Unsolved
This post is more than 5 years old
2 Intern
•
360 Posts
0
45698
October 2nd, 2003 23:00
Are you running a firewall? You should be!
Are you running a firewall on your machine? You should be! Without any firewall protection, you are at a much higher risk of being attacked/cracked through the internet. Example: Windows, by default, allows connections on port 135/139. If I know your IP address I can easily get a list of users on your machine through that connection. If any of them are using weak passwords, it will take less than a few hours to crack, and then I will have full access as that user. The blaster worm and the welchia worm connected through ports 135 and 139 as well. When you run a firewall, it hides your computer online such that it only shows itself when you initiate a connection. If you aren't running any servers, this is what you want, as hackers can't see or access your computer.
You can test to see what ports that are open or showing at one of these sites:
Symantec Security: http://security.symantec.com
Gibson Research: http://www.grc.com (follow the links to Shield's-Up!)
DSL Reports Port Scanner: http://www.dslreports.com/scan
At the very least, enable the internet connection firewall (ICF) that is built into Windows XP- it doesn't protect programs from getting out, but it keeps bad stuff from getting in. The ICF would have protected you from Blaster and Welchia. Microsoft also plans to upgrade ICF into a full fledged firewall with XP Service Pack 2, due out this year. I've been following the code changes, and the built in firewall should be as good as any of the free firewalls that other vendors use.
A nice overview of the ICF is here:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;320855
This article will tell you how to turn it on and off.
http://support.microsoft.com/default.aspx?scid=kb;EN-US;283673
If you are behind a router, you are safer, as the NAT feature of the router will discard all unsolicited traffic that arrives. However, it does not completely protect you, as trojans and other things can still get out. Some routers, like the TM2300, include a built in firewall. I have a belkin router that has a pretty capable firewall. Check with the maker of your router to see if it has a firewall.
For those who want something more secure than ICF I recommend one of the following:
ZoneAlarm: http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp?lid=nav_za (as per the experience of the users below, I'm no longer recommending this program. It's still the most popular, so I leave the link for others to check out)
Kerio: http://www.kerio.com/kpf_home.html
Sygate: http://www.sygate.com/solutions/centrally_managed_personal_firewall.htm
Norton Personal Firewall: http://www.symantec.com/sabu/nis/npf/
Of those listed, Sygate and Norton tend to be the most powerful. ZoneAlarm tends to be the easiest to use, and they offer a free version!
If you would like a nice list of commonly asked questions about internet security, try this link, complements of the awesome security gurus at The DSL Reports security forum:
http://www.dslreports.com/faq/security
Dell user ChrisRLG sent me this link, which is a website he maintains about computer security:
http://www.cjwd.demon.co.uk/compsafetyonline.html
Note: Firewalls aren't the be-all/end-all of security. I urge you to run an antivirus program too. Configure Autoupdates for windows as well. If you keep up to date with patches from microsoft, it's very hard for a hacker to hack you. Here is a nice little article about turning on automatic updates:
http://support.microsoft.com/default.aspx?scid=kb;en-us;283629
Note that it will download them for you, but you still have to actually click install. I've cleaned the blaster worm out of 2 computers that didn't have the patch installed, even though windows had already downloaded it for them. If they had only clicked 'install' they would have been fine.
Of course, you can always download updates seperately at: http://windowsupdate.microsoft.com
Lastly, learning about and configuring firewalls for those who have not done it before can be difficult at first. I offer my assistance to those who want it. If you would like to know more about firewalls, what they do, and why you should use one, please ask. Reply to this post with any questions,or you can send me a private message too. Even if I don't reply right away, there are several knowledgable people here who will.
Message Edited by ryri on 01-28-2004 06:13 PM
rpras
18 Posts
0
October 3rd, 2003 02:00
Ryan:
Thanks for an excellent article. This is one of the best I have seen on the forum. You deserve accolades. A noble act, indeed.
I am using TM1300 behind a NAT firewall offered by my Linksys router. And I just ran the Symantec Security check you recommended. I have in addition to the I5100, an Alpha running Linux and an iMac connected to the router. The Symantec check found one open port (ssh) and one closed port (http) that I enabled on the router to let me and my friend connect to the Linux box to do work, and to serve work-related webpages. It was a relief to see that the firewall does protect me (apart from the open ports mentioned above, that I try and keep as secure as possible).
One question I have is this: for the I5100, that uses TM1300 to connect to the Linksys via the WAP, do I need additional (software) firewall? I guess I'm not sure if any attack on the I5100 must come via the router and the WAP, or whether the TM1300 in the I5100 can be "attacked" bypassing the router/WAP. Can you (or others) please comment on this point?
Thanks again for a great article.
Rajiv
Message Edited by rpras on 10-02-2003 08:25 PM
Jerry Park
695 Posts
0
October 3rd, 2003 12:00
If you have a good router which can stealth your network, don't use compromised browsers and email clients (Outlook Express, etc.), don't open unknown email attachments or download unknown executable files, and check what you do download with a good virus program, you will be relatively safe from a virus or worm attack.
You also need to remain aware that just because your antivirus program doesn't see a virus doesn't mean the file is completely safe. New attacks come daily.
I don't run a firewall, but I do do the above. No problems with viruses, worms or trojans.
nanakivii
37 Posts
0
October 3rd, 2003 13:00
ryri
2 Intern
•
360 Posts
0
October 3rd, 2003 13:00
rpras:
There are 2 most likely scenerios of attack via the wireless network:
1) Someone can sit in an area where they can detect your network, and sniff out traffic for a few hours/days (depending on the computer they have, what strength encryption you're using, etc). After capturing enough packets, they can decrypt your key. Then, they can easily read all of the packets you are sending, and since they have your key, they can attempt to connect directly to your router. If you don't have any access control except for WEP enabled, they will be able to join the router and become part of your network. From here, any file shares you have they can connect to, as well as attempt to explioit any security weaknesses you have.
2) If you aren't paying attention, Windows will connect you to new networks it finds without asking. Someone could get lucky and have you connect to them, and then the situation is the same as above.
A firewall only makes it harder for the person to connect directly to you- it doesn't protect against them reading all of the traffic you are sending. It's impossible to tell who is passively collecting packets as well. You can make it harder for them to connect to the router by turning off SSID broadcasting, and enabling MAC address filtering. (Both can be circumvented, but it makes it that much harder).
Even so, if the Linksys is only running NAT and not a firewall on top of it, I'd recommend a firewall just so you get some outbound protection.
Jerry- I disagree. I liken your comment to saying 'as long as you are a cautious driver, always checking your blind spot and obeying the speed limit, you don't need to wear your seat belt.' (It's not a perfect analogy, but it shows my point)
Jerry Park
695 Posts
0
October 3rd, 2003 14:00
For clarity, I once used ZoneAlarm. I don't anymore because it killed two systems at my work place. Had to completely wipe the hard disks and reinstall everything before TCP/IP would work again.
Caution is good.
Verns600m
130 Posts
0
October 3rd, 2003 15:00
I've been using the other free firewall with great satisfaction.
johnallg
2 Intern
•
7.3K Posts
0
October 3rd, 2003 16:00
I highly recommend this be made a sticky on this forum and also the Wireless Networking forum. An excellent and very informative resource for all users. Thank you Ryan!
rpras
18 Posts
0
October 7th, 2003 06:00
Hi folks:
Just found some time to get back to this discussion.
---- Ryan wrote:
1) Someone can sit in an area where they can detect your network, and sniff out traffic for a few hours/days (depending on the computer they have, what strength encryption you're using, etc). After capturing enough packets, they can decrypt your key. Then, they can easily read all of the packets you are sending, and since they have your key, they can attempt to connect directly to your router. If you don't have any access control except for WEP enabled, they will be able to join the router and become part of your network. From here, any file shares you have they can connect to, as well as attempt to explioit any security weaknesses you have.
----
Right -- sniffing was one thing I was worried about. That is the reason I change my WEP keys frequently. IIRC, this is also basically the idea behind WAP, isn't it (in addition to its authentication capabilities over WEP)? "Frequently" is a relative term here. I do this maybe 1-2 times a week. So this brings up another point: how long does one need to "sniff" before they break my encryption? A day, a week... what? (Obviously it depends on their computing capabilities, but some average number would be nice to set a benchmark.)
----
2) If you aren't paying attention, Windows will connect you to new networks it finds without asking. Someone could get lucky and have you connect to them, and then the situation is the same as above.
----
This I need to be careful about. How does one go about restricting the 1300 to connect to the preffered network only (my WAP) and not behave promiscuously? I have the option "Automatically connect to non-preferred networks" in the Advanced area for the 1300 unchecked -- is that enough?
---- Jerry wrote:
If you have a good router which can stealth your network, don't use compromised browsers and email clients (Outlook Express, etc.), don't open unknown email attachments or download unknown executable files, and check what you do download with a good virus program, you will be relatively safe from a virus or worm attack.
----
Yes -- I checked that my router actually "stealths" the network, so that is cause for comfort. I already follow your other suggestions. Not yet a virus/trojan attack, so I must be doing the right things. But your points are well made, and others should take note of them -- you can never be too safe -- be vigilant. My antivirus definitions files are updated daily, for example, and Windows patches applied when they appear -- not automatically, because I still want some control for myself.
One thing I do not have (yet) that Ryan pointed out is outbound filtering/protection. But I'm the only one using the I5100, and have been lucky so far.
Thanks for a great thread guys, and I appreciate everyone's replies.
Cheers,
Rajiv
Herrflik
21 Posts
0
October 8th, 2003 07:00
If you're using any of the WEP 'classic' modes, you (strictly speaking) must rekey before you've sent 16 million packets, in the absolute best case. If you're making very light use of the WLAN, that might give you as long as a week, but more likely, it would be a good idea to do so daily.
In reality, its advisable to change after only 4000 packets or so, but thats just too impractical to consider.
For any sort of sophisticated attack, it would be better to simply switch over to using WPA; its key management rekeys automatically. But given my level of laziness, I'd take WPA just to save myself the effort of key changes.
rpras
18 Posts
0
October 8th, 2003 20:00
Heheee -- no, I'm not laughing at you. This is the idea that popped into my head a while ago, and it's funny you thought it up too!! Sorta like a poor man's WPA, eh?
No, I guess the easiest will be to just upgrade to WPA. WPA is available on 802.11b routers too (examples, please?), or at least can be if the company provides an updated firmware (mine won't
).
Cheers,
Rajiv
johnallg
2 Intern
•
7.3K Posts
0
October 8th, 2003 23:00
ryri
2 Intern
•
360 Posts
0
October 8th, 2003 23:00
I know of no such utility. It would have to interface directly with the router. I know my belkin router has a little program you can run on windows that will program the router for you- if you could reverse enginner it and figure out what port and how it's configuring it, you could write a little VB script that changes the key and then prints it so you can enter it.
Otherwise, since you can't run scripts on the router, it would be very difficult to accomplish.
arf114
6 Posts
0
November 30th, 2003 15:00
I agree, I ran the tests and was told I had a "Healthy set up". I think it may be too healthy,, I am unable to access some sites and web pages,, Microsoft updates page and MccAffe updates site, alond with Lycos and some Yahoo sites..
My thought is that the Dell 1184 firewall is conflicting with my MccAffe firewall.. Can I turn off the dell TM 1184 firewall?? I have shut my virus scan and firewall down to see if it changed. Not, so I suspect the Dell installed firewall... You with me???
Or am I out in left field about this?
I am running WinXP on a dimension 2350, Have DSL thru a speedstream 5660 router into a Dell Tru Mobile 1184 Router, Have updated firm ware and it works on my other computer running Win 98 ( my recipient computer), But my Dim 2350 is my server computer and has the problem.
Any help would be appreciated!!
jwatt
4.4K Posts
0
November 30th, 2003 17:00
The only way to turn off the 1184's "firewall" is to run the 1184 as an access point rather than as a router. This section of the 1184 manual explains how to do that.
Jim
TechWantAbe
1 Message
0
January 28th, 2004 19:00