Slashdot Mirror
Excite@Home Claims Broadband 'Safe'
photozz writes: "Ya know it's rare when an article can get me angry, but this has managed. Cable provider Excite@Home claims that their users are 'relatively' free of attack from hackers due to DHCP, and say you should only be concerned if they are storing private information on their PC's. From the article:'The fear created in consumers' minds is actually greater than the risk that exists,' he said. 'If a customer operates the computer in a safe manner, there shouldn't be any problem.'" Perhaps not surprising that @Home would downplay the risk, but photozz is right -- the fear in broadband customers' minds ought actually be higher, not lower. BackOrifice, zombie attacks etc., ought to frighten the broadband providers into pushing at least simple firewall software themselves perhaps.
This seems to me like an issue centered around money (as always). The less people fear broadband, the more likely they are to use it with their machines. To really make their customers feel safe, a broadband provider should at least offer a howto for installing windows security software (zonealarm comes to mind).
/proc/sys/net/ipv4/icmp_echo_ignore_all
But even with a download link saying "this software is not supported by " a large ISP would still have to dedicate a large amount of their tech support time to help people install and configure the software. Since most large companies are cheap bastards when it comes to things like this, it's no suprise that they lie about the security of their network instead.
chris
# turn off icmp replies to confuse skript kiddiez
echo 1 >
@Home does NOT probe/scan for people running servers proactively. In fact, when I was with them I tried to get a project approved that would allow me to do some portscans and track down the user with the rogue DHCP server that was bringing our network down. The word that was handed down from upper managment was a very emphatic *NO*.
Apparantly they not only didn't scan the network, but they were so against it that they would rather see the network down than invade users privacy(My best guess at reasoning. Another reason may be that they were suit-monkeys and had no clue what it was other than "bad").
Thank you for furthering my point.
Javascript + Nintendo DSi = DSiCade
I have a few friends that use @Home's cable service in the Southwestern Virginia (USA) area w/ Linux. This might only apply to Cox@Home, but their TOS state that they are not allowed to have any servers running. We think this is an effort to keep people from running insecure servers (like the exploited wu-ftpd 2.6.0 that ships w/ Red Hat 6.2) which can be cracked, and then their server can be used to start a DoS attack. In fact, @Home dropped a server in their subnet to scan all the clients for open ports. They got TOS'ed when the scanner detected their SSH servers running and were asked to shut them down w/n a week or lose their connection.
There are probably two other reasons why @Home's TOS include the "no servers" clause:
Bandwidth availability: I live in the dorms at Virginia Tech, and a large portion of the on-campus LAN bandwidth gets sucked up by users trading large files (MP3s, bootleg movies, ISOs, etc.) using the horribly bandwith-intesive Windows file sharing (the SMB protocol). While on a 10Mbps switched LAN this isn't too much of a problem, it can bring a network of cable modems to its knees.
CYA: If the RIAA goes after @Home b/c it willfully allowed the illegal distribution of copyrighted material, @Home is gonna quickly die a painful death, and a lot of people are gonna be lacking a high-bandwith connection.
The idea is worth merit and makes sense from a business standpoint when you think about it. I'd rather not go into that, though; this reply is already long enough. ;)
DHCP is actually a weakness for a well trained hacker. In case you haven't read some of the papers i direct you to:
e rs/503011.html
http://www.3com.com/technology/tech_net/white_pap
Basically describes how a well trained hacker can act as a dhcp server therby giving the victim whatever ip it wants or worse give it a DNS server run by the hacker which opens up all kinds of possibiltys(i.e. fake websites, ftp sites, you nameit).
Time is Change.
EVERYONE with a "broadband" (ie. faster than 56k) connection should IMMEDIATLY follow the following steps:
:)
1) Install Linux, FreeBSD, or GNU.
2) Connect to the Internet.
3) post your hostname and root password on Slashdot.
4) wait.
yup, XX-31337.whatever.home.com will magically point to your IP - even if it changes.
I'd do this just to see what happens...
Nevermind
Verbatim
Price, Quality, Time. Pick none. What, you thought you had a choice?
Want to protect yourself? Disable file and print sharing, don't accept files from people you don't know, scan for viruses every so often, and avoid emails with a subject line of "I Love You". It really is that simple, believe it or not.
Yes it is. That is called 'user education'. Something that is sorely missing if @home says there are no security hazards.
Javascript + Nintendo DSi = DSiCade
When I tried contacting their support to see if they could recommend a firewall or other protection, I was told they have no recommendations. Not that they were protecting me. Not that DHCP was the cat's meow. Nope. Not even an assurance that all was well. Just an emphatic, we have no recommendations for you.
So I did some searching and reading and I found a firewall on my own. But it baffles me that they explicitly choose not to help their customers secure their machines. Dumb, head in the sand policy.
Fine, but you can say the same thing about UNIX if the user is convinced to install a trojan. Furthermore, I don't see how a cable modem makes this any worse. The point is that if you leave your stock Linux machine on the open net (such as on a cable modem), it will probably be rooted as soon as a new exploit is found. Because Windows 98 does not by default have lots of services running and doesn't have a good command prompt, it's harder and a less desirable target for crackers.
Compare this to Linux's web server market share according to Netcraft.
Together, this tells me that Windows boxes are more likely to get cracked than Unix boxes. Of course, the numbers may be different for home systems, but as these are the only numbers I have I'll believe them until something better shows up.
Cheers //Johan
Installed the Bubblemon yet?
Between the proliferation of broadband access, and the way that @home's "service" is structured, I'm extremely surprised that we haven't seen any more seriously massive DDOS attacks-- I'd say that at least 98% of @home's subscriber boxes are sitting naked on the net, just waiting to be bent over.
Five tons of flax.
To date (one month) ZoneAlarm has blocked 139 attempts at unauthorized access.
Only 139? I'm using an analog dialup in Germany (poor me -- no DSL in my area until December) and I get an average of 10-15 hits per day.
Offering DSL or cable to the uneducated masses without at least telling them they should be running at a minimum ZoneAlarm is so fucking irresponsible! If you have a Windows 9x machine on DSL or cable, you're walking naked down Al Gore's Information Superhighway
Doesn't matter what OS you run, if its misconfigured, its not going to be secure.
And likewise, it's not difficult to set up even Win98 so that it's fairly secure. Turning off file sharing in Windows effectively closes all ports. I don't know how someone's going to hax0r a box that isn't listening anywhere.
This is of course assuming the end user is bright enough not to get themselves BO'd or something.
--
Turn on, log in, burn out...
have you ever read the athome.newsgroups? newbies and even no-so-newbies who've just discovered Zone Alarm go completely mental when they get port scanned. I think they're plenty hyperalert over the whole thing as it is.
I too use @home. I run an ipchains firewall with a very tight ruleset. I monitor my logs and I've noticed that @home scans, at least in my area, for port 119 every 4 hours on the dot. It's not just my IP, it's across my area. I have a friend on the other side of town who gets the same scans and we're not even on the same subnet. I know that newsfeeds take up a lot of bandwidth, but damn! The scan originates from 24.0.0.203 which resolves to authorized-scan1.security.home.net. Is there anybody else out there who is getting scanned by @home itself? And if so, what ports?
On top of @home's scanning, I get multitudes of other random scans for various ports. I get the usual scans for port 80,21,23,25,110 all the way from Japan to Germany and from the East to West coast of the US. I also got scanned for port 98(linuxconf) - if you have linuxconf service running you'd better disable it if you don't want to get hacked. Run SSH and get rid of telnet if you need to remotely access your box. It is imperative that anyone who has a cable connection use some kind of firewall. @home is full of shit if they tell you their network is safe. I've known many people, even geeks, get taken out because of some script kiddie or cracker.
I saw those same NetBIOS (port 139) visits on my firewall also when I first got my DSL line. Don't quote me on this, as I may be wrong.... But I think it's whenever some Windoze user goes online with their DSL line, the Network Neighborhood "service" goes out looking for all connected computers on the same subnet, such as: 64.217.216.X, where X can be anything from 0 - 255, and the Net 'Hood checks each one of them to see if anyone is sharing file systems. That's my theory, anyway.... Any one want to correct me or clarify the situation. I'm curious as to what's going on with these port 139 visits if my theory isn't right. Scott ----- A computer without a Microsoft operating system is like a dog without bricks tied to it's head.
I agree. OpenBSD is absolutely beautiful for a cheap home NAT'ing firewall. I found myself one of those nice Siemens Linux terminals (IDT 200MHz Winchip, 64 megs of ram, built in ethernet and SVGA onboard) on an onsale.com auction, popped an old 545 meg hard drive into it and two $15 Realtek PCI ethernet cards (also via onsale) and voila. OpenBSD firewall box complete with onboard third interface for services network. ;-)
:-)
I highly recommend this to even the most bigotted Linux advocates. I was one of them before I tried it. Linux is fine for my desktop box but I'll make damn sure from now on it'll stay behind me openbsd firewall on my DSL.
If you want to disable file sharing on your cable/DSL connection but keep it on your network at home, just go into the Network control panel, find the TCP/IP that's bound to the cable/DSL modem's NIC, go to the properties, hit the Bindings tab, and uncheck the file and printer sharing part. Reboot, and voila.
there are also problems with spammers using cable-modem boxen as mail relay...wouldn't be the first time i've seen that happen...
//rdj
No one can understand the truth until he drinks of coffee's frothy goodness.
--Sheikh Abd-Al-Kadir, 1587
It won't catch everything (calls through the IE interface, whatever it's called ?!), but it stops most things - no, my DVD player is not allowed to talk over the net to those 'PC friendly' people.
-- Trinity in high heels carrying a whip: The donimatrix - there is no spoonerism
I've been on RoadRunner for almost 2 years. I don't think I've had more than 5 IP addresses in that time. About 2 months ago my RedHat 6.2 firewall was getting crashed about every other day. I could see a ton of ftp attempts getting blocked, so I assumed someone published the wrong IP for their warez/mp3z server. I thought I would try to change my IP. The only way I could do it was to swap out the ethernet card and get a new MAC address. I suppose I could have left it shut down for a day or two, but didn't have the time.
Then I moved to OpenBSD and haven't had a crash since. Well, that's not exactly true. I did have one, but once I taped over the power button on that machine, my 1-year old can't pull that trick again.
There is no way I would run my Win2000 or NT4 Server boxes without a firewall. I've got a two-page list of what I need to do to attempt to secure an NT4 or Win2000 web server.
What I'd like is a good, readable, firewall FAQ. I've got an old copy of AtGuard, but I'll be damned if I've been able to slog through its firewall documentation. The best thing I've ever got it to do is block everything but SETI@Home packets.
Five tons of flax.
What about the ever laughed at AOL user? Will @home's claim convince them to use their service?
I think we can agree that the average AOL user has no frickin idea what security is. They foward those spam emails that "look real" to their friends because the email says that there might be a way for bad, bad men to read their files if they run AOL on Saturday afternoon at 3:44 Pacific time.
So, along comes @home with these outrageous claims... who are they trying to convince? They want to convince the kind of person who doesn't want to waste their time finding out if their claim has any basis in technological facts.
These are the same people who go to college and are so excited to get on the ethernet, that they do stupid things like share their C drive to everyone (giving full access to all).
Do these people deserve a wake up call? Yes, but do you really expect them to understand?
"Welcome to the world of technology, please remain ignorant until your kernel has come to a complete stop!"
SETI@home?
Chaos, Mayhem, and Destruction: Not
Sounds like the lines auto manufacturers used to give about car safety, pre-Nader. "Sure it's safe as long as you drive safe." Which is basically saying, "You won't get hurt in a crash if you don't crash." Sigh.
----
----
Am I the only one who thinks Microsoft is a misnomer? Perhaps Macrosoft would be a better fit?
You don't really expect @Home to come out saying that their service is dangerous, do you?
Hey come pay us $40 a month so someone can break into your computer and steal your credit card numbers!
I have DSL through USWest is now Qwest, and to the best of my knowledge, it is pretty secure from the get go.
My DSL 'modem' (would calling it a router be too hard for people?) is a cisco 675. It gets an IP via DHCP from qwest. Howerver, it's internal IP is 10.0.0.1 and all of the other computers on the inside get assigned a 10.0.0.X address via DHCP (from the router). When I want to get to a computer on the inside, i have to open up a port on the router. For example, 23 and 80 go though to my linux box. Is this as safe as I think it is?
---
/bin/fortune | slashdotsig.sh
I've had ATT@home here in Santa Clara for almost 6 months. Even though I have my system set up for DHCP, I've been using the same IP address the entire time. I even ordered an additional address for a second system. The only complaint I have is that they didn't offer any advice whatsoever on securing the system when they installed it. You'd think it wouldn't be that hard to warn new users or install some kind of firewall software. I'm sure they could work out a deal with ZoneAlert or some other provider, but nooo! Luckily we use BlackIce at work, so I knew how many probes a cable system can get in just one day. So on my windows system I use BlackIce, and on my linux system I have all but a few ports closed. It's amazing the amount of intrusion attempts I get. Usually if it's just a few probes, I'll just block the intruder. If attempts continue, I'll email the offender's isp. Probes also seemed to surge whenever I use gnutella - I guess host lists are perfect fodder for the script kiddies.
