20050723-005950 Experience of network attack for public IP windows servers
I have a terrible experience when installing windows server which using public IP. This week, I installed a Windows XP. The host connected to Internet via a public IP without any firewall in the front. After I setup the network for about 1 minute, my XP prompted me a system message about some failure in registry and ask me to contact a strange company for assistance. In the beginning, I did'nt care about such prompt, and just closed it. But several minutes later, it prompted again. After 20 minutes, my XP was automatically installed with a software in system tray, named "180search". When I want to check the software, it prompted me to shoutdown windows XP with a countdown from 60 secodns. Oh! My God. I neither knew where these prompt comes from, nor the automatically installed software. Originally, I thought one of the installed driver was broken, so I re-install whole windows XP again. Can you imagin, I install windows XP for 3 times, and this strange phenomenon happened all the time. It even happend immadiately after I activated the network interface but before any additional softwares installed. The server connected to public Internet with a fixed IP ADSL from local ISP. Finally, I conclude that it was resulted from network attack. I switch the network interface behind a private network with a firewall, install Windows XP, patch it with all packages in windows update. After these updates, I connected the Windows XP to Internet with public IP activated, it was not influenced by network attack again. After that experience, 2 days later, I install a Widnows 2003 .net enterprise server. I thought Windows server is more robust than XP, so I can install and activate it from public IP directly. But I am wrong, again. Windows 2003 .net server is as fragile as Windows XP when not adding any patch when connected to public Internet. Before I install any software, as soon as I connect windows 2003 to public internet, the annoying prompt appeared, and followed with the 60 seconds shutdown countdown again. I really wonder why the network attack over public Internet is so rampant, especially targeting for Microsft Windows family. If system administrator is a cookie, public network environment is really terrible to him.   I don't know why hackers have such leisure to scan public Internet and luch attacks.

<  top   | back   | topic index  >