The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

One week, one unpatched XP box
Summary

I freed up a Linux box this week and I had an interesting idea.
In these days of the wild internet, I wondered what would happen to an unpatched Windows XP computer.

Well, I'm going to get a good chance to find out as this weekend is the start of The Experiment? - place an unpatched, unprotected Windows XP Pro computer on the internet and watch the results.
I happen to have several spare XP Pro disks, and the one I'm going to be using is the very first edition - no service packs here folks.

Machine Spec

The computer used is nothing particularly special, but is ideal because it's exactly the sort that your mum or dad will be using to check their mail and sell stuff on eBay.

• AMD Athlon 1800+
• 512MB PC133 SDRAM
• 80GB IDE hard disk
• NVidia GeForce 4 MX440
• Soundblaster Live 5.1 soundcard
• Standard 10/100 ethernet card

As previously stated, it will be Windows XP Pro running a default installation.
The only exceptions are detailed below.

Software & Firewall Configuration

There are several important changes that will be made to the OS:

• Enabling of "Remote Desktop" - this will let me check the computer from work and lets me log in from any computer at home.
• TCP/IP - static IP addressing will be used and the computer will be placed in a DMZ to protect the part of the network I want to keep secure.
• The reserved ports 1-1024 will be opened on the firewall and configured to port-forward to the new machine.

Schedule

So when will this happen, and how?

I'll format the disk (currently running Linux) then install Windows XP on Saturday at around 12PM (UK time).
The configuration mentioned in the previous chapter will then take place, then the ethernet cable will be connected to the switch.

The test will run for one week, unless something really interesting happens that forces me to cut the test short or extend it.

Expectations & Possibilities

I'm expecting the box to be "0wned" within an hour, possibly less.
Depending on what happens, I might do some random browsing on a default Internet Explorer - sites that your kids might visit for example, all those flashing banner ads giving away free smiley icons etc.

I'm also expecting to be hit hard by the Blaster worm, this can cause the machine to reboot constantly which will make the test a bit difficult.
If this turns out to be the case, I'll have to stop the RPC service although it'll be interesting to see how long it takes to get infected.

SANS has a top 10 Windows threats list available.

Comments

Please post your comments in the below forum thread

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

What's the IP then ;)

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

If you aren't actually doing anything on the PC, it may take a while for it to get infected with something. It's visiting sites, getting dodgy emails and the like that is the real killer.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

What's the reason for doing this ? - it probably isn't going to last long, but not many such machines really exist.

Even the pc I bought in late 2002 had SP1 on it.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

If you'd like to spam the article link to hell on websites in the coming days, feel free. ;)
I'm going to submit the link to several computer news websites myself, security problems need to be brought to attention.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

What he said...

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Thanks for mentioning that, I recently read somewhere that around 40% of XP machines do not have SP1 - can't find the link though.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Good luck. The other day I put a clean installed XP SP1 computer on the internet, and got a net send alert within about 10 seconds , and within about 5 mins, it had already been exploited. This was exploited before I had chance to download MS antipyware (which isn't as good as it first seems now, I think). The spyware I, (or MS antispyware and spybot S&D), couldn't get rid of it, so I had to delete, reinstall, and then reinstall SP2, antispyware before connecting it to the net again.

If it is SP2 you might last a bit longer, but SP1 will probably be exploited in minutes. (On BT openworld's network anyway)

Its a bit annoying as I wouldn't mind having SP2 on my desktop, but the b****rd won't install, and I can't seem to get round it.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

***** (probably) ;)

EDIT: Removed IP because after a traceroute I don't think it is.
EDIT #2: Ping phpfuture.net to see :)

Perhaps you should put up a Linux box as well for comparison Rich?

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

I'm with Paul M on this one... why exactly are you doing it? It's been done before. I remember seeing a report at sans about an out-of-the-box XP machine being compromised within 18 minutes. If I remember correctly, this article itself is a couple of years old now. I'll try and find it again if you're interested.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Sshh, we all want the chance to pwn his machine, think I'll turn it into an ET server for the day :D

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

I come up against this yesterday,The machine was bought from a local store resently and this come with xp with no service packs,the guy had wondered why his camera said usb to slow

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

That's just shoddy in my opinion. It's not hard to install SP2 on a brand-new computer, if store uses a single image they could slipstream SP2 so they wouldn't even need to do anything after the install.

Windows XP Gold (i.e. no service packs) will now not get any further security updates.

Back on topic, I read it's only supposed to be about 20 minutes now before you get 'infected'. I wonder though if the ntl: port blocking will have an effect? ("...Blaster worms spread over port 135, which has already been blocked [by ntl:]")

Ben

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Well I wasn't worried about it being done before. I'm just curious about the reason for doing on a box with no SP at all, as SP1 has been around for so long now. I would be interested in that link about 40% of XP machines having no SP, as that's quite a surprise to me. :)

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

I doubt it will effect a machine connected via nildram ;)

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Because I have a spare box, a spare Saturday and I'm interested in learning more about security. :)

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

D'oh... read the profile first Ben :knock:

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

If the machine survives a week, then I'll install SP1 then give that another week.
__________________

Definitely isn't phpfuture.net:
Good idea but I don't have any other spare machines ATM - the XP "0wned" machine is going to have XP SP2 installed soon because I need another Windows box.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Ahh, fair enuff then. I thought you were doing it to prove a point, and to publicise it to denounce MS, etc... in which case it'd likely be ignored by many. As a personal learning experience, I'm sure you'll find it useful. I find actually doing stuff to be the best way to get my head around something.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

If it survives a week without getting infected by blaster it'll be a miracle. I still see it hitting my external server firewalls regularly. :disturbd:

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

That's bizarre, I would swear my traceroute last night terminated in a machine connected via nildram. Oh well, back to the drawing board :)

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Hmm... I'm having a problem.
Windows blue screened during the installation and now it keeps doing it. :erm:

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Have you taken precuations to make sure that, when compromised, it does not get used as a spam drone.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Nope, I want this to be as realistic as possible.

BTW - I'm formatting the IDE hard disk in my main PC now because it seems that Windows was BSOD'ing when getting to that stage in the setup.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

I silly connected a pc to an adsl connection a few months ago, after I had installed xp home sp1... within 2 minutes the machine was down and I was reformatting it... It can be quick trust me..

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

There seems to be a big problem with this machine - it won't install without BSOD'ing.
I got nearly to the end of the installation but then it blue screened.
I'll have to delay this for a week or so until I can get hold of another box.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Any update?

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Easy - You want to zero-write the hard disk.

Dump it in another windows machine, and google "(hard drive manufacture) low level format". Run this, and you should be laughing!

What happens when someone turns it into an annonymous proxy, and you end up as the hub of some internet crime spree? I had that - claranet not happy!:rolleyes:

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Aah cheers, tried to reinstall today but kept blue-screening.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Is that before 0-Writing the disk, or after?

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Before, I'll try to do that today if I have time.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

update?

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Any news Richard?

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Not had the time, I'll get round to it at some point.

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

he got bored by the sound of it :D

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Here you go, now pull your finger out :D

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

It's just that hard disk hassles etc have got in the way of this.
I was beginning to wonder what the whole point of it was but I will do it sometime...

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

Hop to it ! ;)
I'm expecting a thesis, 50,000 word report on this you know Richard.
;)

Re: The Experimentââ₠¬Ãƒâ€¦Ã‚¾Ãƒâ€šÃ‚¢
 

update ????????????????