Post by thread:[OT]: Security warning: Stop the crazy script-kidd

In a message dated 12/31/00 11:29:51 AM Pacific Standard Time, spam_OUTartbTakeThisOuTCABLEINET.CO.UK writes: > I have sometimes have about 30 atemps aday they all get .....abuseKILLspam@spam@isp.dot.dot > reports sent. > On my local service provider system I do get them knockedoff for a few weeks > but then they are back "they have still have the same workgroup id. but that > helps knock them off quicker next time. > Sending off reports to abuse@ addresses is just about pointless. I'm pretty sure @home (my cable ISP) is tired of the reports their users send every second in regards to "hack attempts." Port scanning is NOT a crime or a security threat. Many ISPs won't do anything if you report the "attacker" for the simple fact that it's not really a security issue. I see WAY too many posts on the @Home-"security" newsgroups where people post their ZoneAlarm logs only to see that all of the attempts have been blocked. I honestly think firewalls on Windoze systems (not including Windows NT/2K) is useless. </end rant> > You *DO* have a firewall and it is a tested one? don't you? > personally I now lockdown all ports and turn off report's from Firewall but > ant sucessful atempt's do get flaged. > > This is something you *HAVE* to live with > My point exactly....... Regards, Tim H. -- http://www.piclist.com#nomail Going offline? Don't AutoReply us! email listservKILLspammitvma.mit.edu with SET PICList DIGEST in the body

> >Sending off reports to abuse@ addresses is just about pointless. I'm pretty >sure @home (my cable ISP) is tired of the reports their users send every >second in regards to "hack attempts." Port scanning is NOT a crime or a >security threat. Many ISPs won't do anything if you report the "attacker" for >the simple fact that it's not really a security issue. I see WAY too many >posts on the @Home-"security" newsgroups where people post their ZoneAlarm >logs only to see that all of the attempts have been blocked. I honestly think >firewalls on Windoze systems (not including Windows NT/2K) is useless. Before I went to a hardware solution, I was using Zone Alarm (properly configured) and black ice, and getting pretty good results from most ISPs. I didn't get many attempts from @home subscribers, other than the "authorized.... " scan which presumably is done by @home, looking for servers. Of course, anyone can call themselves "authorized..." so it's pretty exploitable. Now, with the linksys router, I'm (AFAIK) secure. I'd be interested in any information to the contrary. 24.4.165.200 is where I'm at. -- Where's dave? http://www.findu.com/cgi-bin/find.cgi?kc6ete-9 -- http://www.piclist.com#nomail Going offline? Don't AutoReply us! email .....listservKILLspam.....mitvma.mit.edu with SET PICList DIGEST in the body

In a message dated 12/31/00 11:59:34 AM Pacific Standard Time, EraseMEdvanhornspam_OUTTakeThisOuTCEDAR.NET writes: > Now, with the linksys router, I'm (AFAIK) secure. > I'd be interested in any information to the contrary. > 24.4.165.200 is where I'm at. > ...sounds like a HoneyPot to me <vbg>. The LinkSys router is pretty secure, much better solution than ZoneAlarm. Just make sure you stay on top of the firmware upgrades =) Regards, Tim Hamel -- http://www.piclist.com#nomail Going offline? Don't AutoReply us! email listservspam_OUTmitvma.mit.edu with SET PICList DIGEST in the body

> >...sounds like a HoneyPot to me <vbg>. The LinkSys router is pretty secure, >much better solution than ZoneAlarm. Just make sure you stay on top of the >firmware upgrades =) I used to do the "two net card" solution, but that made every other pc's access dependent on the gateway PC being up. Windows being what it is.... The Linksys box just runs. :) -- Where's dave? http://www.findu.com/cgi-bin/find.cgi?kc6ete-9 -- http://www.piclist.com#nomail Going offline? Don't AutoReply us! email @spam@listservKILLspammitvma.mit.edu with SET PICList DIGEST in the body

In message <KILLspam4.3.2.7.2.20001231145101.021ffca0KILLspammail.cedar.net>, David VanHorn <RemoveMEdvanhornTakeThisOuTCEDAR.NET> writes >Before I went to a hardware solution, I was using Zone Alarm (properly >configured) and black ice, and getting pretty good results from most >ISPs. I didn't get many attempts from @home subscribers, other than the >"authorized.... " scan which presumably is done by @home, looking for >servers. Of course, anyone can call themselves "authorized..." so it's >pretty exploitable. > >Now, with the linksys router, I'm (AFAIK) secure. >I'd be interested in any information to the contrary. >24.4.165.200 is where I'm at. If you go to Norton's website http://www.norton.com there is an option to run a security scan on your Internet connection, it may be worth running that to see what is says?. I run Norton Internet Security, and the test told me to alter my netBEUI settings, Windows apparently leaves a big security hole with it's default settings. -- Nigel. /--------------------------------------------------------------\ | Nigel Goodwin | Internet : spamBeGonenigelgspamBeGonelpilsley.co.uk | | Lower Pilsley | Web Page : http://www.lpilsley.co.uk | | Chesterfield | Official site for Shin Ki and New Spirit | | England | Ju Jitsu | \--------------------------------------------------------------/ -- http://www.piclist.com hint: To leave the PICList TakeThisOuTpiclist-unsubscribe-requestEraseMEspam_OUTmitvma.mit.edu

