Is it safe to install OS on a machine that is still connected to the internet?

Question

I am worried when I re-install OS on my machine while it is still connected to the internet.

Is it possible for malicious users on the internet to gain access to my machine while I am installing OS on it?

Answer 1

During the OS install, there's not likely to be much risk since most of the actual installation is generally done without network connectivity or with very limited functionality enabled. After the OS is installed though, and you're working on the first system boot, the system will be vulnerable.

However, for all practical purposes, Internet connectivity is a must in order to get the system updated - which is a fundamental first measure towards securing the machine.

Steps you can take to make the system as secure as possible during the re-install:

• Never connect the system directly to the internet - always have a NAT router/firewall between it and the modem.
• Prior to first boot, do not connect the network cable unless the OS install process has built-in updating features you would like to leverage.
• Immediately after first boot (and preferably before connecting the network cable) install antivirus and firewall software. Make sure both are properly configured before connecting to the network.
  • Most antivirus vendors offer offline installation packages, and offline update installers.
• Immediately after connecting to the network, update the OS and all pre-loaded software via known-good and trusted websites or built-in updating mechanisms.

Answer 2

Depends whether your machine is directly connected to the internet (like a single client device ADSL or Cable modem, or being behind a NAT, but chosen as DMZ). If it's behind a NAT it's unlikely to get infected.

If you have XP SP0 and port TCP/139 forwarded to your system, don't complain if you get infections.

Answer 3

It's possible, and it has happened.

An OS is patched often against vulnerabilities. If you're doing a vanilla installation (without the latest patches and/or Service Packs), there's a chance that the installation gets infected while connected to internet.

The "Blaster" worm exploited computers on the internet, simply by spamming itself to large numbers of random IP addresses:

The worm spread by exploiting a buffer overflow discovered by the Polish cracking group Last Stage of Delirium in the DCOM RPC service on the affected operating systems, for which a patch had been released one month earlier in MS03-026 and later in MS03-039. This allowed the worm to spread without users opening attachments simply by spamming itself to large numbers of random IP addresses.

Although the worm can only spread on systems running Windows 2000 or Windows XP (32 bit) it can cause instability in the RPC service on systems running Windows NT, Windows XP (64 bit), and Windows Server 2003. In particular, the worm does not spread in Windows Server 2003 because it was compiled with the /GS switch, which detected the buffer overflow and shut the RPCSS process down.When infection occurs, buffer overflow makes RPC service crash, leading Windows to display following message and then automatically reboot, usually after 60 seconds. (default RPC service failure behaviour).

Answer 4

Unless you have an installer that connects to the Internet, no. And even if you do, none run anything by default that could be exploited externally.