Or if you must use Windows with file sharing you can always use Zone Alarm...free for personal use.
I have @home cable service and have had people hack my box from remote locations, print up funny jokes on my network printer, and change some of my settings. Go to hell, @home.
> 2 play the same dam song 5 times in 6 hours
yup, they do, but luckly I ownly listen to them ~1 hr a day=)
and it's better than The Bear=)
its safe as long as you don't get ops in #l33tw4r3zd00dz or get someone else's nickname. But hell, I've seen people have their hd's shared with full access without a password. I guess they figure someone can fix the bugs for them. Thats an idea, find a way to install a real OS on their computer when they are away. Then secure it. I should do that....then charge $19.99 a month afterwards....oh wait..then i-opener would sue me. Well shit, I'll just stick with OpenBSD.
Chaos, Mayhem, and Destruction: Not
So true, now what's your IP again???
Dirty Pirate Hooker
DHCP is used as a convenience for the ISP, allowing them to reallocate IP addresses dynamically, but they tend to re-allocate infrequenty. My cable modem has given me the same IP address for over 6 months.
Even if used to re-assign IP addresses on a regular basis DHCP is not a security feature. You box only needs to be up long enough to be cracked. The fact that your box might not be at the same IP address tommorrow makes it a slightly less attractive target, but I am sure a smart cracker could install something that would allow them to find you at whatever IP address you happen to have.
-josh
DHCP makes you safe? That's fairly humorous. As soon as you log onto IRC, some script kiddie has already done an /nslookup on you and started scanning your box looking for holes with some warscript.
... you do *not* want to leave your front door wide open.
I'm currently running an OpenBSD firewall and am pretty happy with it, altho my linux firewall previously did a fine job. The point is to do *something* to keep out the riff-raff.
Sure, the heavy-hitters won't be bothering to crack most DHCP boxes, but their are plenty of kiddies out there that are itching to crack *any* box and make a mess of it.
The Internet isn't some little town where you know everyone
I've been using broadband DSL for quite a while, and some of the things that pass by my firewall are disgusting. I'm not even located on the usual 24.X.X.X range that is often associated with cable modem attacks, and every day I get no less than 10 or 20 attack attempts registered on PortSentry. As we all know, it's a dangerous web out there, and I'd really pity the foo' that doesn't use a dedicated firewall in cojunction with a broadband connection. Safe web surfing is one thing, but let's be serious, folks.
Interested in open source engine management for your Subaru?
or even
NETBSD Firewall project
To put it rather bluntly:
Personal Computer Security is NOT the responsibility of the ISP. If you acquire broadband service in your home - then you have also acquired with it the inherent responsibility to protect your computer system for the would-be hackers of the internet. Why should it be the ISP's problem? They only provide the connection, not the content. By that same logic it seems rather short sighted to turn around and say they must secure your computer from the content you choose.
The term "Personal Computer" means just that - a personal computer. But when you place that computer at a pernament address on the internet - you are taking your chances and it is YOUR responsbility to minimize those chances.
Example: Lets say you buy a new mailbox and leave it sitting on your kitchen table inside your house. Well after a few weeks it becomes apparent that the mailbox is fairly useless without access to the outside world (aka the internet) so you place it on your front lawn and begin to send and receive mail.
So whats happens when some punk kid starts swiping social security checks from mailboxes? Hmmmmmm..... yeah it's illegal but would you even consider blaming the US Postal Service for something that is obviously your problem?(Solution: get a PO Box)
People need to start taking responsiblity. If you have a pernament, fast connection to the internet take the extra time to learn a little about computer security. If you dont want to care about it, or if you cant fathom opening a book and actually finding out just how your computer works, or you are one of those dimwits who actually paid money for an emachine - unplug the network connection NOW.
Too many people in America are content to simply bitch and moan rather than stand on their on two feet and do something about it. Perhaps you guys can solicit the aid of Al Gore - I'm sure he'll be more than happy to put your computer into his precious little lockbox, right along with trillons of dollars in so called Social Security money you'll never see again.
In essence - people have confused the term "Internet Service Provider" with "Internet Sercurity Provider" or perhaps in this case even "Internet Safety Provider".
Gamorck
"Flame at will"
I love idealists not because I am one, but because they make life bearable for pragmatists such as myself.
"Our consumer customers get dynamic IP addresses," said Sean Danes, a spokesman for Pacific Bell DSL, a large DSL provider.
Flame @Home all you want, but don't flame them for the DHCP = security statement. Flame 'em for other stuff, of course. :-)
The skill level of some of these techs is really poor too. When I first got @home a few months ago they sent a tech out to my place. I didn't want to let him near my Linux box (don't think that he would have touched it anyway) and intead let him do his setup thing on my girlfriend's mac. He had a really hard time with that, and we're talking MacOS here not some really oddball alternate OS. Not a chance in hell these guys know what they're doing enough to properly secure machines. I don't trust them any further than I can throw them
What I do think is quite good is an LRP firewall. Charles Steinkuehler has one that I have found to be quite easy to setup and quite secure on his web site. It's really nice to be able to boot the whole router machine from a write protected floppy and know that if someone does start to mess with it you're only a reboot away from a system w/o any root kits left behind by some k1ddy. Also included are a DHCP server, NAT, and port forwarding. Well worth checking out.
________________
They're - They are
Their - Belonging to them
I don't want free as in beer. I just want free beer.
dis dude really know his shit!!!
It doesn't matter what IP you have when people are portscanning:
24.112.*.*
The IP blocks of @Home connections are WELL known and are scanned constantly by hax0r dudes across the planet.
Just treat @Home as a hostile network environment, and act accordingly.
How about this ghastly idea, turn off the computer when you are done? Good gods, save energy? just to wait for a boot up??? What are you a wierdo?
I re-iterate. if you dont know basic computer use then you have NO BUSINESS OWNING ONE!
Do not look at laser with remaining good eye.
Anyway, the point I was trying to make (badly) is that if you're going to maintain a constant connection to the Internet by all means run some type of firewall if you don't want to get your box compromised. I use ZoneAlarm and couldn't be happier with it. I just passed the Port Probe and "Sheilds Up!" tests at grc.com with flying colors. Some of the scans ZoneAlarm protects me from (as reported by the security checks at GRC):
- Your Internet port 139 does not appear to exist!
- Unable to connect with NetBIOS to your computer.
- Port 21
FTP
Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!
- 23
Telnet
Stealth! There is NO [...]
- 25
SMTP
Stealth! There is NO [...]
- 79
Finger
Stealth! There is NO [...]
-
80
HTTP
Stealth! There is NO [...]
-
110
POP3
Stealth! There is NO [...]
-
113
IDENT
Stealth! There is NO [...]
-
139
Net
BIOS
Stealth! There is NO [...]
- 143 IMAP Stealth! There is NO [...]
- 443
HTTPS
Stealth! There is NO [...]
To date (one month) ZoneAlarm has blocked 139 attempts at unauthorized access.--
Have fun: Join D.N.A. (National Dyslexics Association)
That's not what I was getting... I'm in Pittsburgh, and I was getting port 139 queries from DC and New York, not even within 8 bits of being on the same subnet. The Baltimore city paper has an article that says that IP-scanners on port 139 are getting popular with the kind of haX0r who's not even 31337 enough to know about rootkits. I wish the article had been a bit more forceful about placing the blame for this "exploit" squarely on Microsoft's flabby shoulders, but I guess I should be happy they mentioned that MS was to blame at all.
You're right -- it probably has nothing to do with security. It's probably a data cache. That way, each /. reader in Australia on Excite@Home doesn't have to download every single image on /.'s page. You can argue if this is a good thing (faster download times, less overall Internet traffic) or a bad thing (privacy).
:)
I know that there's something like that at my school and I've never had any problems with it. There was a discussion on the PLUG (Purdue Linux Users Group) mailing list about it. Eventually, someone suggested they turn it into a giant porn server, since it probably has a lot of that on it
"Save the whales, feed the hungry, free the mallocs" -- author unknown
Every piece I've ever seen on DSL and cable modems always recommends very highly that you install either a personal or true firewall.
This spreading of un-FUD is purely the marketing droids trying to get as many people as possible on this new service. But not letting people aware of the risk is IMHO highly unresponsible.
If they tied up with Norton and their personal firewall software for Windoze they'd do something. Maybe they could subsidise the software or even up the price a bit to encourage responsible use of the broadband access. While this doesn't help the Apple or *nix user but an old 486 only costs a little which would be fine for a firewall.
I guess they are trying to down play the risks, but have too far in doing so. Its very fine balance they have to tread but I'd say they are on thin legal ice on this when your machine gets used in a DDOS attack...
But what about the security. thats what we are talking about.
Chaos, Mayhem, and Destruction: Not
the dhcp is useless, they are simply running out of 24.xxx.xxx.xxx addresses so they are making everyone switch to dhcp just so they are fully switched over when they need to start using the dynamic ip address. so if your with at&t@home you will always get the same ip addres.. well for the time being. and your cable modem will ALWAYS have the same ip address.
I'm using linux as a desktop with @home and it's great. It was a pain in the ass to set up, but once i got it running everything was fine!
bunch of kiddies get their systems together in one room and try to blow the hell out of eachother in Quake arena.
Dirty Pirate Hooker
I don't think the Slashdot people are pissed off that their ISP isn;t taking care of this for them, I think its more the fact that they are angry on behalf of the computer newbies being lied to by cable modem companies - in that spending more time and bandwidth on the net doesn't increase risk, when clearly it does.
A default winbloze98 install offers about as much protection as a chickenwire condom.
Do you hate other human beings?
Ewige Blumenkraft!
Telstra BigPond in Australia firewall port 139, in an attempt to stop the 'qaz' worm that was running around their network not so long ago. See this article on Whirlpool for the e-mail Telstra sent out to members.
That being said, many cable modem brands actually support encryption inherent to their functionality, so they are more secure in many cases that a simple little xDSL modem. I work with both technologies, and know each fairly well from both a network admin and operations perspective. The main point that shouldn't be forgotten is that is users operate their computers properly there will rarely have problems. That means no wide open File and Printer Sharing, don't be a slut with your email (if you randomly open attachments then you deserve what you get - including Back Orifice), take a little initiative to keep abreast of the goings on in the computer world, use a virus scanner, etc. The problem isn't broadband Internet access, the problem is users with poor habits. There is no reason to slam E@H for these statements even though they may be a little naive - users have to take some responsibility for themselves, dammit.
perl -e 'print $i=pack(c5, (41*2), sqrt(7056), (unpack(c,H)-2), oct(115), 10)'
Isn't that pretty standard cracker practice? Don't a lot of "script kiddies" crack into machines just for fun and to use them as IRC bots?
I'm an @home user. Before I learned the value of having a firewall (LRP rocks!), I was cracked once (IMAPd) and had my DNS killed (BIND buffer overflow; killed the daemon but didn't get root-kitted).
Based on my friends logs, an @home customer can expect constant port scans.
Don't get me wrong - I like the service; people just shouldn't run unsecured systems. (For that matter, nor should you leave the keys in your car. ;-)
If your O/S is inherently unsecure (like Windows), I would definetly employ a firewall. I use LRP (I like the control), but I know folks having good luck with those cute LinkSys units.
I work for a major ISP that offers DSL service, and we use DHCP to allocate IP addresses. We do this because it's a pain to type in your IPs, particularly for mobile users, and because it does help allocate IP addresses a bit more efficiently. It's not a protection against someone who scans a pool of IP addresses looking for open shares, as the "911 Worm" did some months ago. Just for IP allocation, that's all.
sulli
RTFJ.
Who cares? Just pirate the IP address that you have now and set it as a static one.
________________
They're - They are
Their - Belonging to them
I don't want free as in beer. I just want free beer.
At least you guys dont have to deal with charter cable. They have bocked all incoming ftp, smtp, and http instead of booting customers who serve. And they did this without a warning.
PS. Their throughput sucks.
Kan jeg få en pils, vær så snill?
Use common sense. I use AT&T@Home. I have portsentry on almost every conceivable port, including 21, 22, and 23. SSH is the only service running, and on a completely different port. (Portsentry = Access a port and it performs an action on their IP, and in my case, it firewalls them). I'm running FreeBSD, and have over 200 entries in my firewall. Some were obviously false IP's, (111.111.111.111), but the person apparently didn't try to portscan me again. Yeah, portsentry isn't some god-send or anything, but it sure as hell helps.
Yeah, right! (With appendum due to shameless karma whoring)
political_news.c: warning: comparison is always true due to limited range of data type
ADSL provided by BT here in the UK is bad, bad, bad.
The stuff for home users (ie, the stuff that's cheapest) uses NAT on the modem, and you've no choice about it.. and you can't (AFAIK) configure it. (It's bad in other ways too, of course.. like being USB-only and expensive)
Horrible! No servers at all.. if I had DSL or cable I'd want to be running my own mail server, at least.
It's one thing to protect the clueless people, but it's no good when it also cripples those who do know what they're doing.
If ISPs are going to use firewalls to block connections, then it needs to have the option to opt-out (I'd have it on by default to catch those too clueless to help themselves), so that people can use their connection how they like, and take their own risks.
I'd love to be able to get broadband here, but I don't know if I'd bother if they were going to put in random portblocks.
