An unsigned reader notes a recent post on the SANS Institute's online network Storm Center site estimating the time to germs of an unpatched Windows machine on the the web* — currently about 4 minutes. The analyst stipulated that the sub-5-minute appraisal was valid for an unpatched machine in an ISP netblock with no NAT or firewall. The researcher, Lorna Hutcheson, called for others to post data on time-to-infection, and honeypot researchers in Germany did so the same day. They found longer times to infection, an average of 16 hours. Concludes the ISC's Hutchinson: "While the darwinism time varies quite a bit across methods used, pretty much all agree that placing an unpatched Windows microcomputer right away onto the online network in the hope that it downloads the patches faster than it gets exploited are odds that you wouldn't bet on in Vegas."

Read more of this story at Slashdot.

More: - Continued here

Mark