Unprotected PCs fall to hacker bots in just four minutes

The lifespan of a poorly protected PC connected to the internet is a mere four minutes, research released this week claims. After that, it is owned by a hacker.

In the two week test, marketing communications firm AvanteGarde deployed six systems using default security settings. It then analysed the machines' performance by tallying the attacks, counting the number of compromises, and timing how long it took an attack to successfully hijack a computer once it was connected to the Internet.

The six machines were as follows:

Microsoft Windows Small Business Server 2003,
Microsoft Windows XP Service Pack 1 (SP1),
Microsoft Windows XP SP1 with the free ZoneAlarm personal firewall,
Microsoft Windows XP SP2,
Macintosh OS X 10.3.5, and
Linspire's distribution of Linux.

Not surprisingly, Windows XP SP1 without the third party firewall had the poorest showing and was hacked in just 30 seconds. Although Windows XP SP1 includes a firewall, it is not turned on by default. That security hole was one of those plugged, and heavily touted, by Microsoft in SP2.

Windows XP SP1 with the for-free ZoneAlarm firewall, however, as well as Windows XP SP2, fared much better. Although both configurations were probed by attackers, neither was compromised during the two weeks.

The successful attacks took advantage of weak passwords on the target machines, as well as a pair of long-patched vulnerabilities in Microsoft Windows.

One, the DCOM vulnerability, harks back to July, 2003, and was behind the vicious MSBlast worm of that summer. The second, dubbed the LSASS vulnerability, was first disclosed in April, 2004, and led to the Sasser worm.

The most secure system during the experiment was the one running Linspire's Linux. As distributed, Linspire left only one open port. While it reacted to ping requests by automated attackers sniffing for victims, it experienced the fewest attacks of any of the six machines and was never compromised, since there were no exposed ports (and thus services) to exploit.

The Macintosh system, on the other hand, was assaulted as often as the Windows XP SP1 system, but never was grabbed by a hacker, thanks to the tunnel vision that attackers have for Windows.

"The automated bot/worm attackers were exclusively using Windows-based attacks," said Colombano, so the Mac and Linux systems are safe but only for the moment. The Mac would have been very vulnerable had code been written to compromise its system.

What should you do?

Update Windows regularly with Microsoft's patches,
Use a personal firewall --third-party firewalls still have their place, since Microsoft's is not suited to guard against outbound attacks
Keep secure passwords, and
Use some type of anti-virus and anti-spyware software.

Of the list, the firewall is the most important. The study concluded, for example, that Linux- and Windows-based machines using an application firewall were the best at preventing attacks.