You do!
This was not a trick question…but the reality is that many computer users have absolutely no idea what a firewall is. As a matter of fact, until recently, my somewhat computer illiterate wife thought that firewalls were only utilized by big companies to protect their own network.
Among my family and friends I am the resident computer geek, and if you are like me, you know that means when you are over their house or apartment you are invariably asked to fix a problem. One of the things that I notice immediately is that the most of the computers do not have a software or hardware based router/firewall protecting their computer from Internet attacks.
The Internet is a scary place with constant probing and attack attempts by hackers and malware. These probes and attacks are being done so that the attacker can set up shop on your computer and essentially use your computer to perform tasks like the following:
- Use your computer to hack other computers.
- Send out spam through your computer
- Use your computer to illegally distribute copyrighted software, movies, and music.
- Attack computers in the attempt to bring them down.
What does this mean to you? Well besides the potential legal issues that may arise from illegal activities being conducted on your computer, these activities will also affect your computer’s performance.
As a test to see how many attacks my computer would receive in a a day, I set up an Intrusion Detection System and let it run for a period of time. I then created a report detailing the attacks and probes that my computer received on the day of September 18th 2006. The report showed that in a 24 hour period my computer was probed or attempted to be hacked/exploited a total of 92 times by 43 different IP addresses. That is a significant number of attacks by a lot of different computers.
I have outlined the attacks and the amount of times for each below. If you want more information about the individual attack you can click on the more info link which will bring you to more information at the end of this blog entry.
Security attempts on September 18th, 2006:
|
Attack
|
Attack Count
|
RPC/DCOM Exploit attempt (ISystemActivator).
This alert means that some sort of attack, most likely a worm, attempted to exploit a security hole in Windows RPC/DCOM services. [More Info] |
18
|
ICMP PING generated by CyberKit 2.2 in Windows.
These types of alerts mean that someone used the CyberKit application to see if your computer is reachable over the Internet. [More Info] |
16
|
NETBIOS IPC$ access
An attempt was made to connect to private or administrative Windows shares. [More Info] |
15
|
MS-SQL Worm propagation attempt (Sasser)
This alert means that some sort of an attack, most likely from a worm, attempted to exploit a security hole in Microsoft SQL Server.
[More Info] |
12
|
NETBIOS SMB DCERPC NetrpPathCanonicalize request
A worm or hack tool was used to try and exploit the MS06-040 security in Windows. [More Info] |
12
|
MS0-4011 LSASS Exploit
An attempt by a worm or script to exploit a security hole in LSASS. [More Info] |
8
|
TCP Portscan
An attempt was made to see what TCP ports are open on the computer. [More Info] |
7
|
Terminal Server Request or Connection
A connection to terminal server or remote desktop was attempted on the computer.
[More Info] |
4
|
The amazing thing is that for a small price, under $100 USD, or for no price at all, free software firewalls, the majority of Internet related attacks can be stopped from even reaching your computer. A list of different hardware and software firewalls can be found here. Heck, even Windows XP SP2 comes with a sufficient enough firewall to block you from external attacks though it won’t help you stop your computer, that may be infected, from sending out data. That is a discussion that deserves it’s own entry though.
Still do not understand why a firewall protects you so well? Let me explain how all these security risks happen in the first place. When a company programs a large program like an Operating System there are millions upon millions of lines of programming code. Due to the complexity of programs like this, bugs invariably will be created and go unnoticed by the authors. Hackers and security experts, knowing this, attempt to find these bugs and exploit them to gain unauthorized access to the operating system, thus being able to take control of it. Many of these bugs are exploitable remotely because the program running is connected to the Internet. When you use a firewall, you block the ability for remote users to to connect to these running programs and thus there is no way they can be remotely exploited.
So with all of this said, get a firewall! If you want to protect an entire network, then go out an purchase a cheap router/firewall. If you just have one computer to protect, think about using one of the free software firewalls, or the commercial ones with more features. If you have no money to spend right now, then at least enable the Windows XP firewall as it will offer adequate protection from these types of attacks.
Attack Information:
RPC/DCOM Exploit attempt (ISystemActivator)
Related to: Microsoft Security Bulletin MS03-026 (July 16, 2003)
This security hole in RPC/DCOM was patched in the Summer of 03 and yet from time to time we still see people infected with the MS Blaster worm. Microsoft had stated in the past that they estimated about 10 million computers were affected by this vulnerability.
ICMP PING generated by CyberKit 2.2 in Windows.
Related to: Microsoft Security Bulletin MS06-040 (August 8, 2006)
CyberKit is a program that contains a myriad of network utilities such as ping, TraceRoute, finger, whois, and a port scanner among others that can be used to get information about a remote computer. This alert meant that someone used this tool to determine if my computer was currently on and connected to the Internet. If the program received a successful ping, the user can then assume that the computer is on and not protected by a firewall, as most firewalls block pings.
MS-SQL Worm propagation attempt (Sasser)
Related to: Microsoft Security Bulletin MS02-039
A security hole in Microsoft SQL Server allowed a remote user/program to execute code on a server running Microsoft SQL. A widely spread worm called Sasser is said to have infected almost a half a million SQL Servers. The most amazing thing about this worm is that it is said to have actually slowed down general Internet traffic throughout the world.
NETBIOS SMB DCERPC NetrpPathCanonicalize request
Related to: Microsoft Security Bulletin MS06-040 (August 8, 2006)
A security hole in the Windows Server service could allow an attacker to remotely execute code or take complete control of an affected system. These attacks were most likely generated by worms that attempt to exploit this vulnerability in order to spread itself.
NETBIOS IPC$ access
All Windows XP/2000/2003 installations have default administrative shares that are used by the operating system or for communication between different computers. An attempt was made to connect to one of these administrative or private shares in order to access the files contained within them.
TCP Portscan
Certain programs, when run, listen for connections over a network or the Internet. When these programs listen, they do this by binding themselves to a particular port on the TCP/IP stack of the operating system making the particular port open. A TCP Portscan is a method for a remote user to scan your computer to see what ports are open. They can then use this information to determine if your computer can be remotely exploited or attacked. More information about TCP Ports can be found here.
Terminal Server Request or Connection
Windows contains a service called Terminal Server or Remote Desktop. This service allows a remote user to connect to the computer and see a/the desktop on the remote computer and use that desktop as if they were sitting in front of it. Attempts to connect to a Terminal Server means that someone tried connecting to a desktop on your computer.
MS04-011 LSASS Exploit
Related to: Microsoft Security Bulletin MS04-011 (April 13, 2004)
A buffer overrun vulnerability exists in LSASS that could allow remote code execution on an affected system. An attacker who successfully exploited this vulnerability could take complete control of the affected system.
Some worms that are known to exploit this security hole are:
Win32/Gaobot
Win32/Sasser
Win32/Korgo
W in32/rbot
Win32/Sdbot
Win32/Mytob
Win32/Spybot
Win32/Wootbot
Win32/Bobax
Tags: Firewall, Security
Security news and information
Everyone, even malware writers, likes a good game here and there, right? Well it seems like the writer of one of the newer VaneBot worm called 
to this program.
