Howard2k

This movie shows a guy plugging his XP machine into the Internet and the 60 seconds or so it takes for it to become infected and start propagating.

I suspect that it's a plain XP build, no security updates etc. In fact I'd put money on the fact that it's not XP SP2 etc.

But for sheer entertainment value (as opposed to technical accuracy) it is good.

http://www.cbc.ca/news/background/co...edcomputer.mov

__________________
Always read stuff that will make you look good if you die in the middle of it.

schrags11

How do we know its not a bunch of mac guys that set the video up...

Howard2k

It could well be, but it's from the CBC (Canadian Broadcasting Corporation), so I doubt it somehow :)

However - think of the un-pactched XP that came on the OEM CD installed on a machine and plugged into the Internet without a firewall/router and it's very realistic. I don't think it's a simulation. I don't think it's representative of an up to date XP machine either though.

__________________
Always read stuff that will make you look good if you die in the middle of it.

psionandy

Well the last time I set up a 'Vanila' out of the box XP system connected to broadband (Just to see what would happen) it lasted about 15 mins. So I guess this is progress.......

__________________
You'd have thought that someone would have put a sig here
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

JMJSelect

it could be from apple people the video is in quicktime

Howard2k

Originally Posted by JMJSelect

it could be from apple people the video is in quicktime

My non-apple digital camera creates mov files too. It's been around since before wmv. Let's not be too paranoid.

wooch

No, that can happen, and alot more than folks think. One of our policies is that a machine be completely patched before it is connected to the network.

Let's say there's a critical update that patches a machine from getting infected by a particular worm. The worm is on the network. Once that sucker's plugged in, it's a matter of seconds. Actually, I've seen a machine become infected almost immediately. Brought it up, and the Messenger Service brougt up an error informing the user that such and such was detected by the AV app and removed.

Patch em as best you can before connecting them to the internet. If you have a Broadband router and you know the other machines on your network are clean, you don't run as much a risk as with a machine that's directly connected ditrctly to the internet, an unsecured network, or a large corporate network where chances are that worms are on the loose.

Frenchy

I have seen the same at work with W2K so patching, firewall, AV is the first install prior to any personal software for the user. Saves you a lot of time on the long run.

__________________
.

Frenchy

wooch

Couple of other notes after viewing the video.

1st, this definitely looks like the Sasser Worm that hit a while back. And yes, if your machine doesn't have the critical update, it will be hit immediately.

When it originally hit, you were protected if you weren't patched, but behind a hardware firewall. It goes in through a particular port, and will exploit the machine if it is not patched. I installed a Broadband router for my parents a few weeks before, and I believe it saved them from getting hit because they hadn't dont critical updates in months.

Second, thanks for this Post Howard!! That Active Ports App is awesome, and of course, freeware :approve:

Grentz

I dont really get it, I have put Regular XP Machines (no updates, not even SP1) on straight internet (no protection at all) and have not had a problem nearly that fast...

UPDATE:

I think I might try doing this sometime, just put a brand new machine on the net and see what it does...

Also, Active Ports is a pretty cool program, take a look at it here: http://www.download.com/3000-2085-10...age&tag=button

forkyfork

Wow, that's scary.. but so very true.

When I was on the dorm connection last year my roommate got a worm within a minute of plugging into the internet - before she could install Norton!

Grentz

Best Defense is smoothwall :)

If you have another computer laying around that is

www.smoothwall.org

it is unbelivable to look in the logs on what it blocks....

pottsbgstv

How fast you would be infected depends on your internet. If you are using an ip that is rarely known, then you may not get infected very quickly. If you have an ip that is very common to some viruses that generate ip's then you would get slammed.