Computer hasn't been connected to internet for 2 weeks

Question

A computer hasn't been connected to the internet for 2 weeks but has still been used. It's running Windows 8 and various notices are complaining about virus definitions and updates not being current. What's the best thing to do once it is reconnected to the internet? Just let it sit and update itself? I remember in the past the blaster worm was so bad it would infect my computer on a clean install before the patches could be downloaded from Microsoft. Is there a way to block all traffic that doesn't come from Microsoft?

Answer 1

In reading some of these answers, I wonder if some read the question: "A computer hasn't been connected to the internet for 2 weeks" as most answers are spouting "static IPs" or "if your computer is connected to the Internet." I would steer clear of these answers as it demonstrates that answers are simply being typed without a thought process.

On to the answer. So your computer hasn't been connected, and you seem to be worried that the moment you connect, something is immediately going to infect you. There are two approaches to solve this problem. The first is out of band updates, where you could either use a WSUS proxy server to download the updates, then get them from your server, or you could download them on your own. Same applies for antivirus.

As far as I can tell, and know of, there have been no "catastrophic" viruses or worms affecting Windows similar to Blaster, SoBig, and others. If you are that concerned, you could determine what the IP addresses are to the sites where you need to get updates from (Microsoft, and your AV vendor) then create a Windows based firewall rule to ONLY allow those sites, and block everything else. The issue with this is, CDN's (Akamai for example) where updates are not coming from your vendor, but a third party.

Another alternative solution (albeit long and cumbersome) is to place the machine on its own network, and monitor traffic to and from it with a sniffer (Wireshark, etc) otherwise, there is no reason to fear that turning that machine on will immediately trigger it to be "hacked" or "infected" or otherwise. That last sentence is based on the premise that the machine does not require a static address, and or, is using exploitable services (vulnerable http, pop3, etc).

There is a difference between vulnerabilities and exploits, and I have stated this before: "not every vulnerability is exploitable." The mere fact that you may have a vulnerable version of say Internet Explorer means little if all you are doing is connecting DIRECTLY to Microsoft for an update. Versus you steadily using the same IE for day to day web browsing.

Answer 2

If it were me I would make sure that the Windows firewall is on and configured to block all inbound connections.

While there is a risk that there could be a vulnerability in the Windows firewall, it is likely that such a vulnerability would be high profile and you would know about it from media reports, in this scenario one of the offline methods (described in other answers) is the way forward.

A hardware firewall or router with firewall functionality between the device and the Internet would be preferable.

If either (or both) are in place go online and make sure the Windows Update is completed before any other Internet related activity (browsing, emails etc.).

One of the reasons Blaster was so quick to spread was that it pre-dated the current Windows firewall, which is now on by default, and also the lack of firewall functionality in modems at the time.

Answer 3

Just let it sit and update itself?

Unless you are a very high value target or you have good reasons to suspect that you're being actively attacked, then just booting up and try to get the update finished before doing anything is quite a reasonable level of precaution. Two weeks of no update are not long enough to likely get infected and you can't protect yourself from zero-day exploits even if you are up to date anyway.

If you do have reason that you're being actively monitored and attacked though, you would want to make sure you have firewall active, preferably an external firewall although Windows Firewall should also do, and configure them to block all inbound traffic and only allow outbound traffic to Microsoft's Update server. Microsoft Update packages are digitally signed, so unless Microsoft's private key is compromised, you would have a pretty good confidence that the update packages come unaltered from Microsoft. Your computer comes preinstalled with Microsoft Update's public key, as long as you trust your initial install, then you should be good. Even if someone do a DNS or IP spoofing and deployed a fake Windows Update Server, they cannot create a Windows Update package with a signature that will be accepted by Windows Update, as packages that failed signature validation will raise a security warning/error. Never install packages that failed signature check.

If your attacker is blocking you from updating, then you can use an offline update server, like the aforementioned WSUS.

Likewise with antivirus. Most credible antivirus software would digitally sign their update packages and would refuse to update from forged package. If yours doesn't, switch to a better antivirus. In this case though, the antivirus update server public key should be installed when you install the antivirus, so if you trust the antivirus' initial install, you're also good. Check how your antivirus vendor does their update, some less trustworthy antivirus have been known to not provide sufficient level of security around their update process.

Answer 4

If your computer will be connected directly to the internet or if your router provides publicly-routable IPv6 addresses, then yes the machine may be at some risk.

If you're behind a router that doesn't provide IPv6 connectivity or acts like a firewall for IPv6 then you're fine since most IPv4 routers act like firewalls by default (unless you forwarded all the ports to your machine's internal IP) and thus your router will be the target of attacks, not your computer, which should (hopefully) give it enough time to update itself and be able to "defend itself" in the future (read the comments below - some routers seem to divert from this default behavior).

Of course this assumes that your local network is clean and no machine is compromised, otherwise your unpatched machine may get compromised from an already compromised machine in your network (even routers may be compromised).

Answer 5

I have heard good things about WSUS Offline (scroll down for the English write-up) which should be able to update windows offline (download everything on another machine fully patched and running updated AV). I have not used it myself but know several friends who have.

After windows is up to date you should be protected from any known (patched) remote unauthenticated worm infection techniques and can then connect to the internet and immediately update your virus definitions file.

(If your av vendor offers offline update packages then you could always download these and transfer them offline as well as the windows updates).