3

I see this guy shared his thought: How to be safe even without most updated Windows updates

So he claims that as long as you do not accept any incoming connections and just use sandbox of Chrome, then it is safe to not update Windows. What do you think?

Improve this question
  • Why would you use Chrome if not for browsing the Internet? Unless you want to use its plugins to open certain types of files, but it would be a bit weird to only use it in this way, especially if you already have stand-alone software capable of opening those files. – A. Darwin May 23 '16 at 18:15
  • 2
    "If you are a big corporation a hacker may target you, because he knows your IP addresses and he will have time to attempt attacks...If you are a home user, with a dynamic IP, that you don't accept incoming connections, it's not easy for someone to exploit a Windows vulnerability" --- And he is also ignoring the human factor, the weakest link on the chain. He is justifying not having updates and not bothering because your ip at home is not fixed on the internet, and that is just plain bulshit. The same way, by assuming that the user makes no mistakes – user28177 May 23 '16 at 18:26
  • That person has long new replies in the link above so you would waant to read those. – autopenta May 24 '16 at 1:07
  • Umm, no, most problems start with you connecting elsewhere with a vulnerable machine. Some goofy stuff out there on the net... and this is one of them. Vulnerability Engines depend on this, you contact them willingly by loading a page or other resource that contains an exploit initiator. – Fiasco Labs May 24 '16 at 5:04
6

No, that's simply wrong.

Just like with a jail. They're not only built in a manner to keep anyone from escaping, but as well to prevent anyone from breaking in. You always have to think through both ways.

Just an example: windows had a vulnerability that allowed arbitrary code-execution injected in JPGs (I think the format was JPG, but I'm not sure. Doesn't matter here anyways). Now I've got a nice little drive-by download that directly infects your PC. Since you didn't apply any Windows-Updates you're still vulnerable and the PC is infected. Now you've blocked inbound connections. Luckily, I'm already inside your PC, so all I need to do is create a outbound connection. No need to break in to get stuff from your PC, if I can get myself inside in a normal way and then break out. I know this example includes quite a lot of uncertainties, but it should do to demonstrate the principle. Real-life attacks will quite likely be more complex, but should function the same way. In general home-PCs are usually bound to a dynamic IP. Most likely noone will attack this kind of PC from "the outside", but rather via malware, so just disallowing inbound connections might make your server more secure (and unuseable); for your home PC this doesn't apply.

The main-mistake already lies within this line:

Don't worry, i know what i am doing. To be infected, you need to allow code to execute locally. If this code isn't allowed to execute, you can't be infected.

It's pretty much correct, that you have to allow execution of code locally to be infected. So far so well, but local code-execution happens every day. Just consider this site. It runs quite a bit of javascript code - inside your browser. This should - in theory - be safe; practically there are plenty of vulnerabilities that can be executed to produce rather ugly behavior. "I know what I'm doing" is already a misconception, since that's far beyond anyone's possibilities. And in general: updating windows is free, doesn't take that much time if scheduled properly. So why would you decline free security-improvement?

Last but not least:

stuff everything into a sandbox and you're fine

In theory that's right. But I wouldn't say in theory, if there wasn't a twist. Sandboxes, just like any other piece of software, have bugs, weaknesses, etc.. For example JavaScript runs in a sandbox, just like the rest of the browser. Still one can do massive damage using JavaScript as a starting-point for malicious code execution. Why? Because the sandbox isn't perfect and has holes in it, that allow execution of arbitrary code, if used in the right way. Next point: going back to the JPG-example from above: there are ways to get out of the sandbox without even embedding any code to do so.

TL;DR

This ignores several factors:
The weakest link is always the human factor. "I know what I'm doing" is just wrong. That'll never happend to the point where you know enough make sure your PC is absolutely secure. Home-PCs usually aren't attacked from the outside, but rather by distributing malware that infects the PC, so blocking inbound connections is just a waste of time. Sandboxes, just like other security software, have weaknesses and bugs. They are a security-improvement, but nothing to solely rely on. In addition: why would you decline any free security? Windows updates are usually there for a reason.

