How secure is your computer?

How secure is your computer?

here is a report on the Internet 'horrors' Windows, Mac and Linux users face simply being connected to the Internet with only an out-of-box configuration. Over the course of a single week the machines were scanned 46,255 times. The test didn't look into additional security threats caused by surfing the web or reading e-mail, just the connection itself.

A Windows computer without the latest security patches is in big trouble.

That's the conclusion from a "honey pot" experiment conducted by StillSecure, a Louisville network security firm.

StillSecure attached six computers - loaded with different versions of the Windows, Linux and Apple's Macintosh operating systems - earlier this month to the Internet without anti-virus software.

The results show the Internet is a very rough place.

Over the course of a week, the machines were scanned a total of 46,255 times by computers around the world that crawl the Web looking for vulnerabilities in operating systems.

Once the vulnerabilities were identified, the remote computers launched 4,892 direct attacks with a staggering variety of worms, Trojan Horses, viruses, spyware and other forms of malware.



The test examined only what happens when computers are turned on and connected to the Internet. The test didn't evaluate additional dangers that computer users face when they use e-mail, surf the Web, click on Internet links or use file-sharing programs.

The good news is that none of the up-to-date, patched operating systems succumbed to a single attack.

The Windows Service Pack 2, or SP 2, system is the most up-to-date Windows operating system. It received 16 direct attacks.

The Macintosh system received three attacks. Two of the Linux systems received eight attacks each, though Red Hat's version of Linux received no attacks at all.

But in the end, none of the attacks were successful.

The Linux and Macintosh sytems were installed out of the box without any additional security patches. Windows SP 2 automatically downloads the latest security patches from the Microsoft website.

Windows Service Pack 1, or SP 1, however, was another story. It's an older version of Windows that was sold in computer stores until a few months ago.

SP 1 was attacked 4,857 times. It was infested within 18 minutes by the Blaster and Sasser worms. Within an hour it became a "bot," or a machine controlled by a remote computer, and began attacking other Windows computers.

Microsoft responded that the tests prove that any operating system is vulnerable when not patched.

"The results don't surprise me at all," said David Brandt, principal technology architect at Microsoft in Denver.

Microsoft stopped shipping SP 1 in August and replaced it with the more secure Windows SP 2. Most computers with SP 1 had been sold from stores by Christmas, said Microsoft spokesman Sean Sundwall.

SP 2 comes with a firewall and automatic security updates, said Sundwall. These features had to be manually turned on in SP 1, which meant that some users missed out on computer patches.

Many computers around the world are still running Windows SP 1, though exact numbers are hard to come by. Gartner research director Michael Silver estimates that by the end of 2005, half of the world's desktops used in businesses will still be using SP 1.

"But most companies are pretty good about keeping their PCs patched, and most have corporate firewalls," said Silver.

Large companies are switching to SP 2 slowly because they have to make adjustments to thousands of different software programs first.

The honey pot test is a good indication that many small-business and home computers are still using older versions of Windows, according to StillSecure chief technology officer Mitchell Ashley.

"Why are we getting hit by Blaster?" asked Ashley. "Because there are infected machines out there. Why are they infected? Because they don't have the updated patch."

Microsoft is concerned about security issues surrounding Windows and Internet Explorer, and the resultant surge of Linux, which can be downloaded for free from the Internet. Most companies, however, chose to pay a Linux vendor in order to receive security patches.

Experts also consider Linux less prone to viruses.96 percent of all desktops and laptops worldwide used Windows at the end of 2004. Macintosh has 2.5 percent of the market, while Linux is at 1.3 percent

Bank Loses Tapes of Records of 1.2 Million With Visa Cards

There are 2 kinds of people:
those who have lost their data,and those who WILL lose it!

Bank Loses Tapes of Records of 1.2 Million With Visa Cards


Bank of America said yesterday that it had lost computer backup tapes containing personal information about 1.2 million federal employees, including some senators, with Visa charge cards issued by the bank.

A spokeswoman for Bank of America, Alexandra Trower, said the bank did not believe that the information had been stolen or had fallen into the hands of people using it to commit fraud. There has been no suspicious activity on any of the affected accounts, she said.

The cards were issued to government employees who need to travel or make purchases on government business. About 900,000 of the cardholders are employees of the Defense Department. Senator Patrick J. Leahy, Democrat of Vermont, was one of the cardholders.

The bank sent letters yesterday to those whose data was on the lost tapes, providing a telephone number for questions or problems. The bank said it did not think it needed to change those account numbers.

Ms. Trower declined to provide many details about the incident, citing security concerns. She said that the tapes were part of a shipment in late December from a bank facility to another location meant to house backups. A few days after the shipment arrived, the bank discovered that a small number of the tapes were missing. The bank then notified the Secret Service, which has legal responsibility for credit card theft.

The investigation so far has turned up no evidence of wrongdoing and is consistent with the view that the tapes were simply lost in transit.

The incident comes at a time of increasing attention to the risks to people when information about them held in corporate databases falls into the wrong hands.

Choicepoint, a company that sells personal data to landlords and employers, said last month that it had inadvertently sold personal data on 145,000 people to thieves last year. The information was used to steal the identities of at least 750 people.