Given the increasingly wide availability of broadband, and the fact that Linux has such a solid firewall built-in in the forms of ipchains and especially the forthcoming iptables in 2.4...
Why not offer to auto-setup a basic firewall during the 'workstation' install?
This would be massively helpful to the many newbie Linux users, handy for those of us with not much time on our hands, and would be a great boost to the reputation of the distro as secure-by-default. It is, after all, not that difficult for a setup program to simply deny all incoming SYNs on all external interfaces, but is beyond many who are new to Linux.
Given that those of us who would find this a problem are also probably those who are confident enough to mess with ipchains/iptables anyway, I can't see how this could be a disadvantage.
So, Red Hat, Mandrake, Debian et al.... how about it?
HOw about adding ALL: ALL to /etc/hosts.deny? Is there a way around that?
Unfortunately, it also locks yourself out of services you might want, such as lpd or X. Then you have to set some permissions in hosts.allow, and there are way to spoof even localhost.
Alos install port sentry, soon as someone portscans you they'll be locked out by the time they reach port 20.
Sooner if it's set up properly. However, a lot of the scans that hit me came from people looking for open Netbus ports. Got the occasional scan looking for something else once in a while, along with the usual Wingate detection from IRC servers and @home scans for open NNTP ports.
Since when do viruses appear in text files? When I type "vi LIFE-STAGES.TXT", will my computer explode?
It a trojan that affect mIRC only. It relies on people accepting the file, usually because they have auto-DCC set to on. Really annoying, even for those of us who actually check what gets sent to us before accepting it.
In windows, if you share (for example), your mp3 directory, as world readable, is there an exploit?
Not sure, but it wouldn't surprise me to find out one shared directory can be used as a jumping-off point through the use of an exploit to fool Windows into thinking a remote viewer is, in fact, local. It's the same reason *nix people shut down nfsd; you don't even give potential attackers the opportunity to get a beachead on your system.
A healthy dose of paranoia is acceptable, but is it worth reducing usablility?
An ounce of prevention is better than a pound of cure.
-------------
Someday, you're going to die. Get over it.
The DHCP remark was made by a DSL provider, NOT by EXCITE@HOME. The @HOME representative was quoted as saying that their techs take precautions during the installation such as "Disabling file sharing". They also say that people should take more precautions if they have "sensitive information" on their PC, not "private information", and that while Excite@home does not provide such software, they did say that they are willing to help a customer install and set it up to work with their service.
I'm not much of a fan of @HOME's tech support and security policies either(personally I run an ipchains firewall on my @HOME account), but the original poster made a pretty inaccurate review of the article and painted Excite as being more clueless than they actually were.
Don't be too quick to jump on the "bash @HOME's security advice" bandwagon based upon the posters comments. Read the quotes in the article for yourself first, the original poster was way off the mark.
Unix is user friendly, it's just selective about who its friends are.
Not many crackers are going to waste their time scanning @Home subnets looking for Internet newbies that they can screw with. It isn't worth the time and the "kill value" is negligable. How fun is it to kill someone in Quake with a ping of 500+ who is stuck in a corner? The true glory comes from killing the best guy on the map. (Or, in Slashdot's case, from rooting a /. box and posting a story about it.)
Also, let's assume 90+ percent of @Home users run Windows boxes--Win95 and Win98. Even without firewall software, Win32 is much less likely to be cracked than *nix boxes. I'm not trying to start a huge flame war here--but the facts speak for themselves. Look at all the rootkits out there. Look at all the successful cracks. Were the servers running Unix and variants thereof? Probably.
Now I'm not saying that a Unix box can't be properly secured. But the fact remains that more hacker activity is exerted towards cracking Unix and its siblings than Win32 and other OSes--and with good reason: it's easier.
Interesting discussion invited; flames to /dev/nul please.
--
Have fun: Join D.N.A. (National Dyslexics Association)
you should only be concerned if they are storing private information on their PC
/mdroid
Hmpf... ALL information on my PC is private unless otherwise stated...
Not yet. Remember all the talk about John Deutch doing classified work at home on his unclassified computer? What if he had @Home and some foreign government was targeting him... That could get messy right quick.
Because the damn service disconnects so many times, it's impossible to hack a machine that phases in and out of connection ;)
Don't listen to the baloney that @Home dishes
out about incompatibility with Linux. I use
an old 16-meg RAM 486 box with a floppy booted
copy of EigerStein/Linux router/firewall:
http://lrp.steinkuehler.net/
and it has worked perfectly 24X7 since the day
it went online last June.
As a cross-platform software developer, the
client machines on my LAN include Windows
98, NT, and 2000, and a Red Hat Linux 6.1
system. All work great with the Linux router/
firewall. I usually get around 1100 kilobits
(~130 kilobytes) per second on the receiving
bandwidth and you'd never know the router/
firewall was there.
The EigerStein package can either dynamically
assign IP addresses to the client machines,
or you can hardcode them, depending on your
needs. Additionally, like with any other
linux router package, you can pass through
(or lock out) individual ports if you want
to use something like Napster on the client
machines.
There was very little tweaking of the firewall
configuration files to get it working with @Home
and DHCP - the hardest part was figuring out the
real names of the local mail and news servers -
when installed, the @Home tech will simply use
"mail" and "news" as the server names. The
receipt they give you after the install has all
the info you need to figure them out.
Hey i live in stitsville too! well that's where HOME is...I'm in Oakville(toronto) going to Sheridan right now...@home is pretty quick there and DSL is available, though I don't know how reliable/fast it is...
Ya, over the the past 3 years the bear has slowly been turning into Chez 106...
it got a great score on the Slashdot Poll! (Well, it came in fifth after Hemos, but who cares.)
sulli
RTFJ.
Well as a user you'd just set up your network scripts to not use dhcp *anyway*. I do that and point my DNS at my home system, just so that it's more convenient for me.
Try using mail.rest.of.your.dns eg. my dns is c#####-b.stcla1.sfba.home.com so i'll just use mail.stcla1.sfba.home.com ... took me 2 hours to figure that out =]
They're selling you high speed internet access. My DSL provider, CapuNet, displays a very sensible article about security in their customer support section. It basically says, your machine is valuble because it has a high speed connection, so do something to secure it. I agree, and that's all they need to say. It is up to the customer to weigh the risks, rewards, and options and act accordingly.
There are plenty of firewall and security products out there, and if your computer gets comprimised, it is not the fault of the service provider. For those hear on /., probably the one that many would be interested in is the NetBSD firewall solution. If you don't have a machine to dedicate as a firewall, there are plenty of others, including free software like ZoneAlarm. One of the funniest things about this, though, is that a lot of the port scans and other intrusion attempts that people get are coming from their ISP. It would be nice if this was to benefit the customer, but I think it's mainly just to keep an eye on the customer instead.
-N
I agree. I've got one of these myself and it works great.
I work at a large ISP here in scandinavia taking care of abuse and support email/phonecalls.
These new personal-firewall programs are really really starting to piss me off, about 95% of all abuse calls turn out to be either NetBIOS connection attempts from their friends or open proxy scans from IRC servers.
Please go away evil software.
On the other hand, what about the support calls you get when some poor user has his/her system infiltrated because there is no protection there? And anyway, most companies seem to have the ideal way of dealing with software support calls they don't want: "No, no, you don't want to talk to us about that - look, ring this number here and talk to the people who wrote it"
Yes, perhaps my comment was a little definite; but as you say, you have to draw the line somewhere. I choose to draw it in favour of greater potential security, especially having read about all of the people on this site who have had their PC's compromised when using broadband.
Many users of Broadband here is Australia (@Home our Telco's Bigbond) have reported attacks on their systems, Telstra's BigPond service recommends not using TCP/IP at all except for their clable connection. (Me? I'm safe-ish behind my Linux firewall)
Best be careful, you might wind up like Nader being sued by MasterCard for your parody. That said, very nicely done:
Old 486: $50. Geek on a caffeine high: $5, $0 if s/he's already jacked on coffee. OpenBSD or Slackware burned on a CD: $0. A kickass firewall to confound the kiddiez with the latest 'sploits and nmap: priceless.
Cheers,
Slak
Watch all the IM users and Napster users revolt if that happens! There are a few.
The truth shall set you free!
The 24.0.0.0/8 address space is reserved for 'cable modem use' and @home has the first part (24.0.0.0 - 24.23.255.255). Other cable providers have other parts (such as UPC/A2000 here in the Netherlands, who has 24.132.0.0 - 24.132.255.255).
At the last RIPE meeting, the ICANN director told that this special use of 24.0.0.0/8 addresses for cable modems would come to an end since it gave them more hassle and Cable modems aren't that special anymore.
About the story in general: I can only repeat remarks made before. For some reason the "DHCP for security" myth seems to be very active lately.
The Virtual Bookcase: book reviews
Its different cause.. well...
believe it or not... its a social thing.
kinda.
Its more fun to kill people when you can hear their real life counterparts cursing at you, and roger wilco just doesnt cut it. It also gives a "good" excuse to get away from your husbands, wives, kids, or whatever and have a few beers.
The best part is picking out the loser for the event. That poor soul who is so excited to come over, only to find out that somehow his peachy-keen brand new Pentium VI-4GHZ decided to divide by zero for eternity SOMEWHERE between Jefferson St, and Lavalle Ave. The rest of the event for him, is figuring out what went wrong and why it happened to him of all people. You can't buy fun in such volumes as that. Except if you lived in Los Vegas... you can buy anything there.
rosie_bhjp
A radio maverick jumps to internet only. The Future of Rock n Roll
What if i want to be able to open a share to the internet? Maybe it has some kind of security needed to access...
At any rate, claiming that DHCP is protecting customers is outright ridiculous. Modem users have that as well, and they are in more trouble then they commonly think. RoadRunners uses DHCP too, but for the most part, my IP address doesn't change. I've had 2 different onces since sept.
Check out the NetBSD/i386 Firewall Project. Far, far easier for a newbie.
And yes, 15% of the the people who visit that web site do so from the @home domain...
-John
There was a user where I used to work who went mental when his machine was _pinged_. It's dangerous to give Windows users software like Zone Alarm or Norton Personal Firewall...
-- Ed Avis ed@membled.com
I should bill the ZoneAlarm vendor for all the time I have spent supporting their users.
I fear that ZoneAlarm and lame Windows firewalls like it will only increase in use with time - and more articles like this.
Edith Keeler Must Die
I have an @home cable connection. Its' really the only available broadband in my city, from what I've been hearing, the local telco has made a real mess out of thier DSL service.
I have had an Open BSD box up as a firewall / router for about 2 months now. I didn't really put a lot of thought into my firewall rules because I wasn't especially concerned about someone comming after me. I just put together someing basic, killed everything I didn't need running and turned on ipmon.
Last week I decided to start messing with ipsec to see if I could set myself up a connection to work and I noticed I was just about out of friggin disk space. On a 1 gig drive!
I'm far from an expert on this stuff but near as I can figure I've been port scanned about 4 times a day the whole time the firewall has been up.
Time to learn more about firewall setup. Ain't life in 24.x.x.x great?
Elf Bowling, a holiday-themed bowling simulator for Windows, was not a trojan. There was a hoax going around that it carried a virus, but this proved to be false. Either way, you can pick up a clean copy of the latest version here.
Will I retire or break 10K?
What's the value of an average user's Windows box?
Perhapse a script that runs through open shares looking for a default install of financial software and harvesting the user's data. Maybe the script harvests cookie.txt files and scans them for common online bank identifications. Imagine the wealth of information an identity theif could have waiting for them after a day or two running such scripts.
Maybe the data itself isn't interesting. Instead we have a host with a broadband 24/7 connection. Relatively insecure. Perfect DDoS server host.
Of course... that's assuming the value is something that normally makes sense. Its great that you mention Quake. Quake cheats are relatively rampant. Why bother playing if you're playing with an artificial advantage - and one that's been "done" before? Yet it happens all the time. In the same line, you have skript kiddies who see themselves as something special if they can poke around, and maybe even delete, some unsuspecting target's files. The fact that it may have been trivial to do so means nothing to them.
The article opens up with the example of an unknown individual posting messages on target machine's WINDOWS desktops. Apparently enough of a customer base was affected by this "attack" to warrent a FBI investigation.It doesn't matter what OS you're using. It doesn't matter if your IP address is constantly moving. Connect a box up to a broadband, persistant connection and it is a target. Being unaware of this is the danger.
Step 4: visit www.dubbele.com
:-)
I may not be a Geek on a caffeine high, but that firewall is priceless - free, that is
-John
The last thing i want is to see PPPoE or some similar dumbing down of my @home just because joe moron down the street left an open share on his machine and had his goat porn collection deleted.
Right now I have a static ip, no @home firewall, and optional http proxy (which I don't use).
The hands *off* approach taken by rogers@home is what has kept me with them. Sometimes I wonder how long it will be before too many idiots make too much noise and @home implements a moron lockdown. I guess when that happens i will have to take the leap to shell out 4-5 times more cash for a commercial connection.
As for the original poster, buddy you don't know how good you have it... shut your piehole before you force @homes hand.
- Toby
A negative is that it is difficult (if not impossible) to host a Quake3 server. I haven't tried to get one going but I know people have had a lot of difficulty with it. You can join Q3A and Starcraft games just fine however :-)
For my Windows machine I also use the free ZoneAlarm software, which allows you to control incoming and outgoing connections.
