Shields UP

i found this site and have tried it ... it is good , and help me for analyzing my internet connection security.

Quote:

---

https://grc.com/x/ne.dll?bh0bkyd2
The ShieldsUP! tests depend upon accurately determining your computer's Internet Protocol (IP) address. If your IP address is incorrectly determined the wrong machine will be mistakenly tested. In addition, computers with multiple network connections — like a modem and a network adapter — can have more than one IP address. And machines with only one IP address can have it effectively "hidden" or "masqueraded" if the connection passes through any sort of firewall, proxy server, or other buffering agent.

If you are using a personal firewall product which LOGS contacts by other
systems, you should expect to see entries from this site's probing IP addresses:
204.1.226.224 –thru– 204.1.226.255. Since we own this IP range, these packets
will be from us and will not be any form of malicious intrusion attempt or attack
on your computer. You can use the report of their arrival as handy confirmation
that your intrusion logging systems are operating correctly, but please do not be
concerned with their appearance in your firewall logs. It's expected

---

i have seen some pretty heavy criticism of grc/steve gibson much of it seems to have validity www.grcsucks.com and i have seen at least two other sites with similar points . I would be curious to hear what others think ?

I don't like grc.com, he promotes hysteria, and never bothers to explain anything, just say "big flaw! patch! use my software!". I could go on all day about steve gibson, but I won't. I do want to say one thing though, the guy at grcsucks.com, does not know everything, he hasn't done his research, he says blackice isn't a firewall, well, I was at staples, and on the box of blackice, it said firewall. So, be wary of what you read. Take it in cautiously, and learn what these people are talking about, but not from them.

EDIT: And for somebody who talks about security, and how he does his part,(gibson), he shouldn't create software that lets people use his shields up test against others.

I had never heard of grc/steve gibson until this post. However the "Shields Up" scanner seems to be a shame, it was obviously designed for those who lack any real computer knowledge. The Test My Shields button did nothing but a NetBIOS scan.... and still left most of the information (Computer Name, User Name, Workgroup) blank. All it did was tell me I have password protected shares and the names of my shares. Anyone who's actually concerned about computer security should be able to determine the shares on their computer. The scan didn't even check for hidden administrative shares (C$, D$, IPC$). As for the Probe My Ports button, it ran a port scan.. and not a very indepth one.... It checked a few standard ports to see if they were open or closed and that was all.. It doesn't even scan standard trojan ports (I opened a few up with NetCat and it didn't connect to a single one). I'd step into the ring with a grizzly bear than trust what this guys site tells me about my computer.

I hear a lot of mixed things about Steve Gibson and ShieldsUp!, and my own feelings reflect that conflict. On the one hand, I think he does a pretty good job of raising awareness among Joe and Jane Sixpack, even if what he says is not exactly right and tends to be a little exaggerated. That has to count for something, because I think awareness among the average home user is one of the biggest obstacles we face. I guarantee you that better than 90% of the users I come in contact with have never even heard of a firewall, have no idea why they would want one, and have never run Windows Update. If Steve Gibson can introduce those words into their vocabulary and get them to think about the issue, then God bless him. :D

On the downside, I don't think ShieldsUp! is a very good tool at all and tends to give people a false sense of security. It probes 12 commonly used ports out of 65,000 and gives the impression that if those ports are "stealthed" you are OK. None of us here would think that, but we take a lot for granted because we've been around it so much. There are far better online port scanners. scan.sygatetech.com, for instance, is much more complete IMO.

I don't think anybody who claims credit for developing the SYN probe can really be taken seriously, but that's not to say he isn't performing a valuable service in many ways.

Quote:

---

Originally posted here by problemchild
I don't think anybody who claims credit for developing the SYN probe can really be taken seriously, but that's not to say he isn't performing a valuable service in many ways.

---

Kinda like Al Gore's run for President...... After all, he did invent the internet...... ;)

I actually like the site.
I have read most of the articles on the site and they are quit informative.
I think he does a nice job raising awareness and I point alot of noobs to the site. I also use it when I have to skool someone on computer security. Showing them why they have to remove fnps from their windows.
Nice starting point IMHO.

The problem with grc.com and Gibson are:
-The biased editorialistic style he uses in his "articles"
-He often sounds like a security newbie himself;
in some way it can help him explain stuff "in a comprehensible way" to other newbies,
on the other hand, he keeps "discovering" stuff and taking credit for things that have been known in the security community for ages.

All this results in an unreliable information source that engages in self-engrandisment: he's like an infomercial for IT sec.

