1

I heard that if you use an old Windows XP and your computer is connected directly to the internet with its own IP, you get a trojan within hours because the complete internet ipv4 range is regularly scanned by automated attackers.

Would this be possible?

And how likely is this happening?

  • check your router's logs, you can see the vast numbers of scans hitting your very own connection – schroeder Sep 12 '16 at 20:24
  • Start Wireshark/tcpdump on a network interface connected to the public Internet and watch. You'll be horrified. – André Borie Sep 12 '16 at 23:57
2

I can't comment on Windows XP as such but I can say that if you add a new connection to the internet, common ports will start being scanned certainly within 30min and sometimes within seconds.

This is not theoretical but actual.

As for XP getting a trojan, that is perhaps a little less likely unless you were to connect up an unpatched version of XP - maybe one that had been offline for a couple of years. But I've not tried it so I can't say for sure. If you have the kit lying around, why not try it?

| improve this answer | |
  • 2
    Some stats: In 36 hours on an internet facing server (that isn't running any website or anything like that): There were 36595 failed login attempts since the last successful login.. This is a root honeypot login over sshd (port 22). So I'd argue it is almost one request every two seconds. – grochmal Sep 12 '16 at 22:19
  • Nice stats, thanks for sharing. I never connect port 22 to the Internet, I always move SSH to a non-standard port. Otherwise you can't spot any actual problems in your logs for the continuous hacking attempts. – Julian Knight Sep 13 '16 at 5:41
  • If this stat is on a honeypot that is well known and was set up it is not very representable, because the attacks were not causet by an IP-Range scan. you would need a server with an IP that isn't known anywhere to only catch IP-Range-Attacks – rubo77 Sep 13 '16 at 8:45
  • I think the point is that it is easy enough to test and demonstrate the real risks. Automated attacks are continuous and highly prevalent. That is unquestionable. To get an infection (rather than "just" a break-in), the machine would need to be either vulnerable to malware that can attack over the Internet or would need to be vulnerable to a remote command/login that might put malware onto the device. Much less likely even between the 2 options but certainly not impossible. – Julian Knight Sep 13 '16 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.