[ILUG] From the register. XP machine rooted in 200 seconds.

[Ken Gilmour]

Captain's Log, stardate Wed, 1 Dec 2004 11:39:49 +0000, from the fingers of Jason Corcoran came the words:
> On Wed, Dec 01, 2004 at 11:26:41AM +0000, Ken Gilmour wrote:
>
>> Captain's Log, stardate Wed, 1 Dec 2004 11:08:44 +0000, from the
>> fingers of Jason Corcoran came the words:
>> There's no point really in testing the vulnerabilities in old
>> service packs... Although i do hate windows, i at least make an
>> effort to update service packs etc as soon as i see them
>> available. The same could be said for a Linux machine (in fact,
>> it's said that Redhat 7.3 had more security holes in it's default
>> install than Windows 2000 at the time). If you don't update your
>> stuff you're more prone to attacks... it doesn't take a scientist
>> to realise that!
>
>
> Given that XP SP2 is 2GB (Not sure about the size, but this was the
> figure batted around my old work place) how many dialups or *can be
> bothered downloading that size of a service pack* merchants are out
> there.

It's between 150 to 200MB depending on what you have already updated and whether you use pro or home. But i can imagine it would be very painful to download the whole thing at one time on dialup (our feckin 50 or so windows machines automatically downloaded it on broadband and i was kicking myself for not knowing why all of a sudden all windows machines were maxing out our bandwidth, i quickly found out and blocked the sites they were downloading from.) In saying that, Microshaft posted me out a free SP2 CD, they were also freely available in magazines etc (i guess it's not free if you have to buy the magazine unless you're a shoplifter).

> Also given that he could be comparing a patched XP v *out of the
> box* linux box. I suppose there is not enough information about the
> default config. of the Linux box to really compare.
>

Yeah i would be interested in knowing which distro for sure. I get a LOT of those brute force attacks on my OpenBSD firewalls and Debian firewalls but they're never successful. They try like 20 times and give up (why they call 20 attempts a "brute forcer" i don't know!)