This week the Internet Storm Center, part of the SANS Institute (an internet security research and education organization), released a troubling report. In it they warned that an unpatched Windows PC connected to the Internet will last for only about 20 minutes before it is compromised by malware of some kind. That figure is down from the average of 40 minutes found in the 2003 study. This average “survival time” of 20 minutes is not enough time for the user to download the patches that will protect the PC from internet threats.

How can you protect yourself? The Storm Center recommends that users turn off Windows File Sharing and enable the Internet Connection Firewall before connecting to the internet for the first time. Microsoft’s newest security update, Windows XP Service Pack 2, will enable such a configuration. The problem is, users will have to go online to download the update, exposing the system to an attack.

Service Pack 2 has been released to business users, and will become available to consumer users in the near future. Features include blocking of pop-up ads in Internet Explorer (long a feature in the Mac OS X browser, Safari); a revamped firewall turned on by default; Outlook Express, Internet Explorer, and Windows Messenger now warn about dubious attachments; origins of downloaded files logged; web graphics in email no longer loaded by default (as in Apple’s Mail application); some spyware blocked; and, users regularly reminded about Windows Updates.

Some applications, especially those that expect to have internet access that the Service Pack has shut off, behave differently after the update. Microsoft has published on their website an extensive list of applications known to be affected by the Service Pack. The list contains many popular games, like Unreal Tournament, Warcraft, Starcraft, and Sim City 4. Other applications of note include Adobe’s Pagemaker and Photoshop Elements, AOL, WordPerfect Office, Quicken 2003, Microsoft’s own Office Suite, including Outlook, Word, PowerPoint, and Excel, Musicmatch Jukebox, Microsoft Works, MSN, Pinnacle Studio, Norton Antivirus and Systemworks, and Yahoo Messenger. There have been some reports that Apple’s iTunes application and its built-in portal to the iTunes Music Store have also been affected.

Although the jury’s still out on the Service Pack’s effectiveness, ridding your web surfing experience of those pesky pop-up windows should be worth the price of admission (which is free). Plus, patches to fix applications affected by the patch will certainly be forthcoming.

© 2004 Peter F. Zimowski