The net as we know it today (unlike the French Minitel of the 80's) doesn't encourage people to put up services. Articles like this; slow adoption of IPv6 by legacy O/S's; it's all part of a general disempowerment consumers are experiencing that favours plans like .Net and hotmail that centralise their information in other people's hands when they should be accessing it from their own machines. Why should I use .Net/hotmail when I can get at my own machine over a constant IPv6 address in a secure manner?
to its DSL subscribers. Only for Windows and MacIntosh, so I can't use it (I run OS/2 with Injoy Firewall, and Linux). Here's their letter:
@ ix.netcom.com
Subject: EarthLink DSL Members - Free Personal Firewall Software
Date: Thu, 19 Oct 2000 17:27:45
From: "EarthLink Broadband Team"
To:
Dear EarthLink Member,
EarthLink cares about keeping your information secure, which is why we're
pleased to offer personal firewall software FREE to our DSL members. Personal
firewall software monitors all Internet connections to and from your computer
and alerts you to attempted intrusions.
This special security package, valued at over $49.95, includes either Symantec
Norton Personal Firewall 2000 v2.0 for Windows users or Open Door DoorStop
Personal Firewall 2.0 for Macintosh users. Both of these powerful software
offerings provide security for your PC and privacy for your personal information.
In order to register for a digital coupon and download your free copy of
personal firewall software, please click on the link below.
http://www.mindspring.net/cgi-bin/dsl.pl?ramunro1
After you are registered, you will receive your digital coupon for your
free software in 2-3
business days.
Please Note:
-You must be an EarthLink DSL customer whose service is currently activated.
If your DSL service is not currently active, you will become eligible for
this offer upon activation.
-This offer includes one copy of either PC or Mac personal firewall software
per DSL account.
Thank you for choosing EarthLink DSL.
The EarthLink Broadband Team
This is a nice example of window security is the following worm. Or how about password passing? The only reason windows machines aren't cracked so often is that are not so easy to use remotly as Unixen. Windows 2000 is about to change this....
signatures pending - ansa@kos.to - (dont mail there)
...I let everyone know how vulnerable their computer is to attack due to the fact that they're now on a LAN and the connection is more or less permanent. DHCP isn't a security feature, it's done for the convenience of us installers. We end up hard coding or statically coding about 30 percent of computers ourselves since dhcp can be a moody bitch. I always tell people to get a firewall and will download, install and configure it for them if they seem like complete idiots. @Home needs to strike a deal with NetworkIce or someone to make it a part of their software package. I did an install last week where some guy had anticipated his install, done his homework, and had an unopened copy of Blackice on hand. I was impressed. @Home isn't a bad service but they do need safeguards in place. They don't push security to their customers because they don't want to breed paranoia in them. Luckily, everyone that trains with me gets to know the importance of firewalling and security and inform customers of the risks of broadband.
no this is not true it may last a while most likely it wont though during the next audit they will most likely check your traps, when they discover they you dont have any, your theft of cable will soon stop however, this does depend on how busy and how thorough the persons performing the audit are.
Sadly yes,
We at @Home are working on a better way to educate our user base but yes you can't save every one and still believe in personal freedom.
Erik
@Home
Personally I think it's up to the home user to make their network or computer secure. There's little difference between what companies like Excite@Home provide and what UUnet and Genuity (or any T1/T3 service providor) provides. I like that, it means that my broadband connection to the internet is more direct and if I don't want to block a port, I don't have to. I don't want to see AT&T blocking ports left and right just because Joe User has no password on his computer. Suppose I have a secure way to open up port 80 or 139? What if I *want* to run a web server. The responsibility of making a computer secure has always been in the hands of it's administrator, and it should stay that way.
Please stop doing that. ZoneAlarm is prone to false alarms, I get 3 or more reports of false alarms regarding "scans" from my network every week. It's downright depressing to think people use and trust crap like this. For God's sake, scans coming from port 80 or 443 right after having visited our site, are flagged as scans by this ZoneAlarm POS, according to the misguided abuse reports I get. If I have to explain TCP handshaking to another @home clueless newbie, I am going to scream.
Edith Keeler Must Die
Not at all @home was founded by people who do not believe in the "Walled Gardens" like AOL or Pac-bell. your connection is never tampered with, we only stop the modem from routing requests or broadcast on 2 known ports, that were never meant to be passed onto the backbone in the first place. To be honest if you don't know how to close your own ports (like 1054) you deserve it ;-)
From another post of mine:
" A small background on Cable modem technology, your cable modem is not a brain dead network bridge with a little compression thrown in like you typical Telco modem or DSL device. A cable modem works as a kind of mini router and as a router can be configured to filter out traffic that broadcasts across your network. Like the infamous Windows file and print sharing broadcasts...
Q: "Why do we do this" you ask?
A: Well think of it this way... you network you are connected to is a data steam, do you really want someone spewing dirt into your clean stream and Rivers... NO. Additionally unsuspecting users systems could be damaged by a uncreative wan bee hacker, remember not all or half our users are techno savvy folk.
This does not mean we are firewalling you in it means we are keeping data that was never meant to go out of the users home networks off your broadband connection. It is wasteful and drives up the cost of your connection"
Erik @home
... and the amount of compromised machines using @home' service is ridiculous. Most of the DDOS servers out there join IRC to allow the 'master' to find the compromised machines easily, and dalnet is quite popular because services can control your channels for you.
I work for a pretty high-profile ISP in the UK and I have tried to contact @home on many occasions regarding DDOS attacks launched from their networks, and all you get is a long message on their answerphone saying "Don't bother trying to contact us, we're dealing with any thing that's wrong, so sod off."
I'm at wits end and are almost ready to lauch a formal complaint to any and all industry complaints boards that there might be.
The company is incredibly unprofessional, and rude. I doubt their technical ability.
chrome.
FYI: the DHCP lease times on cable providers (Roadrunner anyway) is about 2 hours. Anyone running firewall will see a ping from them about once an hour or so to see if your still there. When I asked them, they said they needed to "up" the time to 2 hrs 'cause the "network" folks were screaming about the corporate mandated 15 MINUTE LEASE TIMES. cna you say ping nightmare?
Dirty Pirate Hooker
LOL :-)
Well, I'll be the first to say that @home sucks like no tommorow. I was one of their first beta testers, and had stuck in until half a year ago when I finally couldn't take their ex-taco bell phone support anymore. Having to stay on hold for twenty minutes in order to get transferred to someone who knows what "traceroute" is bites.
However, one thing @home didn't do is silly things like this. Please, you want an ISP to infringe upon your freedom and dictate what kind of traffic can come in, and can't come out? Hey that's nice and all, but I'd rather have the freedom to setup a firewall for myself, I don't need my ISP to do that for me. For a website who talks about freedom so much, this is a pretty bogus idea
Snort alerts me to all the scans done on my network (2 class C's) and every night is at least 2 from @home. And it's not like I ask for it, it's got to be just spanning networks, I don't even allow ping or traceroute to my network.
There are tons of zombie machines on @home
This could cause more harm for their customers...
I have a cable modem that uses DHCP. Every once in a while, I'd see that another remote root exploit was found. I'd pretty much say "Well, I don't really need that. Probably only people running websites, or more important things. I'm using DHCP, and nobody will attack me, anyway".
Then, later, my computer gets rooted. People, ALWAYS update when big security flaws are found! You'll save yourself the trouble of backing up and reinstalling the whole system later on!
-----
"But really, I think life is just a game of Mao Nomic." -Purplebob
No replies made to AC posts. Please log in.
being an AT&T@Home user, I can tell you that their DHCP is both useless and irrtating
a: it simply doesn't appear to work within linux or any other OS besides windows
b: it always assigns the exact same IP address
c: even if it didn't assign the same IP address, because of how the network is organized, the hostname will remain the same
thus, DHCP use on the @Home network, at least in the northwest united states, is a waste of resources
Hi,
I've found my home LAN to be relatively secure. I started with these two things:
One) Purchase a WatchGuard SOHO Firewall/Gateway device. Only $350 at Outpost.com (free overnight shipping!). This little beauty does DCHP and NATs your LAN as well. You can plug 5 machines directly into it, or extend it with a hub. There is also a VPN option if you want it. It is configurable via a web interface, and can basically upgrade itself from their website.
Two) Start running iptables on the 2.4 Linux boxes, and ipchains on the 2.2 boxes. Here is a version of the firewall.sh script that I run to configure iptables to keep the box reasonably safe, without going overboard.
Keep in mind that for these logs to actually be *useful*, it helps if you have the correct time in those logs. Something like NTP is your friend.
-30-
I use the austrialian excite@home, and we get probed every day. It's important to warn consumers about the risks, - don't turn any services on that you can't control, stay up to date etc.
What would be worse would be for the broadband provider to put a big filtered firewall in the way so I couldn't use the internet the way I want.
What might be best is the ability for consumers to choose "safe/protected" mode or "open" mode where we are responsible for our own firewall.
Who the heck moderated this thing up as Informative? It has one link!! To a well-known OS's website, no less!
Here, I'll be more informative:
Linux.com
Linux Kernel
Computer Emergency Response Team (CERT)
Securityfocus.com
Woo-hoo! Now I'll just kick back, relax, and watch the karma roll in...
Let's try not to let fact interfere with our speculation here, OK?
Just as an example, some joker cracked my dial-up Linux box, back in May when I had uswest.net. (They apparently exploited a bug in rpc.statd).
The bad guys WILL find you, DHCP means nothing in terms of security. Buy or build a firewall, or you WILL be sorry.
- Necron69
Optus@home ( an australian cable ISP ) states in their FAQ that
Optus@Home is completely secure if you are using a standard operating system like Windows 98.
I had a good laugh over that one.
:wq
If the ethernet is disconnected, then they cannot get into the system.
Cleara
In Canada, Rogers@Home has a new advertising campain all over TV/Radio saying that cable is safer than DSL.
I laughed out loud the first time I heard it.. ahh well...
I use OpenBSD on my p166 and love it. The NAT works beautifully and I apprecate it not installing a ton of garbage I didnt need. By no means am I saying that this is the only way to go. But I have found that the default install is quite secure and stable and includes exactly what you need for NAT and firewall capability. More so than debian or redhat.
Sure, @Home says they're using DHCP. Every time my system comes up or down, I always get the exact same IP address - it's configured through dhcpcd, but never changes.
In any case, it's easy enough under Linux, since I'm not doing masq or anything - I just closed off basically every service. All that's listening is Apache, SSH, sendmail (no relay), and imapd (but only to 127.0.0.1 for IMP via httpsd).
It's not a perfect setup by any means, but between that, a backup of my RPM database, and tripwire, I'm in decent enough shape.
This goes even beyond the basic insecurities I'm sure you've all already posted about.
I just wanted to let you know just how pointless DHCP is here on mediaone (now AT&T broadband) in Massachusets. The nameserver here allowed me to a ZONE TRANSFER... yes thats right. It handed over a nice list of every host on the network... users and all. And since the names are usually based directly from MAC address, the IP doesn't even matter. This is a serious security problem that I've notified them about...
There's a bug in windows filesharing right now, where the client attempting to connect can specify the length of the password.. Okay, so they specify 1, and that's 256 max to try, 128 avg.
--
Not to plug, but our product Gateway Guardian is a new way of doing firewalls. Not really a "personal" FW, but something that is probably a little more industrial strength (and smart).
When I had my linux box sitting between my cable modem and the outside world, I killed just about every service on eth1(which was connected to the cable modem) except for appletalk, telnet and a couple of others which I wanted to use from work.
Every once in a while I'd get portscanned. No big deal. If it's some script kiddie, if he doesn't see anything interesting he'll just move on. No response to http requests, and any attempted telnets would give the prompt "Login:". No kernel or distro information to give someone an idea about which buffer overflows to try to exploit.
If you've ever carried large amounts of cash through "bad" areas you already know how to play this game. It's called "Blend In", if you look as plain and normal as everyone else, you're not going to attract the wrong type of attention. If you're machine is responding to requests on every port (figuratively, not literally) and you're giving WAY too much information away in your issue.net, you're making yourself far too tempting of a target for crackers.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
Wrong.
They want as many win98 boxes they can get so they can install DDOS floodnet trojans such as Sub7.
1 windows box on a rogers@home link isn't much, but times that by fivehundred, and you have a network of machines that is able to generate an *astounding* amount of traffic.
This is not FUD. This is fact. I see it every day.
chrome.
They are waiting for their prototype router/switch like linksys makes....then the'll say: "HOLY SHIT. YOU DON'T HAVE A FIREWALL?" then proceed to offer you amazing savings on their product with the "no brains, no problem" service. But, thats just my opinion. dhcp is safe? then why were there a few nice exploits for it recently. answer? to even out the playing field for the windoze kids that god Backorifice or Netbus when they got Diablo III beta or some crap off #kr4dw4r3z or some shit. hell i don't know. Time to drink more beer.
Chaos, Mayhem, and Destruction: Not
One of the parameters passed by DHCP is the gateway. If a rogue server passes a bum gateway address, they can route all of your traffic through them, and sniff it all.
Veracity check:
Does DOCSIS prevent this?
