As a little experiment of my own a few weeks ago, I put a default install of NT 4.0 on a machine, with just SP2, and left it directly connected to the internet overnight. I even made the Admin password "password". You know what? Not a single infection or access. No changes at all.

What's the catch? I did this on my Digital Personal Workstation 500a. A DEC Alpha box. ;) It's too bad that Windows on Alpha is no more.

Having daily monitored SNORT logs for the last year, I firmly believe that any machine that is directly connected to the 'net will be infected within minutes. A cheap Linksys/Netgear NAT router would be a suggestion (to "hide behind") for cablemodem users. That would prevent a lot of scanning activity from hitting the PC - well worth the minimal $$ (plus they can get wireless access for yon laptop). But for poor dialup folks... the firewall is the only option.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/262/28080#28080