🚀 go-pugleaf

A Quick Primer on Internet Security for Home PC Users

If you use Microsoft File and print Sharing on a LAN, and you use the
typical full-featured network installation, then you may be sharing your
system with the whole Internet.

The issue is NBT or NetBIOS-over-TCP/IP. NetBIOS is the simple
addressing system used for Microsoft LANs - each PC is addressed by the
short name in START / Settings Control Panel / Network / Identification
/ Computer Name (a 13 character identifier or 'address' - e.g.
"Celeron366"). NetBIOS addressing may be bound to the NetBEUI protocol
or the IPX/SPX protocol for LANS, which are well suited to this 13
character (i.e. small) address to identify each computer - in this small
pond, names are unique.

The trouble appears when NetBIOS addressing is enabled over TCP/IP -
which is the DEFAULT setup when you do a typical LAN and Internet setup
on an MS PC. Of course the short NetBIOS name is not unique across the
big sea of the Internet - but it is TRIVIALLY EASY to query the PC at
any IP address for its Computer Name, Workgroup and Description. No, I
will not tell you how.

Even worse, when NBT is enabled, then any shares (Files or Printers) are
ALSO SHARED across the whole Internet.
Let me EMPHASIZE that - if you share files across a LAN, and connect to
the 'net, then your shared Files/Printers are probably shared to the
whole Internet as well (any passwords will still apply though).

For more details on this networking binding issue and how to FIX this
hole, I recommend you read and follow the instructions on
http://grc.com/su-bondage.htm

For a more general Security Check - try ShieldsUp! from the main page at
GRC:
http://grc.com
This page will perform security checks on your PC and report any issues.

There is also some really good tech explanations on this site. He also
has a tool to check and remove hidden SpyWare from your PC - OptOut - I
haven't tried it (I know EXACTLY what is installed and running on my
machine)

If you are shocked at how open your PC is, there are many FireWall
programs (it protects your PC from Internet nasties, like a firewall in
a car protects againts fire or explosion in the engine) available to
Home Users for free - I found ZoneAlarm 2 is pretty easy to use.
ZoneAlarm may also tell you if you have a Trojan installed on your
machine - which often show up as un-expected outgoing connections. It
can be found here:
http://www.zdnet.com/downloads/partners/zonealarm/download.html

After you have installed a FireWall - go back to ShieldsUp! and see how
secure you are. Note that Port 113 is tricky and may show as Open (which
it is meant to be, sort of, if you are using e-mail clients). Note that
a FireWall will often register blocked accesses which occur as part of
the Internet 'background noise' - i.e. not every block is a foiled
pirate attack - it is common to receive unsolicited connections from a
server you have visited recently (perhaps the TCP connection was lost
and the server is checking if you are still there). BlackICE is
particularly prone to False Alarms (especially if set to Paranoid or
Nervous). ZoneAlarm has a nice easy WhoIs which will give you a broad
idea where a connection attempt comes from (although its only for Arin
(US), you have to learn when to check for APNIC (Asia/Pacific) or Ripe
(Europe), or JPNIC in Japan

If you can't figure it out, here are the 4 WhoIs servers - if you get an
attempted connection from a certain IP address, you can enter that
address in here and see who it connects to - NOTE WELL - usually the
best you will get is the ISP who owns that block of IP addresses. Don't
send Flames about Piracy to the people listed - they are often just the
registered officer of the ISP - get it? IPs are handed out dynamically -
WhoIs does NOT usually tell you anything about the PC or person
connected to that IP address - be careful. A connection attempt from a
New York ISP after you just left a site in New York is probably OK. A
sudden flurry of probes out-of-the-blue apparently from outback Russia
is probably Not a Good Thing.

US (Arin)
http://www.arin.net/whois/

Asia/Pacific (APNIC)
http://www.apnic.net/apnic-bin/whois.pl

Europe (RIPE)
http://www.ripe.net/cgi-bin/whois

Japan (JPNIC)
http://serv.nic.ad.jp/cgi-bin/whois_gw

If you pick the wrong WhoIs, it will usually tell you which one you
really need.

If you want to learn more (much, much, more - phew!), try Robert
Graham's site for a starter on terms and concepts:
http://www.robertgraham.com/pubs/hacking-dict.html

Then this page has more details on intrusions and their types:
http://www.robertgraham.com/pubs/firewall-seen.html
Of particular interest is his list of Ports and typical attacks.


If you can absorb and understand what Gibson Research and Robert Graham
have to say, you will be well informed on Internet Security for the PC.

If you want to do an easy Virus Check - McAfee has an ONLINE Virus
Scan - its quite convenient:
http://www.mcafee.com/myapps/clinic/protect/ov_scan.asp?


Quentin David Jones