On a DOCSIS net, is the gateway essentially a null field, and your head end is always the gateway?
Or can you be spoofed into going through your own head end, and gate through the rogue's system?
The living have better things to do than to continue hating the dead.
You might want to check the IP of the attacks, I was getting about 30 or so a day until I found out most of them were just pings from the provider asking to renew the lease on the IP
Dirty Pirate Hooker
About all that would happen that way is a denial-of-service. Default gateway has to be one hop away. A remote attacker can't specify his own IP address as your gateway, he has to specify another machine on your network. So he can shut you down remotely, but that's about all.
:-)
Now, this attack is useful once he has control of a machine on your network. There are all SORTS of exploits once you have root access to the wire. This is a lot of the reason for the domino effect -- once you lose one machine, your others usually fall over like dominoes because they trust that machine not to be malicious.
Security is a process, not a state. The more secure you think you are, the less secure you tend to be. Andy Grove would love this field -- 'only the paranoid survive'
What the hell? Having a live IP at ANY point means you are exposed. God forbid anyone take any personal responsibility for their own systems and make sure that they are not at risk. Why would an ISP be responsible for your personal configuration at all? Take care of yourselves... dont expect others to do so. Sorry for the rant but that's like asking the government to stop by and lock your doors at night because you'll forget.
I've got cable connections at both home and work, with different ISPs. Both use DHCP. In the last year, my home IP address has changed twice. Maybe 3 times. Work hasn't changed in the 6 months or so since we got connected.
No way I'm trusting either ISP to provide any security. I've got an "un-supported operating system" running in both locations. OpenBSD. SSH ports are the only ones open (most of the time) and I've got a nice ipsec tunnel between the two.
i was just gonna try to piss of the leenuchs kids. who knew that i would get moderated UP for such a simple post?
Chaos, Mayhem, and Destruction: Not
This is total bullshit on so many levels. But one stands out for sure. With DHCP, the users aren't guaranteed they'll get the same address when their lease expires, but they usually do get the same address. A friend of mine has a cable modem through @home and he's had the same IP for the last 3 months. Their lease time is set for 2 weeks too.
Cable modem providers need to hand out a "tell it like it is" pamphlet, and start pushing personal firewall software. There are way too many clueless users out there, and a pamphlet designed to scare the living daylights out of them is just what they need. I suggest ZoneAlarm. It's free and is way better than just about all other personal firewall products, even the ones you have to pay for.
Need Free Juniper/NetScreen Support? JuniperForum
I've had my @Home connection for about three weeks. I'm already spoiled rotten and doubt I will ever be able to go back to a dial-up account. I spent a lot of time securing my PC before I got my modem, so I'm relatively safe. I installed Zone Alarm, shut down any programs that may access the internet, and watched last Friday as I accumulated 500 warnings (the maximum number ZA will log) in about 45 minutes. These were portscans from Universities, other cable modem users, and some internationals.
I'm savvy enough to know how to secure my PC, but I wonder if the average user is. I know if my Mom had a cable modem, I'd be over there once a month to reload her OS.
At least, it's bad if they are clueless. I had a local cable ISP that firewalled to "protect" me, and the only port open was 80. No way to ssh, telnet, ftp, nothing, in or out. I finally got them to open FTP, but it was too little and too late. Also, by providing *any* protection, they may be assuming liability for all customer boxen and become easy lawsuit fodder.
I'm sorry but this article is pure FUD. 98% of all hackers couldn't give a rat's patoot about a personal pc. Win98 boxes are boring. Granted there is a large amout of hacking/cracking being done but it is far from how it is portrayed here. Cripes you guys sound like NAI. your computer will get viruses instantly!!! there are a bazillion virii waiting to attack your PC right NOW!!!! buy our software to protect yourself.
Fearmongers are the worst element of society. and this article trying to say that @home users should be scared shootless that every hacker/cracker is trying to get their pc is pure lies and FUD. I have ran servers with static IP's and have been on the internet for more years than 80% of you and online in some fashon cince 1979 (remeber using 110Bps modems? I DO!). I have NEVER been hacked, and I have NEVER been virused. (I dont run virii scanners and I didn't use a firewall on my servers in the lambdanet.com domain.) If you have a pc on the internet and you dont know how to secure it then you deserve having it taken down by some kiddie and you have no business having it online.
No, thinking that crackers want your computer is pure lies. Shame on slashdot for letting this FUD on the site.
Now if you have lots of porn, then the crackers want you.
Do not look at laser with remaining good eye.
I constantly get scanned by people in my subnet on @home. If I come home from a lan party and forget to turn off file sharing, it's only a matter of a few hours before my system comes to a crawl with people leaching mp3s off of me through network neighborhood. I've even done some myself, printing "You've been h4x0r3d" on a friends printer nearby. That was fun.
I use @home and am well protected. Every port is stealthed. It is too cool for school. I am in a lockbox. No one can find me, much less attack me. Now DSL needs the consumer to provide their own protection...
>"For example," he said, "as part of the >installation process for @Home, we always turn >off a computer's file sharing."
Oh dear me. Please, somebody, tell me this is a joke. No? I think I'm going to become a hacker, 'cause it just got a whole lot easier. If this is a large company's idea of 'anti-hack' security, we have big problems.
These companies need to face facts: End-users don't worry about security. They put credit card numbers in text files; they fiddle with settings and save sensitive passwords by accident. And even ignoring the security aspect - what about the destructive side of hacking?
It should be the responsibility of the company supplying the broadband access to supply and configure a firewall as part of the installation, and explain to the users whay it is needed. Otherwise, no-one will be secure. Simple as that.
Is there anyone else out there that got cable because of a static IP? Arrrrg! The day ATT kills my static IP is the day I drop their cable service.
In any case - The @Home DHCP as such timers that my IP address never gets released... Even afer one week off... Addressing has nothing to do with security
Frankly, it all depends.
$ping mail
PING femail.sdc1.sfba.home.com (24.0.95.81) from 192.168.1.6 : 54(84) bytes of data
cntrl-c killed the useless attempt to get an answer after 5 pings and zero returns. Of course, this won't work if you depend on the @home DNS because it won't be working most of the time!
You will be better off if you can get mail and DNS elsewhere. I use the local university.
Linksys has released several updates for the unit that help it forward ranges of ports instead of a fixed number (used to be 10). That should help you host a game server without any problems, in theory that is.
G
C'mon, the only real reason @home uses DHCP is that it's easier than assigning static IPs for them. It makes their lives easier so that their users have to suffer. Personally, I'd rather have a static IP. If it means I have to setup a firewall to keep the script kiddies away, so be it, but I'd rather have a static IP. I'm not sure how pppoe works, but dhcp will attempt to regain the same IP, so if the users' computer is powered on 99% of the time, then the chances are it'll have the same IP.
Oh and on an off-topic note, @home service varies so much by area, do some research before you invest $50/mo of your hard earned money. I currently have comcast @home in the sacramento area, and the latencies are horrible. Speeds are starting to suffer now as well. After 2 months of back and forths with the @home "technical support", there is still no resolution. Obviously they've TOTALLY maxed out a pipe and/or hub and are refusing to fix it, saying "we're investigating any malfunction in our hardware". Yeah right, it takes 2 months to diagnose poor performance on a traceroute *I* gave them? Like I said, TOTAL joke. Only a couple of more days until DSL is installed, and I can put the nightmare that is @home behind me.
"I drank what?" -Socrates
On the optional (or not) http proxy note... you may want to turn them on because
1. Our proxies do not log so unlike AOL and smaller ISP's we do not resell your site hits to others.
2. We mainly store graphical information files of large content on the proxies to save from you having to (again) waste your connection and @Homes backbone on repeating the same request another user just did. Again is saves bandwidth and is saves Us/You in the end with hopefully soon a reduction in cost.
Erik,
@Home
I know for a fact that @Home tech support will set a static ip address routinely, if they can't get DHCP working quickly. The pressure to get call time down is very high. I don't work there.
but this would be a good time to mention
OpenBSD
Chaos, Mayhem, and Destruction: Not
I see a few people recommending firewalls or routers with a built-in firewall. Whenever this discussion comes up, I always recommend Zone Alarm. It's free (beer, the only one I care about), works great, and is super easy to use. I also like the privacy feature of prompting me when a program is trying to send OUTBOUND packets as well and allowing me to block it.
---
DO NOT DISTURB THE SE
For example, 24.24.0.0 belongs to Time Warner cable.
HOw about adding ALL: ALL to /etc/hosts.deny? Is there a way around that?
Alos install port sentry, soon as someone portscans you they'll be locked out by the time they reach port 20.
Since when do viruses appear in text files? When I type "vi LIFE-STAGES.TXT", will my computer explode?
In windows, if you share (for example), your mp3 directory, as world readable, is there an exploit?
A healthy dose of paranoia is acceptable, but is it worth reducing usablility?
A much nicer security method is to decide who shouldnt have access, rather then who should.
When Skeletor finally kicked He-Man's ass he bestowed upon man broadband. There were those that said of this thing nothing good shall come. These nay-sayers tried to convince people that they were in danger of everything. Broadband won't hurt you. Why don't broadband companies invest a few more dollars (offer to thier customers at a discount) good cable or DSL modems that have built-in routers with a bit of security. And completely besides the point, where the fuck are my internet active toys? Why can't I plug my microwave into my router and surf the net on its one line monochrome screen? I need to check my fucking email!
I'm a loner Dottie, a Rebel.
Oh yeah, their DNS server never works either. I don't know about their DHCP server, but I would expect similar success.
I stupidly ran a renamed BO client a couple years ago. I had great fun reading the funny little dialogs my tormentor pushed at me.
:D
Did I whine to my isp?
Did I write to my congressman?
I disconnected from my isp, found the exe, and deleted the little bastard from DOS.
That which doesn't kill my OS can only make me stronger!
I had @Home for a while, and thought the service was just fine. I have DSL now, but the switch was due to cabling issues in my apartment, not the @Home service.
However, I had a WebRamp 700s as a firewall and for a period of about 4 weeks recorded at least 1 serious attack a day (Syn Flood, DoS, Ping Flood, etc....).
So yes, @Home is talking **** again.
Here is a sample of this weeks log (Started Sunday). Some days there are more attempts other days fewer. This is not the only log but it is of the more common ports. You would be amazed at homw many times these sites will continue to knock even though they get no response.
Oct 22 13:19:17 ng ng: IP[Src=24.3.84.46 Dst=XXX.XXX.XXX.XXX TCP spo=00021 dpo=00021]}S03>R02mD
Oct 22 15:40:58 ng ng: IP[Src=199.217.172.253 Dst=XXX.XXX.XXX.XXX TCP spo=01301 dpo=00023]}S03>R01mD
Oct 22 15:41:43 ng last message repeated 4 times
Oct 22 15:42:13 ng ng: IP[Src=199.217.172.253 Dst=XXX.XXX.XXX.XXX TCP spo=01548 dpo=00021]}S03>R02mD
Oct 22 15:42:58 ng last message repeated 4 times
Oct 23 03:32:35 ng ng: IP[Src=24.19.0.225 Dst=XXX.XXX.XXX.XXX TCP spo=02562 dpo=00080]}S03>R03mD
Oct 23 03:32:35 ng ng: IP[Src=24.19.0.225 Dst=XXX.XXX.XXX.XXX TCP spo=16419 dpo=00080]}S03>R03mD
Oct 23 06:22:21 ng ng: IP[Src=24.142.211.22 Dst=XXX.XXX.XXX.XXX TCP spo=04846 dpo=00021]}S03>R02mD
Oct 23 06:22:30 ng last message repeated 2 times
Oct 23 16:55:25 ng ng: IP[Src=24.142.211.22 Dst=XXX.XXX.XXX.XXX TCP spo=02913 dpo=00021]}S03>R02mD
Oct 23 16:55:34 ng last message repeated 2 times
Oct 23 17:54:11 ng ng: IP[Src=24.93.99.103 Dst=XXX.XXX.XXX.XXX TCP spo=03195 dpo=00021]}S03>R02mD
Oct 23 17:54:21 ng last message repeated 2 times
Oct 24 06:37:52 ng ng: IP[Src=24.23.155.145 Dst=XXX.XXX.XXX.XXX TCP spo=04602 dpo=00021]}S03>R02mD
Oct 24 06:37:53 ng ng: IP[Src=24.23.155.145 Dst=XXX.XXX.XXX.XXX TCP spo=04626 dpo=00080]}S03>R03mD
BTW: This is a hardware firewall, I havn't quite figured out how to get it to log only certain things. It's either a specific few or everything. I also have IPCHAINS and TCPD running (just in case). One day I'll replace it with a Linux box running Net Filters.
Neil Cherry - Linux Smart Homes For Dummies
I'll say it again, and listen up this time --- you can't put a Red Hat or other boxed distro box up on the net without turning off all kinds of services and running a locked-down ipchains ruleset, or you are gonna get owned in short order.
Need a Linux consultant in New Orleans?
I wonder how many of those port scans are cable admins?
I'm a Rogers Excite@Home customer, and I can assure everyone @Home broadband is safe: they knock you off their network for hours or days to make sure! You can't get hacked when you're off their network, which is quite often. Service has stunk lately, with email outtages lasting entire week-ends (and who knows if emails bounce or are lost). Now that's a good firewall.
