Security Corner

Jul 19 2008   12:58AM GMT

Unpatched PC “0wn3d” in Four Minutes or 16 Hours; Which is it?

Ken Harthun Ken Harthun Profile: Ken Harthun

I just love stories like this one. On the one hand, Internet Storm Center researchers say an unpatched PC connected to the Internet will be compromised in less than four minutes. On the other hand, a researcher and co-founder of the German Honeypot Project (GHP), Thorsten Holz, claims the survival time is much higher than 4 minutes and in fact is nearer 16 hours. “Compared to the survival time from the Internet Storm Center [ISC] which is currently below five minutes, we measure a higher survival time,” he said in a post to the project’s blog. The blog has some interesting graphs, one of which shows that survival time is just under 1000 minutes, or about 16 hours.

So, which is it? Do we believe ISC or GHP? I can tell you from experience with my own firewall logs that my IP address is probed for common vulnerabilities about every two minutes, sometimes as often as once per minute. Based on this, I’d be inclined to believe ISC’s estimate. The bottom line is it doesn’t really matter who’s right–we all agree that it’s a bad idea to connect an unpatched PC to the Internet. From the ISC diary:

While the survival time measured varies quite a bit across methods used, pretty much all agree that placing an unpatched Windows computer directly onto the Internet in the hope that it downloads the patches faster than it gets exploited are odds that you wouldn’t bet on in Vegas.  Using a NAT router and a correctly configured personal firewall is the way to go – both these measures help a lot to improve the odds in favor or your PC.

Be careful out there.

Ken is a Systems Engineer at Connective Computing, Inc. specializing in network and desktop security for small and medium businesses. Ken helps others through his Ask the Geek blog, is a regular contributor to Dave’s Computer Tips newsletter, and is currently working on his first consumer-oriented book on computer security.

 Comment on this Post

There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

Share this item with your network: