Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I see this guy shared his thought: How to be safe even without most updated Windows updates
So he claims that as long as you do not accept any incoming connections and just use sandbox of Chrome, then it is safe to not update Windows. What do you think?
No, that's simply wrong.
Just like with a jail. They're not only built in a manner to keep anyone from escaping, but as well to prevent anyone from breaking in. You always have to think through both ways.
Just an example: windows had a vulnerability that allowed arbitrary code-execution injected in JPGs (I think the format was JPG, but I'm not sure. Doesn't matter here anyways). Now I've got a nice little drive-by download that directly infects your PC. Since you didn't apply any Windows-Updates you're still vulnerable and the PC is infected. Now you've blocked inbound connections. Luckily, I'm already inside your PC, so all I need to do is create a outbound connection. No need to break in to get stuff from your PC, if I can get myself inside in a normal way and then break out. I know this example includes quite a lot of uncertainties, but it should do to demonstrate the principle. Real-life attacks will quite likely be more complex, but should function the same way. In general home-PCs are usually bound to a dynamic IP. Most likely noone will attack this kind of PC from "the outside", but rather via malware, so just disallowing inbound connections might make your server more secure (and unuseable); for your home PC this doesn't apply.
The main-mistake already lies within this line:
Don't worry, i know what i am doing. To be infected, you need to allow code to execute locally. If this code isn't allowed to execute, you can't be infected.
It's pretty much correct, that you have to allow execution of code locally to be infected. So far so well, but local code-execution happens every day. Just consider this site. It runs quite a bit of javascript code - inside your browser. This should - in theory - be safe; practically there are plenty of vulnerabilities that can be executed to produce rather ugly behavior. "I know what I'm doing" is already a misconception, since that's far beyond anyone's possibilities. And in general: updating windows is free, doesn't take that much time if scheduled properly. So why would you decline free security-improvement?
Last but not least:
stuff everything into a sandbox and you're fine
In theory that's right. But I wouldn't say in theory, if there wasn't a twist. Sandboxes, just like any other piece of software, have bugs, weaknesses, etc.. For example JavaScript runs in a sandbox, just like the rest of the browser. Still one can do massive damage using JavaScript as a starting-point for malicious code execution. Why? Because the sandbox isn't perfect and has holes in it, that allow execution of arbitrary code, if used in the right way. Next point: going back to the JPG-example from above: there are ways to get out of the sandbox without even embedding any code to do so.
This ignores several factors:
The weakest link is always the human factor. "I know what I'm doing" is just wrong. That'll never happend to the point where you know enough make sure your PC is absolutely secure. Home-PCs usually aren't attacked from the outside, but rather by distributing malware that infects the PC, so blocking inbound connections is just a waste of time. Sandboxes, just like other security software, have weaknesses and bugs. They are a security-improvement, but nothing to solely rely on. In addition: why would you decline any free security? Windows updates are usually there for a reason.
This is partly true.
First of all, if you wish to go this way you need to understand that it's not enough to deny all incoming connections at certain times, you should deny them always. This is so because any time you are connected to the Internet (even if only for few seconds or minutes), you are potentially exposed to malware of all kinds. In fact, if you chose to accept connections only at certain times, you could be exposed to a clever variation of ransomware.
Basically, an attacker downloads a ransomware on your computer. After a while, you deny all incoming connections, but this is pointless. The ransomware is already there, encrypts your data, and asks you a ransom. The point is, to pay the ransom you should use the very same computer, thus opening a connection. In this way, if you pay, you could get infected with other malware, whereas if you don't, you are left with a useless computer (the ransomware could even try to damage your hard drive, or even physically damage your computer, or you don't pay).
There is a reason why "air-gapped" computer are always disconnected, and you should do so.
OK, so you chose to keep your computer always disconnected. This seems great, except it has a few issues.
For example, your computer could become infected with a malware delivered by a flash drive. You might say "Even with the computer connected, I would be exposed to this kind of attack, what's the big deal?". Unfortunately, things are a bit more complicated, for at least two reasons:
if your computer never connects to the Internet, you may be tempted to download stuff on another computer and then copy them on your offline computer via a flash drive (or, even worse, ask a friend to copy them on a USB drive!). Note that you could live with a computer connected to the Internet bit without using flash drives, so you would be exposed to this kind of attack even more when using an offline computer;
things get even worse because you cannot install updates to your OS and/or an anti-virus solution. In any case, you wouldn't be able to update the AV signatures.
A better solution would be to not plug in flash drives, perhaps only using non-rewritable media (of course, checking the files written in the CD/DVD with an anti-virus!). Eventually, you get closer to certain high-security computer setups, which clearly trade off usability for security.
I'm neglecting more esoteric attacks (e.g. jumping air gaps, perhaps through a smartphone), because they are almost impossible to mitigate for an average person, and including social engineering attacks in the "flash drive attacks" category. Physical attacks are always impossibile to avoid, whether you are connected or not.
Bottom line: it is safer, if you don't mess with flash drives and don't let anybody else physically access your computer.