Ammo

Only trust what you know, there are some dodgy sites out there

Try this one http://www.dslreports.com/scan

Or this http://www.auditmypc.com/freescan/ma...06319YZ1V8Z0ZY

Another one at http://stealthtests.lockdowncorp.com/

Or http://www.pcflank.com/test.htm

check this out ;-)

http://www.grcsucks.com/

Hello everyone.

I think that the topic "Shields Up" is very thin and very misleading, especially for people who have no experience or knowledge in computer security, giving out a fake sense of security.

The results i got from there indicate that my system is god and is very very safe. I run this scan from a web cafe, using the free version of ZA ( :eek: ) on a win98 system that crashes every 20 mins. It said that my ports were "STEALTHED" (w00t w00t).

This sort of misleading and false results is very bad, since a novice user now thinks he is totally safe, so there is no need to lookup anything else related to security. Also the fact that he is offering some miracolous wonder applications for download to secure your system incase the results were negative.

But lets go back to my favourite part of this.....the "STEALTHY" part. What is a stealthed port? How secure is this?

What they call "STEALTH" is nothing more then a firewall which is set to DROP an ICMP packet. That means that when an ICMP (ping) packet is send, the firewall just drops it rather than sending the echo reply back again (pong). Many people will argue to whats better, is it better to DROP an ICMP packet, or is it better to DENY it? The advantage of dropping an ICMP is that if a remote user pings you, or scans you, he will be stalled, since the packet reply has to wait the maximum round trip time, and then usually times out. That will slow down an attacker who is awaiting replies/results. The disadvantage here though is that the attacker is aware that there is a firewall in place, making a target more ....uhm...... shall we say "Attractive".

So the term "stealth" is dangerous and very misleading. A simple example is when using nmap with the -P0 option. That will give away the open ports behind a firewall althogh the GRC results indicated that its very safe since the ports are "stealthed" (LOL).

What GRC is supposed todo, and they dont, is to try to explain a bit more detail on basic security, rather than tell a user that they are safe. A firewall can be f00led, in many ways. Thanks to GRC all i need is a firewall to be safe. What a joke.

Ofcourse i must respect the fact that many users are not very computer literate and have to use them for many different reasons, and that they might not be interested in security. But if these users fall victim to GRC, they get a totally wrong sense to how secure their systems are.


REMEMBER, SECURITY IS NOT JUST A FIREWALL. SECURITY DOES NOT JUST DEPEND ON SOME ONLINE SCAN. THERE IS NO SUCH THINGS AS A SOFTWARE THAT YOU DOWNLOAD AND ALL YOUR SECURITY PROBLEMS ARE SOLVED. SECURITY MEANS KNOWLEDGE. IT MEANS MAINTAINANCE. And non of that is mentioned on GRC. I wonder why.


Cheers. :D

Just to give you an idea about how "great" his secuirty is, compare...
http://grc.com/lt/leaktest.htm Gibson's Leak Test (which showed how great Zone Alarm was)
http://keir.net/firehole.html Firehole, which did the exact same test, the proper way.

No one knows everything about security. Its not possible. My biggest problem with Gibson is that he acts like he does. Yeah, he may be a decent programmer, and be able to explain noobie problems to newbies, but that doesn't mean he knows everything.

oh yeah, and we don't even have to get into Shields Up (that has obviously been covered here already)

Quote:

---

The disadvantage here though is that the attacker is aware that there is a firewall in place, making a target more ....uhm...... shall we say "Attractive".

---

Chances are that he'll think that there is nobody online at that IP address. Unless you're chatting with him at the same time on IRC :D The person would think that there was no system online at the IP address he pinged and probably move on to something else. And, he would have no way of confirming that either. Dropping is usually a good idea, but, I found that on my system, using different firewalls, dropping takes up more system resources. Nowadays I have a router, beautiful thing, protects me. Imagine my surprise to find roughly 40 important attack logs :0, 20 that were "ping of death" attacks, and 20 that were "Syn Flood" attacks, well, my router filtered them out anyways. Anyways, hardware firewalls are usually a good choice. I think I got confused from what I set out to say, so, I'll end this post here, confused, um, yeah. Oh, wait, one more thing.
Grcsucks.com was most likely written by somebody with a problem with Gibson, the person hasn't done their research, and in more than a few cases, is flat out wrong.
Don't trust any site. Trust books. Go to your bookstore, read up on internet security. Seriously, don't trust any online portscan, they're only going to scan like 30 ports anyways, you have over 60 thousand.

I , myself like steve gibsons' site and have used it quite a few times but there is yet another that I like at http:www.pcpitstop.com that gives a prety good scan also. I thank you all for these links and will use them to scan and secure my computer. Thanks guys. Auntie