Improve this answer
  • I've heard so many mixed comments on updating windows. Some say yes, some say no, some say only criticals, some say all lol. I've noticed in the past, when updating windows a lot it would slow down the machine quite heavily, not sure if that is just because of the hardware used... o rnot.[ – XaolingBao May 23 '16 at 20:05
  • @Lasagna Linux-user here, so I can't say much about the practical points of Windows updates. But at least the critical one should be updated, since they're security-relevant. You don't want some nasty exploit to destroy anything. – Paul May 23 '16 at 23:10
0

This is partly true.

First of all, if you wish to go this way you need to understand that it's not enough to deny all incoming connections at certain times, you should deny them always. This is so because any time you are connected to the Internet (even if only for few seconds or minutes), you are potentially exposed to malware of all kinds. In fact, if you chose to accept connections only at certain times, you could be exposed to a clever variation of ransomware.

Basically, an attacker downloads a ransomware on your computer. After a while, you deny all incoming connections, but this is pointless. The ransomware is already there, encrypts your data, and asks you a ransom. The point is, to pay the ransom you should use the very same computer, thus opening a connection. In this way, if you pay, you could get infected with other malware, whereas if you don't, you are left with a useless computer (the ransomware could even try to damage your hard drive, or even physically damage your computer, or you don't pay).

There is a reason why "air-gapped" computer are always disconnected, and you should do so.

OK, so you chose to keep your computer always disconnected. This seems great, except it has a few issues.

For example, your computer could become infected with a malware delivered by a flash drive. You might say "Even with the computer connected, I would be exposed to this kind of attack, what's the big deal?". Unfortunately, things are a bit more complicated, for at least two reasons:

  • if your computer never connects to the Internet, you may be tempted to download stuff on another computer and then copy them on your offline computer via a flash drive (or, even worse, ask a friend to copy them on a USB drive!). Note that you could live with a computer connected to the Internet bit without using flash drives, so you would be exposed to this kind of attack even more when using an offline computer;

  • things get even worse because you cannot install updates to your OS and/or an anti-virus solution. In any case, you wouldn't be able to update the AV signatures.

A better solution would be to not plug in flash drives, perhaps only using non-rewritable media (of course, checking the files written in the CD/DVD with an anti-virus!). Eventually, you get closer to certain high-security computer setups, which clearly trade off usability for security.

I'm neglecting more esoteric attacks (e.g. jumping air gaps, perhaps through a smartphone), because they are almost impossible to mitigate for an average person, and including social engineering attacks in the "flash drive attacks" category. Physical attacks are always impossibile to avoid, whether you are connected or not.

Bottom line: it is safer, if you don't mess with flash drives and don't let anybody else physically access your computer.

Improve this answer
  • there's a difference between "blocking all inbound connections" and "airgapped". E.g. if you wish to open a site in your browser, that's an outbound connection and thus is possible in the former, but not on an airgapped machine. There's nothing that'd prevent you from infecting your machine with all inbound connections being blocked. – Paul May 23 '16 at 19:37
  • @Paul I know that there's a difference, I quoted "air-gapped" to make an analogy. Also, I might be absolutely wrong (I'm not an expert) but how could you complete a connection to a website without accepting inbound connections? Yes, you could send for example a GET request, but you wouldn't be able to receive the response. Am I right? – A. Darwin May 23 '16 at 19:52
  • "Outbound connection" only means the connection is initiated from your device. In other words: you're requesting a connection to the server. Inbound would be if someone requests to build a connection to your device. But all (initial) traffic happens on that connection. E.g. most required files will be loaded via this connection, and any further requests will as well be sent from your PC. There may be a few exceptions, but usually any connection is built from your device to the server, if you try to load a website – Paul May 23 '16 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.