installed all your updates and you can safely leave the computer up and browse the Internet head on over to Red Hat, or some other Linux.... kidding... somewhat.

    Buy a mac. Easier, and they have very nice laptops.
  • If you haven't been on the internet in a long time it is something you should be aware of. I thought I was a sophisticated XP user. I have ZoneAlarm, never click on anything in emails, and only install software from reputable companies. But I recently found a keylogger on my system. I forget what it was called, but it captures AOL logins. Fortunately, long ago I stopped using Windows for any online-banking, ecommerce, or anything else that has a password. For those I use FreeBSD with a good ipfilter r
  • Oh my gosh, you should through it away right now and go buy a Mac or Linux box. Don't even try to fix it because once you fix it, it will break in an hour.
  • the firewall shouldn't need updating unless a bug is found and even when they do they are pretty rarely exploited anyway.

    the AV is just a second line of defense if your firewall crashes or you do something stupid or you download code from dubious sources its a non-issue if you are just connecting.
  • What's the lifecycle of [...] a state approaching extinction

    Iraq should last another couple of years, I'd guess.

  • god bless you.
    Just get back here alive, then update.
    yes there is always some fresh Improvised Explosive Data lurking on random pages and attachments every week but as careful as you seem to be about stuff like that, you'd notice if you got infected....you DO have your firewall set to squawk if unexpected outbound traffic crops up, right?
  • You apparently know at least more then the average computer user, so you shouldn't worry about it. I never really worry about it. I've plugged unpatched XP boxes to the Internet and done updates and such, downloaded SP2, etc. I've never really had any trouble. That's not to say you won't get something, but all the "Windows machines hacked in 6 minutes" seems overrated to me. I just don't see it happening under normal "non-major outbreak" days.

    Obviously, I wouldn't LEAVE it unpatched and unprotected, b

Slashdot Top Deals

"What man has done, man can aspire to do." -- Jerry Pournelle, about space flight

Close