1

suppose the machine is clean of all malware but not in any sense updated, patched, secured etc. Suppose I connect it to the internet from behind wireless router with the intent of using it only on a few trusted sites and only there. Or, for the sake of argument, maybe I wouldn't do any browsing at all, just let it sit there connected to the network. This is all happening in a residential situation with cable internet.

In this situation can a remote attacker somehow detect the fact that the machine is connected to the internet and try connecting to do an exploit?

6
  • I don't think that this is a good question, it is very open to speculation and discussion and not a real problem that you face.
    – Baarn
    Apr 14, 2012 at 13:44
  • of course it's a real problem I face. I suspect my main machine of being infected, and I want to use another, certainly clean one, for financial issues. So I want to know if that other one will become infected quickly just from connecting to internet. Apr 14, 2012 at 13:56
  • 2
    You should edit that into your question, as I read it now you are just having some sort of vulnerable machine (like say running vanilla win98) behind a router. But as you describe it you allready have a hole in your line of defence (infected machine behind router), this is a completely different situation and your question should reflect that.
    – Baarn
    Apr 14, 2012 at 14:02
  • I cannot answer, but i would comment that many of the open holes were based on various running services, and listening items. Like remote connect ability, and even mostly internal communications. Potentially a person could shut down completly many of the things that connect and listen. That method has been applied before to both stop a possible exploit that could use a certian service, and because the user had no specific need for the item to begin with.
    – Psycogeek
    Apr 14, 2012 at 15:24
  • Any computer connected to the internet can be detected and attacked.
    – cutrightjm
    Apr 14, 2012 at 20:42

4 Answers 4

3

It is hard to speculate, but let me try. You are asking:

In this situation can a remote attacker somehow detect the fact that the machine is connected to the internet and try connecting to do an exploit?

Even if the unpatched machine is clean (how do you know? did you do clean install?) it could be compromised again. It would be hard to detect the unpatched machine directly, if it just sits and does nothing (this is not the case if it transmits/receives some traffic). But that doesn't mean that the machine is safe.

Here is a potential scenario in which the unpatched machine can be compromised: If there is a router exploit (it has happened before) an attacker could compromise the router and the unpatched machine is an easy target.

Another scenario: a weak encryption or weak password of the wireless router could result in router compromise, and from there the unpatched machine could be compromised too.

And last but not least -- an obvious scenario which was already mentioned: a compromised machine on the local network could result in compromise of the unpatched machine.

As for visiting trusted sites, there were cases in which third-party ads on such sites were infecting users with malware, so the machine could be compromised unless Adblock Plus and/or NoScript, or similar are used (but that's part of securing the machine)

Of course these scenarios are not very easy or common, but are possible and have happened before.

There is really no reason to keep an unpatched machine on a network for a long time, behind a router or not.

1
  • i108.photobucket.com/albums/n24/jbender85/trust.jpg 2 very trustworthy sites I visited regular like, accidentally aquired JS and ActiveX malware, took them 1&2 Days to even find it due to the complexity of the code and cross linking, and adds and scripts. Luckily I had that all turned off on the browser , but many fully updated and secure users got it.
    – Psycogeek
    Apr 14, 2012 at 20:35
2

The second "clean" machine cannot be directly attacked and infected from the internet if it is behind a router but if your first machine has a known malware infection then it is possible that the malware on it could be written to actively seek out other machines on your network and infect them by any means possible.

If there is one machine on your network that is infected then all your machines are potentially at risk, especially if they share data or programs or usernames and passwords.

If this clean machine also has an older or unpatched operating system it makes it more likely that it has vulnerabilities that could be exploited across a home network.

If you only ever go to absolutely trusted sites then you may well be okay but the first site I would go to would be an antivirus site to get some up to date protection.

Until you can clean the infected machine I would only ever have one machine switched on at any given time.

2

Today's malware often is a delivery mechanism for a multi-pronged attack that looks for program/os vulnerabilities, service vulnerabilities, share points, etc. From the initial machine infection, it can try to push infection agents to either actively or passively attack other machines on the network through various vulnerabilities.

In your scenario, it is more likely that someone will infect another system that then attacks the vulnerable system. If the infection is a remote access trojan, the person can also actively see all the machines on the internal network. Other malware can also do a network scan and phone home with information.

On an internal windows network where file sharing is being used, an unpatched machine can be attacked through three separate vectors.

1)Share points that have the trojan dropped in place with an autoplay. Your machine is infected either by direct execution or an autoplay being triggered. Don't enable the Microsoft Client to access other computers on the network on the outdated system.

2)Vulnerable services can be scanned for and the machine attacked through them. Don't run any services that listen on the network on the outdated system.

3)There's no such thing as a trusted website anymore. Most of your attacks will come through Acrobat files, Flash content, Java applets, etc. The browser itself, being unpatched if IE will be another major source of attack, especially if it's IE6. Keep the websites you visit down to corporate sites that have a lot to lose if they ever get compromised. Blogs are never trustworthy, you can't depend on the person running them to be aware enough to patch before compromise. I've gotten pretty used to the Kaspersky pig squeal in the last year.

Now from the most likely attack to the less likely attack.

As to "Behind a wireless router", what encryption level are you running? If you aren't running WPA2-AES, get a router that will run it and passphrase protect the network so that it's easy to connect other systems, but hard to break from the outside.

With NAT on the router and the unpatched computer accessing the network, all an attacker should see when this computer is generating traffic is your router IP address and a port number. Don't port forward anything to this system.

And now where NAT can allow information leaks. Whether this is Linux, Windows or MAC, there are certain intranet protocols that MUST BE BLOCKED from passing through the router to the public network. I've seen routers pass Microsoft File and Print sharing traffic outbound, DNS traffic from internal name resolution that gets passed outbound. From this traffic and a packet sniffer, it is possible to build an internal network map of the private network addresses being used and by the packets, attempt to fingerprint the OS generating them if that information isn't spelled outright in the packet.

1

Whether a computer can be discovered behind a router has nothing to do with whether it is up to date and properly patched, but whether the router will allow it to be accessed. The network address translation and firewall provided by the router may provide a (small) degree of protection against the system, but it is still relatively easy to detect and exploit the vulnerable computer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .