Is possible to get infected by only staying connected to the Internet (nothing else)?

Question

I have a router and I'm the only user. I have a computer with Linux and a tablet with Windows 8.1.

Because of a few problems, I had to reinstall Windows on the tablet. Since I'm a bit paranoid about virus and malware, I would like to ask:

Even if I only used the Internet to download Windows updates and get the antivirus software from the official website (using IE), is it possible to get infected only by staying connected to the Internet (doing nothing else)?

Also note that I never had both computer and tablet connected at the same time.

I read somewhere that is possible to get the router infected, so to prevent this, I'm doing almost everything with attention.

Answer 1

A few years ago (2003), there was this worm called "Blaster" (or MSBlast, Lovesan etc. - read more on https://en.wikipedia.org/wiki/Blaster_(computer_worm)). It spread by using a vulnerability in an RPC service, running on Windows XP and 2000.

At the time where it was "worst", you could get infected within minutes, if you didn't have a firewall set up. I remember installing a clean Windows XP, putting it online (without a firewall), and watch it get infected within minutes.

So to answer your question: Yes, if you're connected to the internet, you're vulnerable as long as there's open ports with services listening on them (and there's a vulnerability in the software).

So you can definitely get infected by just being online and not doing anything. Remember, even if you're not doing anything, your computer is still connected to various services online and using the internet.

Answer 2

It might be possible to be infected if your computer is directly accessible from the Internet (without NAT, router, etc.). But the attacker will need to find a vulnerablity in TCP stack of your operating system that would allow him to execute arbitrary code on the machine (e.g. by sending a malformed packet), and those are very uncommon nowadays.

There can also be exploit in some system services that are listening (Windows has couple of these). This is how major Internet worms spread (e.g. Sasser, Conficker). It would also require your computer to be directly accessible from Internet (no firewall or NAT) or your router hacked.

But the probablity of both is so low that you shouldn't be concerned.

Answer 3

Short: Don't download anything and you will be fine.

Long: If you aren't downloading any file from the Internet there is almost no possibilty that your computer will be infected.
If you aren't downloading any file from the Internet and you only fear from viruses that affect your computer directly then the only way to actually infect your computer is through an open port.
The way to secure open ports is using an antivirus or a firewall to block them.
If you aren't downloading anything to your computer then the open ports on your machine will be secured if you use Windows Updates regularly.

---

If you want to check your open ports you have few ways:
1. Use Nmap on your linux machine to map the windows machine ports.
2. In windows you can type netstat -ab | more in your command line.

Answer 4

Edit:

If you are connected to the Internet, then yes it is possible.

When you say

connected to the Internet (doing nothing else)

Do you browse websites? Receive email? Connect to any other computer from the Internet?

If you do any of these things, you can still get infected.

If you do none of these things, then it is still possible (although unlikely).

And if you do none of these things, I have to ask why you are connected to the Internet. If you only use the computer to download updates, I recommend you turn the computer offwhen not downloading. That will lessen the chances of being attacked.

Answer 5

By just being connected to the Internet ther is risk of being vulnerated.

This risk can be mitigated with software updates and some security products (antimalware, firewall, intrusion detection systems, etc...).

On an ideal setting, the risk is very low. You would be running behind one or two routers on a NAT, with a fully updated operating system, no services open to the public network... and no port forwarding anyway.

To get to you on that situation, they need to compromise the routers first.

---

Then again if you are connected directly to the ISP (not behind a NAT nor a proxy) the risk is higher.

In theory the attacker will need an exploit for a vulnerability in your particular system. And the chances of an attacker picked at random knowning what vulnerabilities you have is low....

But! there are two scenarios in which this is not the case:

• If you are a target of a persistent treat, they will find a vulnerability sooner or later. When they do, it will be race to see if you patch it before they exploit it.
• If the attackers are looking for a random victim*, they will look for hosts that are vulnerable to the exploits they have, instead of looking for exploits for the vulnerabilities you have. And that search will probably be automated. Given enough time and enough exploits laying around, they will get you.

*: they may looking for hosts to add to a botnet, for example.

---

All of this is made worse if you have particulary vulnerable services installed... or simply poorly configured ones. For instance a web server, a database engine, or file sharing service can be targeted.

---

And finally you are hardly "doing nothing else". As you recon, you would download updates... perhaps your dns gets poisoned and it start directing you to a fake update server (that may even appear to have valid certificates and digital signatures due to a collision attack on the hash algorithms used to create those by the real author). And then you get infected from the updates.

Also, what else is installed on your machine? Do you have... I don't know... a Java updater? Flash updater? Chrome updater? Acrobat Reader updater? etc... any of those could be used to harm you.

Also, many user will sync files with a remote server, via Dropbox, OneDrive, Google Drive, etc...

Did you remember to disable remote assistance? Do you have a convenient Team Viewer service running all the time? How about that tool that comes with the drivers for your audio or video adapter that will look for drivers updates?

Etc...

---

Edit: no, I'm not saying that you should not update. It is a higher risk to not update and be stuck with and old version for which there will be known exploits that will continue to work forever because you never update. It is better to take the risk of updating, even considering the occasional faults update form legitimate source.

