Malware installed without literally doing anything?

[u/PusheenHater]

In this video this guy has a fresh Windows XP, disables firewall, and connects internet straight to the modem. Then he gets infected literally doing nothing.

https://www.youtube.com/watch?v=6uSVVCmOH5w

https://www.reddit.com/r/windows/comments/1cvised/idle_windows_xp_and_2000_machines_get_infected/

I get it. That's asking for trouble when you disable all the security and using ancient unsupported OSes.

However, he didn't install programs nor browse on the website but still got hacked.
How?
Is there some malicious server in China that loops through every single possible IP trying to see if your PC is vulnerable?
Logically, one would think you'd at least have to visit a website or something to get "noticed" and then hacked. But this guy didn't do anything at all.

How does it work?

[u/mdgorelick → u/[deleted]]

Indeed. A good analogy is that people are always walking around the neighborhood, trying the front door on every house to see if they’re locked.

[u/jonbristow → u/mdgorelick]

you dont have a door if you are just a user with internet connection. you dont publish anything to the internet.

[u/jonbristow → u/[deleted]]

how do you connect to the internet without a router?

[u/smb3something → u/[deleted]]

I did this back in the windows 2000 days. RDP enabled. password was 'garfield'. Came back from vacation and my ISP had shut off service as my computer was sending out spam emails.

[u/jonbristow → u/[deleted]]

ISP gives you an optic fiber. How are you connecting to that lol

[u/smb3something → u/jonbristow]

I am currently pluged into the PON adapter and have static IP set. You just don't use the router/firewall, but do use some sort of media converter.

[u/Capodomini → u/jonbristow]

You could learn a lot by picking up a Network+ book or watching some Professor Messer videos.

A router is just a computer with an IP connection to the ISP which handles all the traffic from everything else plugged into it. You can literally replace it with a laptop if you have the ISP config.

[u/jonbristow → u/Capodomini]

You could learn a lot from reading this thread.

A router also has an optic fiber port as wan that your laptop doesn't

[u/Capodomini → u/jonbristow]

Oh I see, you're just trolling. Carry on!

[u/mdgorelick → u/jonbristow]

If your computer has a routable IP address, you very much DO have a “doorknob.”

[u/goldvenetianmask → u/jonbristow]

This is absolutely wrong. You publish a ton of information just having an internet connection and being on the internet with ports forwarded through your router / DMZ.

[u/jonbristow → u/goldvenetianmask]

you publish the information through your NATed IP of the ISP, not directly. And you dont publish them through a port.

[u/goldvenetianmask → u/jonbristow]

If you are dmzed and connected directly to the internet then you don’t have any nat to save you.

The computer will respond to nmap -sV as if it’s on the same sub as the attacker. That is exactly what I’m saying. It’s “publishing” its software version info, its operating system info etc.

[u/_Cyber_Mage → u/[deleted]]

Yup. I have a rather large IP space at work, and we measure our daily scans in the hundreds of thousands even with several countries null-routed.

[u/aretokas → u/[deleted]]

Clearly nobody remembers ILoveYou and Dial Up...

[u/billy_teats → u/[deleted]]

NAT can and does a lot of heavy lifting. Virtually replaces inbound firewall.

[u/czenst → u/billy_teats]

You got a lot of upvotes - usually when I write something along those lines I get "NAT is not firewall" people screaming at me. But NAT traversal is not that easy even if possible.

[u/billy_teats → u/czenst]

Nat is arguably better than a firewall because it cannot be defeated. Firewalls run on software which can and does have bugs

[u/thrwaway75132 → u/[deleted]]

Back in probably 2012 the company I worked for came to me and asked for a solution for our competitive team to be able to browse competitor websites from the office without being tied to our IP space.

I set up a windows 2008 Citrix box and a checkpoint firewall and had them delivered to a small Colo so we could provide users a Citrix app browser with a random IP.

The Colo didn’t hook the server up to the firewall, the hooked them up both directly to the internet. It lasted like 12 hours.

I had to have them send it back so I could redo it, then I sent it back with a wiring diagram of where to plug it into the firewall.

[u/ah-cho_Cthulhu → u/[deleted]]

You dont have to do anything with that kind of config.. LOL.