Quote:
Like prodikal, some of the people posting here, including catch, have missed the point I made in my first and second post here
Quote:
I recommending ignoring catch's remarks. We must keep in mind that Windows itself runs a good 10 - 20 UDP ports at all times for it's internal use and DLL calls (in some distros, DCOM), making an unpacket filtered computer a prime target for UDP exploitation and DDoSes.
I think thats ignorant telling some one to ignore others advice hes simply offering his opinion to the discussion and whats the chances of some one targetting you as a home user to DoS the **** out of you and DDoS is distributed denial of service which is diffrent from a UDP flood
where DDoS sends unroutable packets to a host till there pipe of bandwith gets clogged with all the open SYN packets and no where to send replies to a UDP flood would result in sending UDP packets to a specific port if it was vulnerable until it crashed the OS and if some one is going to DoS you there going to DoS you just because packet filtering is there doesnt mean the packets arent big deal there set to drop but some DoS attacks are so sever that a software firewall would more than likely crash from it rendering it useless and all the packets would clog your pipe anyway because theres that many thats why it called denieing service
Quote:
Even if you are a lone computer on a dialup, the risk of having a trojan planted via email (or by other means) can prove to be that one port that would compromise your security. Take the wisdom of others here and know that just because you can't see it, doesn't mean the vunerability is not there. Don't believe me? Turn on your windows machine and turn off your firewall. Now ask a friend to run a complete TCP and UDP port scan on you. Notice the stack of UDP go further and further down the list. How could this happen, even though you are not running the services?
Most trojans now days are built in with firewall and AV kilers some even sophisticated to look like there still running and not crash them why get a friend to do a port scan when there is netstat -an thats what white hats do put fear in to the masses there a simple command that tells you what listening why do you need a port scan ? to inject fear and hysteria in to people
because port scans are classed as an early stage of an attack as i said in the earlier post all net services can be stopped and people with out firewalls that get infected 80% of the time dont even know what a worm or trojan is and think the internet is for email and chatting on MSN yahoo aim etc
Quote:
How could this happen, even though you are not running the services?
Are you asking a question ? or are you trying to emphasise on the fact that computers have ports ? that you all ready said windows depended on internally and to my knowledge there is no known udp based vulnerabilities for udp ports on windows and if they were i can guarantee they wouldnt be used on your average joe and there wouldnt be a new worm
Quote:
Catch, I kindly urge you to stop and continue this fight else where with people on PM's. This is slowly turning into a flame war, and I would ONCE AGAIN rather not see a good parent post obliterated by another forum flaming session.
Please, everyone set their anger aside, step outside for a moment, and let the heat die down. We can all continue this in a civil discussion without insults and blindsideness. For the sake of the parent...
Agreed but you started it and others jumped on the bandwagon how would you feel if catch told people to ignore the advice you gave them ? and he has more than likely set up more servers workstations lans wans than you have pooh you seem to have more knowledge for a win enviroment which is a good thing because if your in the industry windows is all people know and you can land a cushy job but catch replies with indepth answers to both windows UNIX and linux questions and to tell people to ignore IMO an advanced answer is arrogant did the original poster say how much knowledge of computer systems he has ?
Quote:
. Yes, an advanced user should be securing their services, ports, and internal/external OS security settings. This is part one of the security process, but it does not stop there
Agreed
Quote:
As a newbie to security, or as step two for an advanced network security admin, it would be to place a firewall. Why? Sure the system is secured. Sure the services are controlled, and sure the ports are locked. But: A. Trojans and rootkits CAN happen, and will get right beyond a system that does not have packet filter (aka firewall)
As i said earlier in this post if there is a trojan infection and you were targeted your firewall would probably be killed when executing it and since it would more than likely have an AV killer binded to what you going to do then ? and they would have to have remote access to install a root kit on the box and they only come really on servers and im sure were on the topic of home users
Quote:
User configuration error (aka accidental exploitation) that bypasses security settings and somehow idiotically finds a way around the system. A firewall can prevent this, settings can't
I dont really understand what you mean by accidental exploitation. Wouldnt the firewall only block this if it was configured too ? and the user configuration error (aka accidental exploitation) as you put it wouldnt they all ready have access ?
Quote:
ICMP, UDP, and TCP based pings done by an attack will show the network to be online. The only way to not allow those kinds of pings is packet filtering, and that means using a firewall
So does the http requests you send out if you use p2p msn they all show you as on-line and if you were getting targeted wouldnt they allready know you were on-line ? and if the net services are shut down what diffrence does it make if you respond to ping requests ? as i said earlier if your going to get flooded (DoS'ed) your going to get DoS'ed
Quote:
So while having a firewall is not 100% needed, there are far too many circumstances and percentile chances in which we can not afford to risk. You first secure the system to your highest degree, and then provide a firewall. As MsMittens taught me, it is simply an extra layer of security beyond what you already know how to secure, lest something unexpected and unpredictable come across... that way at least you have something filtering and controlling packets.
a badly configured firewall is as good as none at all so telling your average joe to install a firewall is like asking a janitor to be a rocket scientist