---

Edit 2: yes, your router can be compromised. Heck, even "mine" probably is compromised and I don't even know. That is because "my" router is form the IPS and they don't give me full access to it. That's why I have a second router behind it, and this one is trully mine! I can set a more secure wifi on it, I can also see its activity logs, keep a backup of its system, and I can even update it's firmware (I did once already).

---

Edit 3: By the way, by just being connected to the Internet is how honeypots work. Of course honeypots are usually intentionally vulnerable. By keeping you machine updated you are mitigating the risk, but not eliminating it. There will always be a residual risk... the only way to actually delete the risk is to be disconnected.

Answer 6

It is possible for several reasons - but your intuition is fundamentally correct, because the fundamental issue is always the "attack surface." And network security is all about minimizing the attack surface (and locking down the surface that must be exposed).

You probably have a combination router/firewall at your "edge" that serves as the default gateway for your LAN and is connected to a modem that either bridges or routes traffic to/from the edge. These devices run on software, just like any other network node, and therefore are only as good as the software they rely upon. Because of NAT, or network address translation, your PC is not addressable from the Internet, meaning that incoming traffic must first pass through your edge and get filtered, routed, and filtered again.

NAT can give a false sense of security because it feels as though you are "hiding" behind the edge, and in a sense you are. But, when you open a connection to the outside, the outside must be able to get the traffic back in, and so your NAT device (your edge) will typically open a random port (typically a very high number) when you place the request so that it can get back to you. Incoming requests are usually blocked by default because there is no NAT rule to send traffic to your node, but an attacker who gains access to the edge via shell or (sadly) the web configuration tool can add that kind of rule, or set your PC as the DMZ host.

So, the motivated attacker would look in a certain subnet and/or range of IP addresses for nodes that seem to be running vulnerable software. Maybe you bought your edge device in 2010, at which time it was loaded with the latest version of CentOS or something. Now five years later, maybe the manufacturer and/or you have not been keeping up-to-date with CentOS patches. The attacker would do something like this:

1. Pick a range of targets to assess
2. Look for nodes that respond in any fashion at all (ICMP, TCP, whatever. Anything is something.)
3. On those nodes, try to fingerprint them or figure out what software they are running on each exposed protocol + port.
4. Lookup the fingerprints that are found and match to known vulnerabilities (CentOS 2.1, Apache 5.0.28 or lower, etc.)
5. Try exploit to gain elevated access
6. If successful, set up a backdoor quietly
7. Inspect the INTERNAL (LAN) nodes using tools of choice, split output of all traffic to the attacker (ie man in the middle), poison DNS, etc.

Once the attacker has access to your edge, it can really hurt. For instance, they can intercept DNS requests (domain names to IP addresses) to point you to their servers. This is why SSL exists, but they could easily find a way to trick you by doing this for non-SSL sites. ("Please contact Time Warner tech support...")

They could also quietly log all your traffic to sift and analyze.

And of course, they could try to repeat the same classic procedure described above on your internal network, and find your node just sitting there. From there, your node has an expanded attack surface because Windows by default treats LAN traffic with more respect - so more services are exposed, like NetBIOS and File Sharing or in the older days, RPC. I mean, the sky is the limit.

This would be a lot of effort, so in all likelihood, you'll be okay if you stick to patching on the reg. But that includes patching your edge and anything in between.

Answer 7

First and foremost, anything non-trivial is theoretically possible.

Now, on to practicality.

It is exceedingly improbable that you'd get infected in this situation. The router is kind of like a phone system in an office: instead of global "phone numbers" (IP addresses), your internal machines only get "extensions" (internal, non-routable addresses). There's no direct way for an external machine to address an internal one.

However, if the router were to become compromised, that would be a "forward base," so to speak, facilitating a multi-stage attack. Fortunately, this level of sophistication is basically unheard of in malware today, and your attack surface is very small in this configuration. Ensuring "remote administration" is turned off in the router and that there isn't a DMZ set up will make it practically (if not actually) impossible for your Windows machine to get compromised.

This, of course, assumes that the only thing you do is access Windows Update. There is a type of attack called "DNS cache poisoning;" someone could theoretically get you to connect to a different machine than you intend to using this or other attacks (man-in-the-middle). But...

That's where digital signatures and SSL come into play. They make it possible to have reasonable end-to-end security.

Still doesn't make it impossible. Say Microsoft's code signing certificate gets compromised. The attacker can then sign binaries that your machine will happily accept and run. It could even be cracked rather than stolen. For that matter, it might be that the would-be attacker might have access to a quantum computer; then, all bets are off.

In short... you're NEVER 100% safe unless you physically disconnect the uplink cable. But in the situation you describe, you're probably in the 99.999% range or so. Otherwise... there's no such thing as "perfect" security.

Answer 8

If you are just connected to the Internet (so you are not downloading anything), your computer cannot be infected, but attacker can get to your computer through an open ports.

Another problem will be if you already have virus in the computer (like malware), it can use the connection to send data (e.g. passwords) to the attacker.

So there is no possibility to get infected, however, attacker can use this state to attack your computer or virus (already inside) to send data.