> >If you go to Norton's website http://www.norton.com there is an option >to run a security scan on your Internet connection, it may be worth >running that to see what is says?. I run Norton Internet Security, and >the test told me to alter my netBEUI settings, Windows apparently leaves >a big security hole with it's default settings. It can't even scan me. -- Where's dave? http://www.findu.com/cgi-bin/find.cgi?kc6ete-9 -- http://www.piclist.com hint: To leave the PICList RemoveMEpiclist-unsubscribe-requestTakeThisOuTmitvma.mit.edu

> If you go to Norton's website http://www.norton.com there is an option > to run a security scan on your Internet connection, it may be worth > running that to see what is says?. I run Norton Internet Security, and > the test told me to alter my netBEUI settings, Windows apparently leaves > a big security hole with it's default settings. Unless you are on a LAN netBEUI is NOT a security problem for a net connected computer since the net only understands TCP/IP. TTYL -- http://www.piclist.com hint: To leave the PICList piclist-unsubscribe-requestEraseME.....mitvma.mit.edu

Netbios (Netbeui) over TCP/IP is a problem though. On Mon, 1 Jan 2001 11:35:55 -0500, Herbert Graf wrote: {Quote hidden}>> If you go to Norton's website http://www.norton.com there is an option >> to run a security scan on your Internet connection, it may be worth >> running that to see what is says?. I run Norton Internet Security, and >> the test told me to alter my netBEUI settings, Windows apparently leaves >> a big security hole with it's default settings. > > Unless you are on a LAN netBEUI is NOT a security problem for a net >connected computer since the net only understands TCP/IP. TTYL > >-- >http://www.piclist.com hint: To leave the PICList >EraseMEpiclist-unsubscribe-requestmitvma.mit.edu > > > Ivey Cole RemoveMEicoleEraseMEEraseMEonr.com -- http://www.piclist.com hint: To leave the PICList RemoveMEpiclist-unsubscribe-requestspam_OUTKILLspammitvma.mit.edu

In message <RemoveMENAEALEBPNOHNGKFACEHAOEGMDCAA.mailinglistTakeThisOuTspamfarcite.net>,> Herbert Graf <EraseMEmailinglistspamspamBeGoneFARCITE.NET> writes >> If you go to Norton's website http://www.norton.com there is an option >> to run a security scan on your Internet connection, it may be worth >> running that to see what is says?. I run Norton Internet Security, and >> the test told me to alter my netBEUI settings, Windows apparently leaves >> a big security hole with it's default settings. > > Unless you are on a LAN netBEUI is NOT a security problem for a net >connected computer since the net only understands TCP/IP. TTYL I have a number of computers networked together, the Norton scan detected this and their website explains why it's a security risk, and how to prevent it. -- Nigel. /--------------------------------------------------------------\ | Nigel Goodwin | Internet : RemoveMEnigelgKILLspamlpilsley.co.uk | | Lower Pilsley | Web Page : http://www.lpilsley.co.uk | | Chesterfield | Official site for Shin Ki and New Spirit | | England | Ju Jitsu | \--------------------------------------------------------------/ -- http://www.piclist.com hint: To leave the PICList piclist-unsubscribe-requestSTOPspamspam_OUTmitvma.mit.edu

> Netbios (Netbeui) over TCP/IP is a problem though. True, netbios over TCP/IP is bad (it opens port 139 and allows alot of info to be retrieved, possible even file shares) however, netbios and netbeui are two different animals, one has no direct relation to the other. TTYL {Quote hidden}> On Mon, 1 Jan 2001 11:35:55 -0500, Herbert Graf wrote: > > >> If you go to Norton's website http://www.norton.com there is an option > >> to run a security scan on your Internet connection, it may be worth > >> running that to see what is says?. I run Norton Internet Security, and > >> the test told me to alter my netBEUI settings, Windows > apparently leaves > >> a big security hole with it's default settings. > > > > Unless you are on a LAN netBEUI is NOT a security problem for a net > >connected computer since the net only understands TCP/IP. TTYL > > > >-- > >http://www.piclist.com hint: To leave the PICList > >spamBeGonepiclist-unsubscribe-requestSTOPspamEraseMEmitvma.mit.edu> > > > > > > > > Ivey Cole KILLspamicolespamBeGoneonr.com > > -- > http://www.piclist.com hint: To leave the PICList > EraseMEpiclist-unsubscribe-requestEraseMEmitvma.mit.edu > > > -- http://www.piclist.com hint: To leave the PICList @spam@piclist-unsubscribe-request@spam@spam_OUTmitvma.mit.edu