I'm a member of rogers@home, as I have been for two (unhappy) years.
I was cracked while my computer was on a dialup connection to my ISP. Completely dynamic IP, not a 24/7 connect by any means. Ever since I've had the experience of using Rogers@home, my friends and I have always received the same IP when renewing their lease with DHCP. It's almost as if they've just taken out the middleman of telling you that your IP address has been assigned and telling you to configure your data, and just assigning it to you using server side software.
A friend of mine apparently had someone stealing their IP address for two weeks on end. When phoning @home tech support, they traced it to one guy with the incorrect DHCP settings. However, under Acceptable Use Policy, they couldn't do anything but ask him to stop. The result? My friend's DHCP settings constantly returned the same IP, even though it was conflicting.
She paid for two weeks of @home cable modem usage without being able to use it.
Fuck you, @home.
Michael Labbe
Are you that guy? Hats off to you :-)
Erik
@Home
I work for a nationwide wide isp that handles thousands of dsl customers and i have yet to recieve one report from a customer complaining about an intrusion even though we use static ip's. The probability of being hacked is just too low to warrant the recent flood of warnings that broadband customers are in serious danger of being hacked. The problem lies with customers fearing the worst and putting software firewalls in place and call in every 5 minutes claiming they are being hacked by their own isp. Come one guys...do you really think that everyone wants to steal your valuable mp3's and your nice new broadband collection of porn. How about those .txt documents...pretty interesting stuff.
As you can see, the long persistance puts people at risk because they are often not security experts. Escpecially people new to computers or to an OS in particular. And now @Home wants to tell them there is no danger? Pfff. This is going to be a media circus.
Javascript + Nintendo DSi = DSiCade
I've used Excite@Home about a year and DHCP has always been an option (and a crappy one, at that). Even if you DO use DHCP, you're still using it to access a permanent IP address -- not a different one every time you use the internet. It's scary how easy it is to look out over my subnet at home and see everyone else's computers -- an Airport here, and iBook there, a Sun here, a few Win NT machines there, etc.
With the right tools, anyone could crack any of those computers -- you think systems are weak in businesses? Home computers are much more out-of-date and more easily crackable than most business systems!
Everyone who uses any broadband for internet access should be VERY paranoid about it -- paranoia is the best way to be prepared. Don't go crazy, of course, but use your paranoia to protect yourself. Lots of people are posting good suggestions here, but the main point here is not to let your guard down on this just because the companies who want your money say so.
Shouldn't MS be called to task, for not doing a better job of security in their os?
Not just a smart cracker - anyone with half a brain could set up a system on a hacked PC to get it to broadcast its IP when it goes online or changes! I mean, I've done it, and if I can do it anyone can...
Script Kiddies - hack our customers' computers.
I even managed to get a fellow @Home user's account terminated after I proved to abuse@home.net (via my firewall logs) that he'd been a naughty boy.
I strongly urge anyone with a windows box and a cable/DSL connection to get a firewall (zonealarm, black ice, etc).
Slashdot: come for the pedantry, stay for the condescension.
Is it just me, or does "just a ping" not imply that we are only talking about ICMP echo packets, or else the TCP or UDP echo port ?
A connection to any other port means that somebody is checking for something specific, not just for connectivity.
where there's fish, there's cats
A quick lesson, which I am sure that you have had: Yes, DHCP assigns an IP address when you log into the server that your ISP has. With broadband, chances are that you can leave your connection going all the time, effectively giving your computer a static IP until you shut down or reboot. While you are going, you can still get hacked.
Cogito, ergo sum.
The one thing I love is that once you have the @Home service, you can get full extended cable TV for free. The installer told me that a subscriber needs only sign up for the modem service and from there, connect the splitter and TV's. This was 3 months ago, has anyone else found this to be true. Sure a nice way of saving 40-50 bucks a month.
yeah, the one example of a honey pot i saw--once they cracked it, they had a doctored irc client that connected to a certain channel of their irc server, so they could always find it--granted that was solaris, but i am sure something similar can be done for pretty much any OS given enough time and effort.
mov ax, 13h
int 10h
mov ax, 13h
int 10h
Just for information, a lot of the entries in firewall logs are often from game port scanning robots.
I suggest to anyone with cable/adsl internet to get themselves a Linksys internet router. It has a built-in firewall and can redirect ports to specified computers for games, ftp, telnet and such. It also has a 100Mbit switch on the the internal side and it's cheap! Purchase of the year.
its 64.28.67.48 but why would you want to know that?
I use @Home. I file share for friends. No firewall as I have nothing on my computer but mp3's and theater/dvd-ripped movies. I run Napster 24/7 for my 5,000 mp3's. The question is: If I log into my online bank using the secure connection (https), can anyone else see what my username and password are? Now, I back up everything to CDR so I could give a sh-t if anything happens, but how dangerous is my Win98SE setup. I'm guessing it's very vulnerable, but I don't really care, or give a flying f-ck, I'd rather spend my time doing something more valuable outside.
Is this guy for real? Before you think only the paranoid need worry consider the following:
Where else would I put any of the above? The "PC" stands for "personal computer". That's the computer I put my personal stuff on. Jackass.
--
Freeper Logic
I remember waiting outside a BART station waiting for a friend to meet me, when a maketing type (the kind that roam around college campuses with a clipboard full of credit card applications) approached me. This person knew absolutely nothing about the internet. I raised the security question, and this is the gist of the answer:
"@home has special sotware that makes it so nobody can get in your computer"
that's a rough paraphrase as it was about a month ago. Upon hearing this, I gave the girl a quick and dirty guide to internetworking. I asked her where she heard that, and she said the guy who hired her.
I think anyone in this forum can understand that a firewall would be involved if that were the case, but I have never heard of @home installing a firewall on every client machine on their network.
In any case, if the people who know better don't educate their friends on how to defend themselves against these attacks....they will go and get tougher laws passed to make up for their ignorance when they get tired of being cracked.
"Let him go, Ralph. He knows what he's doing." --Otto Mann (simpsons)
But about secure information, most people want their computer to do useful things, and one large area of the useful-thing pie is finance management. Lots of people use quicken, and can't even recount the number of people I found who had quicken backups all over their drive, and what about people who use excel? C'mon, almost everyone has sensitive information on their computer, even if it's just a little address book.
I have DSL here and use NAT on my linux box to share the connection. I get at least 10 portscans a day, according to good old portsentry. I also run samba on that machine, and get lots of strange machine names in the log files of people trying to snoop. It's ridiculous to say that people are over-paranoid, most people really believe that hackers are just some movie fantasy and not a real threat.
I don't believe, however, that the answer is firewalls. They are annoying. They break lots of things, and I'm sure would increase the amount of tech support 10 fold if they employ any kind of sweeping policy. What really needs to happen is education. To help people know where the real dangers are, and what's imaginary. People learn about safe living, safe sex, and safe everything else, they also need to be taught safe computing. Sure, it sounds retarded, but IMHO, it's the only thing that will help. Awareness and education can stop lots of problems.
Free Online Woodworking Resources Directory
My brother is somewhat of an alarmist when it comes to his broadband connection. He runs antivirus software and scans his computer regularly and he does sometimes find things. Often windows will crash and reset to some 3 month old registry settings and he will be forced to reinstall - he will firmly blame this on a virus. Once he found a virus on his computer and quickly sort someone to blame. Obviously it couldn't be his fault for downloading every crack he can find and running it on his computer. Turns out he got the idea that it must have been his girlfriend running Napster on his pc. I had to patiently explain to him that there are no mp3 viruses. That mp3's don't contain code and although exploiting holes in Napster to propogate viruses may be possible, I seriously doubt that is what happened. The argument lasted for hours. Are you aware of how difficult it is to argue with someone about how they got a virus when they don't know the difference between code and data?
How we know is more important than what we know.
I don't even use Linux as a firewall. It's a great router, but in the v2.2 kernel, the firewalling code is pretty weak. It's stateless; that is, you have no context about a packet. You can't (easily) allow, say, all outgoing traffic on port 80 while refusing it inbound.
:-)
:-) The whole process is just enormously complex and incredibly prone to error.
:-)
You can get around this by filtering on particular combinations of SYN/FIN/RST, but that makes it pretty easy for someone using NMAP to get packets in past your filter.
Personally, I use OpenBSD as my firewall/NAT device. Stateful inspection firewall for free -- gotta love it. I even paid for mine.
There are some nice online pages that will walk you through a series of questions and generate an ipchains ruleset for you. It's a lot better than nothing, and it's a good place to start learning about firewalling, but the process is complex enough that any form of automation is likely to make assumptions you may not like. The Checkpoint Firewall-1 product comes to mind. Out of the box, the 4.0 and 4.1 installations are just dreadfully insecure. It's easy to administer but it's got tons of holes in it. That's my biggest fear about automated rulessets.
But doing it by hand isn't very likely, for most folks. I'd say no more than one person in a thousand is really qualified to be writing firewall rulesets. Hell, I've been learning this stuff for three years and I'm still not sure I'm entirely qualified.
I'm not sure what the answer is here -- TCP/IP requires an extraordinary amount of study in order to be used in s 'safe' way. From a security standpoint, I think the protocol may be essentially useless. You CAN get security but it's so difficult as to be impossible for 99.9% of the public.
I'm struck that maybe it's time to toss out the whole mess and start over -- except in the real world, that NEVER happens. Look at COBOL.
Hmmm, just as I was reading this earlier today in Wired.
The bit on using personal firewalls looks quite different from the point of view of network administrators.
These things rarely protect their users, since they usually only block closed ports.
What they do is annoy the admins by sending bogus emails "somebody from your network just sent me a packet". These emails are deliberately huge (megabytes) and include very little useful information.
I wish people would stop advocating use of this sort of broken software. It's far easier to not run redundant services than to install them anyway.
Not to mention the fact that these kids have made the firewalls newsgroup completely useless with the childish questions and "expert advice."
-- Stanislav Shalunov
>About all that would happen that way is a denial-of-service. Default gateway has to be one hop away. A remote attacker can't specify
:-)
>his own IP address as your gateway, he has to specify another machine on your network. So he can shut you down remotely, but
>that's about all.
Understood. I was presuming this MITM attack from someone on my cable network. The subnet mask is 255.255.254.0, so I'm potentially sharing it with almost 500 others. Plus a rogue server could come in on a 10. (or other RFC1918) net.
>Security is a process, not a state. The more secure you think you are, the less secure you tend to be. Andy Grove would love this
>field -- 'only the paranoid survive'
I keep seeing, "I got a really tight firewall from linux-firewall-tools," show up out there, and that mindset bothers me, for just your reason. So far firewall rules tend to be less Open Source than other software. I suspect part of the reason is because people are scared to expose their protection. But IMHO the good side is that firewall rules should be a process, not a thing that you trust. Recently rc.firewall V5 came out. I'm looking at it not to use, but to tighten my own ruleset.
The living have better things to do than to continue hating the dead.
- In flame wars, unlike real wars, noone has ever used ICBM's to assault the person they are pissed off at.
- In cybersex, unlike real sex, noone can get herpes, aids, crabs, etc.
- While running around shooting people in a game such as Quake or Unreal, unlike running around shooting people in school or a post office, the worst wound you can get is blistered fingers.
I can think of other reasons why @home would be considered safe, but it's all about relativity. Sure, @home might not be safe when compared to other ISPs, but they sure are safe compared to playing hot potato with a hand grenade. :o)
Mas vale cholo, que mal acompañado.
As for security, that is total bunk. DHCP does not stop the 5cr1p7 k1ddi35 from scanning a subnet and attempting to hack whatever open ports they can find. Once they have control of a machine, it is trivial to have it mail them or signal them (have it ping an address, or do a POP mail check, or even an ICMP unreachable packet). There are a million methods to get the new IP address when it changes. DHCP helps nothing.
Enigma
Enigma
Why don't you?
/usr/local/.
I'd quote, but pathname is down right now. Damn straight I have read the FHS, and its description of of opt primarily states *optional*. Packages that are self contained [ie, which need their own tree] should live in
Either way, `optional' is a pathetic label. Is StarOffice optional? Is KDE optional? I can run a system without grep, is that optional? What about compilers? If you use binary packages, are they optional?
On Solaris, anything not made by Sun is [usually] considered `optional'. Okay. Apply the same logic to Linux distributions. In that case, Acrobat reader is optional of redhat, but non-optional on Caldera.
/opt is fucked.
Yes, I have @HOME too. Because I use a firewall (free ZoneAlarm) I am relatively safe, in actuality. Intrusion attempts are common, usually daily. That scared me pretty deeply when I first installed ZoneAlarm. Now I'm sanguine. "I can see it coming". Its also obvious from port# and IP that most are "simply" @HOME pings. Trouble is, how does a subcriber KNOW which is which?
"Many have chosen to follow. They aren't the ones I'm worried about."
Well the ISP should not be blocking anything, since most claim unlimited internet access. As far as the dopy people that leave sharing on and get burned by it. Fuck them, its time people learned about thier pc. Just as when you use a car you first learn how to properly function and care for it, you should learn to do the same with your pc. I've never once seen a warez site thrown up via SMB. If users are too dumb to turn off file and print sharing, they are probably too dumb to share anything to begin with. I'm not going to be inconvienced b/c someone doesn't want to learn about their pc, just like i'm not going to be denied access to information b/c some other people can't handle it.
