Comment by halfcat | Hacker News Reader

Comment by halfcat | Hacker News Reader

Parent Full thread

There are unpatched remote code execution vulnerabilities on basically every version of Windows that is out of support.

If you plugged it into the internet with a public IP, someone would likely gain full remote control of the machine in a matter of seconds to hours.

You might think you’re safe if you only connect to your home internet, since that’s not wide open for anyone to scan. But then your kid/nephew/friend uses your wifi and they have a spyware-filled Doodle Jump game clone on their phone that asks for permission to connect to the local network, and your kid/nephew/friend wants to play the game so of course they click yes, and now that’s scanning your home network, and now your Windows 7 computer is part of a botnet.

The same thing would happen on the coffee shop’s WiFi, the hotel’s wifi, and so on. Unless you never connect to a network of any kind ever, it’s a bad idea.

We have a project XP machine that has been plugged into the internet for nearly a year now with no third party firewall etc. Nothing has happened despite all the proclamations it'd be an infested box within seconds of touching the internet.

The reality seems to be that problems stem from the user and what software they use to access the internet more than just being connected. This jives with your comments as you keep mentioning user actions that result in infections.

> We have a project XP machine that has been plugged into the internet for nearly a year now with no third party firewall etc. Nothing has happened despite all the proclamations it'd be an infested box within seconds of touching the internet.

Is it behind a router? Most routers have stateful firewalls doing a lot of work to keep random connections from passing to the NAT'd devices behind them. All the "infected in under 5 minutes" stories I've seen were machines connected directly to the internet.

Also, are you monitoring inbound/outbound traffic for that machine? It seems like you should at least be seeing attempts to compromise your machine (even if they're not working). Is it using IPv4? If you've got a setup that stops port scans, vulnerability scanners, and internet worms you should share!

maybe this gets into the why more, like is the ISP doing a lot of heavy lifting behind the scenes.

Reply on news.ycombinator.com