Unless you are on a LAN netBEUI is NOT a security problem for a net connected computer since the net only understands TCP/IP. TTYL I believe that netbios over TCP/IP is enabled by default in all win9x systems that run both TCP/IP and netbios, and that netbios/ip inherits a lot of stuff from the "netbeui" configuration (netbeui is netbios directly over ethernet framing.) BillW -- http://www.piclist.com hint: To leave the PICList spamBeGonepiclist-unsubscribe-requestKILLspammitvma.mit.edu

I believe it meant NetBios settings. -- Mitch -----Original Message----- From: pic microcontroller discussion list [.....PICLISTspam_OUTMITVMA.MIT.EDU]On Behalf Of Herbert Graf Sent: Monday, January 01, 2001 10:36 AM To: TakeThisOuTPICLIST.....TakeThisOuTMITVMA.MIT.EDU Subject: Re: [OT]: Security warning: Stop the crazy script-kiddie scanning the > If you go to Norton's website http://www.norton.com there is an option > to run a security scan on your Internet connection, it may be worth > running that to see what is says?. I run Norton Internet Security, and > the test told me to alter my netBEUI settings, Windows apparently leaves > a big security hole with it's default settings. Unless you are on a LAN netBEUI is NOT a security problem for a net connected computer since the net only understands TCP/IP. TTYL -- http://www.piclist.com hint: To leave the PICList TakeThisOuTpiclist-unsubscribe-requestKILLspamspammitvma.mit.edu -- http://www.piclist.com hint: To leave the PICList .....piclist-unsubscribe-requestRemoveMEmitvma.mit.edu

Don't forget about port 137, too. -----Original Message----- From: pic microcontroller discussion list [RemoveMEPICLISTspamBeGoneMITVMA.MIT.EDU]On Behalf Of Herbert Graf Sent: Monday, January 01, 2001 1:31 PM To: spamBeGonePICLIST@spam@spam_OUTMITVMA.MIT.EDU Subject: Re: [OT]: Security warning: Stop the crazy script-kiddie scanning the > Netbios (Netbeui) over TCP/IP is a problem though. True, netbios over TCP/IP is bad (it opens port 139 and allows alot of info to be retrieved, possible even file shares) however, netbios and netbeui are two different animals, one has no direct relation to the other. TTYL {Quote hidden}> On Mon, 1 Jan 2001 11:35:55 -0500, Herbert Graf wrote: > > >> If you go to Norton's website http://www.norton.com there is an option > >> to run a security scan on your Internet connection, it may be worth > >> running that to see what is says?. I run Norton Internet Security, and > >> the test told me to alter my netBEUI settings, Windows > apparently leaves > >> a big security hole with it's default settings. > > > > Unless you are on a LAN netBEUI is NOT a security problem for a net > >connected computer since the net only understands TCP/IP. TTYL > > > >-- > >http://www.piclist.com hint: To leave the PICList > >TakeThisOuTpiclist-unsubscribe-requestspammitvma.mit.edu> > > > > > > > > Ivey Cole icoleEraseMEonr.com > > -- > http://www.piclist.com hint: To leave the PICList > RemoveMEpiclist-unsubscribe-requestEraseMEspam_OUTmitvma.mit.edu > > > -- http://www.piclist.com hint: To leave the PICList @spam@piclist-unsubscribe-requestRemoveMEEraseMEmitvma.mit.edu -- http://www.piclist.com hint: To leave the PICList EraseMEpiclist-unsubscribe-request@spam@mitvma.mit.edu

On Sun, 31 Dec 2000, David VanHorn wrote: > > > >...sounds like a HoneyPot to me <vbg>. The LinkSys router is pretty secure, > >much better solution than ZoneAlarm. Just make sure you stay on top of the > >firmware upgrades =) > > I used to do the "two net card" solution, but that made every other pc's > access dependent on the gateway PC being up. Windows being what it is.... ... and that would be "totally unsuitable for a firewall", right? 8-) I've been using a Linux box with ipfw and now ipchains (finally) for about three years now. 10Mb NIC for the cable modem side, 100Mb for the house side, running Samba, dhcpd, etc. It's my Web server/mail server/firewall/gateway/NAT/file server/tape backup/Xwindows machine, and it's only been rebooted when I've done it on purpose for kernel upgrades, hardware fixes, etc. It's currently a 200MHz Pentium-MMX with 96MB of RAM and an 8GB SCSI-2 drive, which is way more than adequate for the job, though sadly underpowered for Windows. It's not a solution for the technically inept, though, and from what I've heard the LinkSys box is great for that. Please don't take that to mean anything other than what I said... if I weren't fond of playing with my own systems, I'd use one. I figure I need a firewall, need a server, kill two birds with one stone, but I'd certainly never suggest it's the way for everyone to go. Dale --- The most exciting phrase to hear in science, the one that heralds new discoveries, is not "Eureka!" (I found it!) but "That's funny ..." -- Isaac Asimov -- http://www.piclist.com hint: To leave the PICList @spam@piclist-unsubscribe-requestspam_OUT.....mitvma.mit.edu