Check out Steve Gibson's Shields Up , especially if you run Windows. It will probe your IP address for open ports and NetBIOS crap.
cpeterso
Of all of the probes I've seen run against the networks with which I'm associated, @Home is far and away the *largest* source of such probes.
RoadRunner comes in a close second.
When notified that one of their users was attempting an RPC exploit against one of our machines, an @Home representative said, "I didn't think any of our customers were smart enough to do that."
I pointed out that it may not have been @Home's customer making the attempt, but that one of their customers' machines may have been "owned" by some pathetic script kiddie - he was shocked.
I don't think he'd considered the possibility that the entire @Home network is a smurf-cluster (or other "relocated" attack) just waiting to happen...
Specialization is for insects. - R.A.H.
And that is a bad thing? I hate to tell you this, but most users don't have the slightest concept of what firewalls do, how to install them, or how to set them up! Linux (and most UNIX variants) have included firewall software as part of the basic package, and now similar (and free) firewalls are available for the Win/Mac crowd (example: Zone Alarm). ZA is easily the easiest personal firewall to install and use, but how many broadband users would dare to download it OR install it?
Oh, gee, that puts my mind at ease... I was really worried that some evil hacker might break in and steal all of my public information. Apparently my fears were unfounded... I only need to be concerned if I have private information on my PC... These fears really are overblown... I mean, who puts private information on their PC, anyway?
*wipes brow in relief*
---
Personally, I always want a static IP. I realize that DHCP provides no real protection against cracks.
What's something that we can push to the general e-populace to make them want static IPs?
$200 mini-webservers? $100 firewall devices?
Post your suggestions here.
--------
Life is a race condition: your success or failure depends on whether you get the work done on time.
I did this too, although can anyone tell me what the hell sunrpc need to have port 111 open for? Actaully, what is sunrpc?
Is closing off ports enough? I have a nagging feeling that in order to have a reasonably secure box I'm going to need to know a little more about ipchains.
:wq
AT&T won't support linux, but that's far from saying it won't work at all if you know what to do yourself. Here's one person's experiences with successfully hooking his linux box up to his @Home service.
-- Anne Marie
I have on average 30 people a week from @home.com IP's scanning my netbios ports. @home actually had the nerve to tell me they are filtering their users from doing this. If your smart and you have DSL or cable you will setup a firewall like I did. I just had someone tell me last week his computer got erased because someone on napster got mad at him.
As a comcast@home customer, I can say for a fact that the NetBIOS ports are definately filtered and have been for at least the last year or so. I've confirmed this by doing nmap scans of hosts that I knew had open netbios ports and seeing those ports come back as "filtered".
Why is it that the proponents of "one nation under God" are so eager to get rid of "liberty and justice for all"?
Just hack it once and install a script to update yi.org or dyndns.org or what not whenever the nslookup of the host is different than the current value. duh. thats what i used to reset ipnat on my openbsd box because my cable would drop in and out of signal threshold and i would lose my ip. But these other bot suggestions work too, but this would be easier. You could always have it send 3 ping packets to a certain host at a certain time and just monitor the ipf logs of the targeted host to determine the ip. Any of these ways defeat the stupid:
:)
"security through obscurity"
hell, try to hax0r my box. now that i've gotten telocity i have a static ip, hax0r d00dz will try that shit and see that it's not gonna work. they will figure out that i don't have a redhat honey pot and they can move on to the next subnet. but like you said, dhcp didn't change too much with cable. but true security is a myth. you can only hope to reach farther than others in that great quest. apply those root exploit patches from 6 months ago and turn off BIND, apache, sendmail, samba and all that other stuff if you don't use it. There are many resources for securing linux and other OS's. they should offer that information to their windoze subscribers (the windoze info, not linux, since that wouldn't help windoze users too much would it)
Chaos, Mayhem, and Destruction: Not
dhcp as a defense is lame. If the ip of a computer changes, which is not that often on this network from what I hear, that is little defense. You come on the net, people will probe you. Once they get in with a trojan horse or sumthing, the numerical value of your ip doesn't mean squat.
Where do you want to be, What are you doing to get there.
... Then why do 80% of the attacks (we get them nightly) come from machines on @home's networks?
Yet they would still want to do that. Why not tell users they should turn it off, and tell them how? Especially since most likely an @home tech guy will be on site..he could do it just as easily. Winxx comes with SMB, not FTP. Its also a little earier to setup and use then FTP...and don't forget that NT is more secure then 9x.
If you can't differentiate between a ping request and a portscan, maybe you need to read up a little on TCP/IP. Here is a great place to start: The firewall forensics page It is chock-full of commonly scanned ports (and tasty goodness!).
Enigma
Enigma
Um ok... sure. Wait till the next Internet worm comes around, taking advantage of some remote r00t exploit in Windows and takes down every wide-open win box permanently connecteed to the Internet. It's amazing how quick exponential algorithms grow, and if you just have every infected Windows box hack 2 more you've got a million dead billboxes in 20 cycles (yes I'm sure you already knew that). I'm entirely amazed this hasn't happened yet.
:-)) But DHCP isn't going to effect a worm that can touch every IP address available.
I don't think its excite's fault though. Broadband is *relatively* safe if you've got a locked down *nix box behind software and hardware firewalls, but it certainly took me a hell of a lot of time and energy to figure out how to do that right, and I'm still a novice when it comes to security. (I couldn't crack a Commodore 64
Now if only all the Linux distros would start locking down their distros by default so that you can be safe as a Linux novice, I'd really appreciate it. I'd much rather have the inevitable worm target Windows than Linux.
They have a class A, how many damn ip addresses do they need?
Well,..when the trafic starts to overload in one network, they can subnet off and keep things at a managable level. This realy cuts into the # of available IP addresses. If they are aiming at millions of customers, a class A gets chewed up prety quickly, thus DHCP scopes.
Dirty Pirate Hooker
OK, it appears that YOU are one of the dopy people who are exporting Windows file sharing to the world.
If you like, i'll give you my IP and you can see just what i have exported.
Well, don't be surprised when some kiddie attacks your Win9X box.
Ya, they can do ALOT of damage getting to my mp3 directory, even had i been exporting it. Even if i were to export it, i'd not be giving just anyone access. My win95 box is VERY secure; i don't have one to break into. The box with the cable modem hook up is linux, and each share can only be accessed by certain users, and from certain IPs. The internet is not in those ranges.
You've got to realize that people who do enable file sharing over a persistent broadband connection in fact ARE inconviencing the rest of us. Why do you think @Home got blacklisted? It's because too many of their users had their boxes cracked and turned into spam relays, and @Home didn't do anything to correct the problem.
Oh, gee silly me thinking it was @Home's mail servers that were open. Or someone incorrectly setting up a mail server. No, they did it ALL with only windows file sharing. Quite a feat i'd imagine. Of course its possible, but to argue that they use that and that alone to do it is higly unlikely. You'd only probably be in real danger if you share your entire harddrive with full access without a password. Since home networks are still fairly uncommmon, i doubt many people would do that. Incidently, why is it my fault that someone broke into your machine and setup a spam rely? Its partly your fault i'd think but most of the blame rightly remains on the person doing the cracking.
Every clueless luser who installs a personal firewall is going to go batshit that they are being "attacked" 10 times a day. Logging is a Good Thing, but ONLY if you know how to read the fscking logs. I've played with a couple of personal firewall tools for windoze. These kinds of mass market programs need to install with minimal/no logging as the default, to help manage the "chicken little" syndrome. The alternative is to build in AI heuristics that can distinguish between random portscans and a real attack.
I have a cable modem router. It dosn't do any logging. On the windows box behind the router, I run AtGuard. Ever since the router went up, AtGuard's logs have stayed empty. If an "attack" dosn't get past the router, it dosn't get logged. That's fine with me; I'm not worried about script kiddies who are too dumb to source route through a simple NAT box. If anything DOES get thru and shows up in my AtGuard/ipchains logs, I'm DEFINATLY going to pay attention!
Why is it that the proponents of "one nation under God" are so eager to get rid of "liberty and justice for all"?
The hub router I have, mainly for sharing my cable modem with every computer on my network, has a firewall built-in. Just enter a few numbers, and tada, the firewall is active. Of corse, I then have to enter more if for IRC and stuff, but I'm off the subject. If a hub router can have a firewall built-in, why can a broadband modem have a firewall built-in?
i get max speed on sympatico all the time..
If I may be so bold as to bash the company for which I am employed. Frontier was purchased by GlobalCrossing awhile back.
t ml#secure
Check out this page as it is on Frontier's add for DSL. I thought that it was pretty funny.
http://www.frontierlightninglink.com/fun/fun.sh
"Secure
Cable modems leave your computer vulnerable to others accessing your private files.
Not so with Frontier LightningLink. Your connection to the internet is dedicated and secure. You can leave your computer on all day with no worries about whether someone is looking at the private files on your personal computer."
Yea!
This is completely untrue. I get at least 3 portscan attacks per week from other home.com hosts alone, not to mention others. I think the idea of the cable modem just attracts a lot of shady l33t d00dz who like to sit around and run portscans all day since they have nothing better to do. I have to say, their service is really going downhill. It's almost to the point that I'd go back to dialup, since there are no other high speed options in my area.
Read it again, I said DHCP refuses to work correctly with linux, not @Home I use @Home, and am a linux user, but I can't use DHCP, but there's no reason to anyway at the moment
And to top this off optus@home actually actually names your machine on their network (customer id number) so it doesn't make any difference what ip number it has assigned.
:wq
Note to self: Turn off my firewall, purchase @home access, and use their dhcp/self healing network because they are on top when it comes to security. Oh wait..I said that about time warner...then i got raspberry jammed.
I use at home, if im not around i just un plug the wire, lay it on my desk. Try portscanning me now!!
sunrpc is Sun's Remote Procedure Call. It forms the basis of many UNIX services, especially NFS (Network File System). However, RPC is extremely dangerous when left exposed to the Internet, which leads to frequent compromise of servers based upon Sun Solaris and Linux. RPC should never be exposed to the Internet. close down NFS, portmap, NIS and anything rpc.* which you aren't using (if you don't know if you need it or not, you don't need it... turn it off!)
I personally have a DHCP server in my house(so more than one person can access the internet at a time) and my computer (which isnt' the dhcp server) was hacked, and called 911.. but anyways, if someone can get through DHCP so easily to my computer, then how can it be "safe" ?
Sunrpc is remote procedure call, which is a VERY DANGEROUS service to leave open. It is used primarily for NFS(Network Failure^H^H^H^H^H^H^ile System)and NIS(Network Information System), which is basically the same as windows file shares. Usually you don't have NFS mounts available by default, but on some systems you might. Yes you should learn about IP chains. Here is a great site that will custom-build you a firewall on the fly. Firewall Forensics is also a great page to find out what port scans are looking for. Be careful, I see quite a few scans for RPC in my logs, if you leave it open, you will be comprimised sooner or later.
Enigma
Enigma
I wrote an article on it for O'Reill yNe t
As usual, @Home is full of it and needs to hire people who know what the hell they are doing.
-- DuckWing
heheh
1.walk up to a in mall demo of the @home service (in ottawa, rodgers cable)
2.pull out your trusty floppy, with 1 permiscous mode packet sniffer
3. use said program, peole will wonder what your up to, and look over your sholder
4. explain to them that what they see is all the trafic on that segment of the @home Network
5.point out bob749's password as he ftp's to some porn server
6. tell them "oh yah,its very secure"
enjoy the look on reps face...
A truly safe distribution would be locked under 50 feet of cement and never turned on, lest it's data possibly be altered by evil crackers. But I actually want to use my computer, so I care very little about security on my machine. Even maintaining moderate security can take many hours I just don't have, or that I'd rather spend doing something useful, such as creating programs, rather than just protecting the one's I have. People too concerned about security remind me of people too concerned about diet. If you count every ounce you eat, and spend most of your time exercising, you'll be fit and healthy, but you'll only get about 2 hours a day to enjoy it. Me, I enjoy 4 hours a day (besides work) in sloth and laziness. I don't want to become wrapped up in diet so much that I lose sight of the end goal, enjoying life. I don't want to become so wrapped up in security that I lose sight of the end goal, using and enjoying my computer.
up here in ottawa, the cable companys were running adds about download rigermotous, ie stiffing of libs that occures while waiting for downloads to complete.
the local DSL provder started runing adds where the family bought the whole neighborhood so they could get fast, secure access.
heheheehhehe
I prefer to blame things on "general fuck-up propensity". I'm usually right, too.
--Perianwyr Stormcrow
What we call folk wisdom is often no more than a kind of expedient stupidity.-Edward Abbey
How can a default install of Win98 be remotely "rooted"? I'm sure there are DOS attacks, but without installing a trojan or using an insecure email client such as Outlook, I'm not aware of any common exploits. Care to enlighten me?
Well, he said "attack atempts" not specificaly portscans. I know I was a little freaked out at getting 30+ allerts on my first day running a firewall, and found out later most of them were just ping requests.
Dirty Pirate Hooker
"...ought to frighten the broadband providers into pushing at least simple firewall software themselves perhaps." To a point this is true, but I don't want Big Brother ISP protecting me from myself either. I get that enough from the government. Though having them supply something like Zonealarm (which is free) wouldn't be too bad. As long as it went no further.
We are a small ISP with Network ICE Sentry monitoring one of our backbones. We see regular events from people infected by the Sub7 trojan. you can change your IP address, but you can't hide. (I hear you can get a desktop version of this IDS as well with a personal firewall).
i have a friend who is in tech support at the local @home call center
he uses the competing DSL from the phone Co.
most DSL techs i know, use the service they support..
hmmmmm....
Actually, there have been some news reports about AT&T breaking up into 4 different companies. Maybe they are just gearing up for the future :)
Enigma
Enigma
I was browsing the net the other day and found a great little white paper on how to make a linux baised firewall out of an old pentium computer(With the addition of 2 network cards).
It is pretty sweet addition for any cable modem or DSL line, It allows the user to use the service with an unlimited computers on the inside (well not more than 253).
It was a pretty good way to relive my old P75, but most anywhere you can pickup a pentium 100 for 30 bucks at a garage sale and two 10/100 network cards for 20 bucks each.
http://www.emacinc.com/white_papers.htm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Some people are alive, only because it is against the law to Kill them!
DHCP just makes you a slightly moving target, and if an attacker is looking for victims, they probably won't restrict their portscans and probes to single addresses, but IP ranges. I occasionally do a sweep of my university's residence network just for yuks, and I've run across a few unsecured boxen, Windows and Linux alike (the guy in Pitman Hall who just installed Debian, this means you!)
.0 releases. You don't think the latest macro virus craze can get you? Think again, spam-boy; why do you think Unix/Linux vendors have been going batshit looking for format string holes in their software offerings? The exploits may be merely theoretical, but it's best to close them up before the theoretical becomes practical (with apologies to the L0pht).
However, there are some simple ways to make your broadband connection a little bit less like swiss cheese:
1) Disable file sharing and remote login - Running Windows? Take a look for any folder or file with that little hand icon, and un-share them. Even better, just go into Control Panel -> Network and shut it off completely. Don't think passwords on your shares will help you, as a recent bug was discovered in Win9X share-level password protection where a one-byte character string can be used to bypass a protected share should that byte happen to match the first byte of the actual password. If you're on Linux/*BSD, for the love of Bob shut off NFS, ftpd, telnetd, Apache, and the like until you know what you're doing! Can you say "backdoor"? Even experienced admins leave the occasional hole, and default installs aren't often known for being secure (OpenBSD people, stuff it while I make a point for everyone else:).
2) Don't let anything run automatically - Java and ActiveX in IE and Netscape installing and running automagically? Kill it. Auto-DCC in IRC clients? Un-auto it. Run attachments on preview in Outlook, or run macros in Word documents? You know the drill. Don't let a damn thing run automatically unless you actually know what's taking place. If I ever see LIFE-STAGES.TXT offered to me by DCC again, I'm going to reach through the monitor and shove a virus scanner up the patoot of the victim. The world doesn't need another Melissa or backdoor being passed around just by opening an e-mail in a brain-dead-by-default program.
3) Check for patches and follow directions - MS didn't tell people to change their Outlook settings while it took them a month to patch the program in the wake of ILOVEYOU because it was fun for everyone. Red Hat isn't releasing megs of updates for Red Hat 7 so you can sit there and kvetch about buggy
4) Extra steps if you're really careful and/or paranoid - Old 486: $50. Geek on a caffeine high: $5, $0 if s/he's already jacked on coffee. OpenBSD or Slackware burned on a CD: $0. A kickass firewall to confound the kiddiez with the latest 'sploits and nmap: priceless.
5) Ignore the DSL/cable pissing contest - Nothing to see here, move along...
I'm glad to say most cable installers where I live have a brain, and hence make sure filesharing is turned off in Win9x when they set up your system. Linux/BSD geeks usually have to take matters into their own hands, but most usually know enough to at least kill nfsd and ftpd if they're not going to be used. (Incidentally, this is also why Red Hat and others need to stop enabling every conceivable service by default.)
Closing your box off to kiddies is acutallly pretty easy. However, back-patting fluff like this Excite dropping does way more harm than good by instilling that false sense of security that leads people to think its OK to let attachments run automatically, or leave all those services running on their new Mandrake box. Hard advice is better than press releases and misrepresenting technologies as security measures.
-------------
Someday, you're going to die. Get over it.
well, acording to the arin whois, the 24.0.0.0 address space is owned by the entire @home network. Your local @home provider only has a single subnet of that large class A.
Where I live, (Toronto, ON) we still have the option of using static or dynamic addressing. They both provide the same ip address, and with how many times their DHCP server goes on the blink, I am quite happy to use a static IP. In terms of security advantages, since both provide the same IP, I don't get any type of additional security.
One thing that you pointed out that must be re-mentioned. All of the people that are looking to do damage to your computer, are not after your computer individually. They are after a computer, with weak security, to have some fun with.
That's my $.02
I'm using Optus@Home and all someone has to do is break into my computer, get my Optus@home hostname and then they become me. If they abuse my account, i'm the one who gets kicked off!!
Now if there is no security, how would you stop someone getting this??
6/10/2000 Became a cable modem user. 8/30/2000 Over 5500 unique IP address's tried to break into my computer, not counting pings. This is a personal account, not hosting anything. There is nothing to attract interest. 'nuff said.
If a customer operates the computer in a safe manner, there shouldn't be any problem.
Indeed. Any computer that's sitting with its bare ass out on the net with a static (or even dhcp-assigned) address with all ports open, unnecessary services running, and without a firewall for protection, is just begging to be pillaged.
It's like sex. Would you have sex without a condom or suitable barrier? You might out of laziness (or the mistaken thought that you're not getting the full experience), but if you do, nine times out of ten, you'll be coming home with an STD. It's the same with firewalls and network security. You might not run one out laziness, or the mistaken thought the firewall will impede your performance by constraining your movements, slowing down your "bandwidth", or impeding your access to others' ports, but nine times out of ten, you'll be coming home with a cracked box.
I tell all my lovers, "No glove, no love", and I encourage all of you to tell your sysadmins, "No firewalls, no thigh-or-balls, er, I mean, no service."
-- Anne Marie
well, my local isp that provides me adsl said me the same that i'd be quite safe from hackers & etc if i'd used "grey" ip and dhcp. but that didn't suite my needs, so here i am. gladly i have ipchains running and all unnecessary services disabled... at least some security.
ound the message used repetitively over and over still nothing grows silen
Ford executives today declared the much maligned Pinto to be entirely safe and sound. "If people operate the car in a safe manner, it will be safe." Ford CEO Henry Edsel Ford IV said in a press conference today. The Ford administration cited a lack of customer education, and claimed that "The risk is much greater in the customer's mind than in the real world" "For example, a basic precaution all other traffic should be avoided, reducing risk of rear end collisions. Reverse gear should never be used, as the risk of colliding into stationary objects is much greater while backing up. As part of the final dealer checkup, we are careful to remove all fuel from the tank. Customers should be advised that they fill the tank at their own risk." Other safety precautions cited by Ford engineers included the cars ability to move quickly and make sharp turns. "Since it is a moving target, it is much harder for no-good-niks to hit. For this reason, we were able to ignore the need for any sort of structural protection."
/* This post not warrantied for mission critical applications. */
These personal firewall systems are really starting to piss me off. Now millions of instant "security experts" can shriek every fucking time they get a ping. At home, you'll know you've been r00ted when mysterious traffic starts showing up on your modem or router. Sure, you've noticed someone scanned you, but WTF do you do after that? Send a complaint to the netblock maintainer? Hah, like they care what someone from their thousands of systems ran a portscan on someone in 24.x.x.x!
At work, your firewall *should* be good enough. Reporting abuses of your network to the maintainer of that netblock may actually produce some results. You *should* have some qualification (read: you know what you're talking about), be able to speak that person's lingo, and *should* have some well documented log excerpts to show a clear pattern of abuse, not some untraceable and/or forgivable indiscretions.
That's my $0.02.
--
There is no K5 cabal.
There is no K5 cabal.
I am not the real rusty.
I walk the streets naked, while blindfolded and let anyone fuck me and probe all by orifices, while using no protection whatsoever. Gee, why do I have all these viruses and diseases?
Hi, I use the free firewall Zonealarm which does a very good job. Everyone must use security software and good security practices on the internet.
Will the last company to abandon Linux please turn off the lights??!
Fnord.
Any sufficiently advanced civilization is indistinguishable from Gods.
As an ex-@home (att) employee, I can tell you that the blocking of ports is, for the most part, a myth. I only dealt with AT&T@Home, so I don't know about the other cable providers, but I can personally attest that no att customer has *any* blocked ports. If there is a service blocking ports, it's becuase the cable company themselves blocked those ports. Excite@Home has nothing to do with how the MSO's configure their hardware.
On the issue of security, it's almost funny to hear people talk about how dangerous it is to leave your computer on if you have cable or dsl.
SpeedGuide.net has a good article abnout cable/dsl security.
To sum up the security issue; there is no discernable difference between the security of a cable modem and the security of a 56k, aside from the VLAN (virtual local area network) setup of a cable modem.
Want to protect yourself? Disable file and print sharing, don't accept files from people you don't know, scan for viruses every so often, and avoid emails with a subject line of "I Love You". It really is that simple, believe it or not.
Wow. They move you to a different part of the "Information Superhighway" and the l337 ldd33z have to ask for directions. I have DSL through a baby bell i don't want retaliation from, and i have been scanned within minutes of getting my IP from the DHCP god.
So basically the marketing guy did his job and lied for the reporter. He should get a job working for bush
Do you hate other human beings?
Ewige Blumenkraft!
Software upgradeable, and _a_lot_ easier to setup than a dedicated linux box with ipchains.
I believe I am as safe as I need to be. I don't type it in and no one can get it. I type it in, anyone should be able to get it - even if they have to break into my computer to get it. Mind you, I have _some_ protection (eg. a nicely setup firewall).
If you don't want people to see your porn surfing habits, don't go to porn sites. They don't need to hax0r your computer to create a click-stream of your online-exploits (doubleclick?).
If you don't want someone to steal your credit card #, call your order in or go to the store. You could also, if you trust it, use encryption. Even if you call in your order, you have to TRUST the other end.
The BIGGEST thing we cable users face is DOS attacks. Because we are online for long periods of time we often keep the same IP address for the same long time period. This makes it easy for someone to DOS attack us and be very effective. For the record, my cable IP has not changed in 9 months, and only changed once when they swapped my modem for a newer model.
It's interesting (as a user) to telnet into the firewall and watch the hits go by. I set up a small script to count the number of incomming DOS attacks (including BO, Netbus, WinNuke, Smurf, etc) and the bandwidth they consume and sent the numbers to my ISP. I turned on my internal DUMMY MODE and did not let on what I really knew (I said "a lot of weird stuff is comming thru my pipe"). They LIED and said it was "standard internet traffic" (okay... maybe it's normal to get nearly 1MB/s of DOS attacks 24/7.. I dunno). I called back and told them what I did (firewall, logging, etc) and they didn't believe me at all. I even e-mailed them the logs and they asked me what they were supposed to do with 'em. Jeez. I finally broke down and set the firewall to ignore those packets again, but @Ho.. err.. I mean... my un-named ISP refused to do ANYTHING... They didn't acknowledge the problem, they didn't offer to change my DHCP entry to give me a new IP (as I said before.. I have a non-changing DHCP IP), or help trace the source of the attacks... NOTHING.
Oh well. I'm paying $40/mo for a service that pisses me right off.. but it's cheeper than DSL in my area so.. pfft.
Whatever.. nevermind...
Verbatim
Price, Quality, Time. Pick none. What, you thought you had a choice?
The Australian Excite@Home (provided by Cable and Wireless Optus) already has at least one annoying firewall-like feature that has nothing to do with security. They implement so-called "transparent proxying", meaning that all outgoing connections on port 80 go via their proxy box, regardless of your browser's proxy settings. This has had me spitting chips on one occasion when their proxy died. On other occasions it's merely annoying, because you're never quite sure whether it's dishing up data that is actually current.
proof, n. A demonstration that a conclusion is implied by certain premises and axioms.
I get 5-10 hits a day from spammers trying to hit port 1080. On a stock win98 system I'd be a unknowing little spam relay. I also get 3-4 scans a day from @home's 'security' boxes looking at port 119. Using a Linux box as a firewall/router helps with most script kiddies, and all the 'security scans,' but if someone really wants, they'll get in. I don't think that's @home's problem. If we put our boxes' security in thier hands, there goes what little freedom of use we have now, considering the midevil AUP that is in place. The service would become nothing more that REAL fast WebTV.
Banned from moderation 01-27-2002. Fuck you too
please define attack. A lot of the "attacks" (approx 3-4 a day) I see, are no more or less than pings.. ok they are pings pointed at particular ports where vulnerabilities may lie but it is still just a ping. Over the last 10 months, only one of these vicious attacks from an evil master cracker been followed by any activity indicative of more than a rudimentary intelligence. The dangers are vastly overstated, mostly by people who do not know what they are talking about usually, in my experience, in an attempt to impress people who know even less.