Printable View
anyone know the load order of ZA in win9x...i know in win2k it loads as a service and is already up a the logon box...in win9x...it 'appears' to load after logon...
the kids leave their game box on running win 9x w.cable but log off of their desktops to the ms networking uname/pwd dialog....
does this leave the box in a vulnerable state with no ZA loaded?
You really do not need a firewall before login. You actually need it when you sign on to the internet. You do not have any remote connections before logon ..hence no threat.
well...yes...but since the box is on a cable modem, it's always got an ip...which seems to me... makes it vulnerable...or am I wrong...does win9x only pick up the ip when someone logs on...?
duh...well..i guess i could actually test it myself now couldn't i...i'll nmap it when it's sitting at the logon dialog..
If you have a DHCP assigned IP to a router which is hooked to the cable modem, it will get an IP address before you log in, because network services (much like unix) are started at boot time. Same thing for static IP addressing which, based on the definitions for your TCP/IP settings, will have information (which may or may not be valid). ZA is more like a service which will be started regardless of whether you're logged in or not, otherwise the box would be vulnerable to internet access without anyone on the machine. If any of this is incorrect, please let me know as this is from what I've found out by digging myself (as the NT "admins" didn't know what really was). Example: look at IIS servers which are infected with Code Red (did I mention my linux box has crossed 7000 hits from infected servers over 3 months?) don't have to have anyone sitting at the console for it to do it's dirty work. When you log into win9x, your desktop is updated with systray and such, but that doesn't mean the service isn't loaded already. Maybe I should make a VB program (heaven help me, what the fsck did I just say?!) that'll show load times of services compared to systray updates. But that's really only if I'm considering suicide, hehe...
well Vorlin knows more about it than I do....it seems to me that even if there is a brief period when ZA is not active and the internet connection is..the attacker would have to work fast to do anything. Vorlin could files and such be accessed before login or would the box only be vunerable to some sorta Ddos attack? When ZA does load would it hen stop the attack?Quote:
Originally posted by zigar
well...yes...but since the box is on a cable modem, it's always got an ip...which seems to me... makes it vulnerable...or am I wrong...does win9x only pick up the ip when someone logs on...?
duh...well..i guess i could actually test it myself now couldn't i...i'll nmap it when it's sitting at the logon dialog..
Windows hardware services, such as your cable modem connection, are included in the system.dat portion of the registry. These registry entries are processed on system start up. This can be confirmed by pinging a Windows machine that has not been logged in. It will reply. Software services are included in the user.dat part of the registry. These registry entries are processed when the user logs on as part of his user profile. If you can create one user profile that runs Zone Alarm and another that doesn't, then your fears may be well founded
the thing i'm worried about is that the box sometimes sits for hours at the logon dialog...so unless za loads as a 'service' (not really the right way to put it for 9x but...) on boot..it might be vulnerable...Quote:
it seems to me that even if there is a brief period when ZA is not active and the internet connection is
i guess one could also f8 on start up and 'confirm device drivers' or whatever it's called...might be able to see if the za driver loads on boot...and it's just the interface that loads on logon (ala win2k)or if nothin happens until after logon...which seems to me a scary prospect...
will check it when i get home...
From my understanding, shares are also processed, but on the user's setup (one shares a drive, the other doesn't) but that doesn't exclude the local drives. I would hazard a guess concerning the vulnerability being limited to a short-access timeframe if ZA doesn't do anything to outside-in connections once it's loaded. That, I'm not sure if it stops anything or not. It'd be great if it did, with rulesets and such so you can allow certain things and deny others. DDoS seems to be the prevalent way for skr1pt kiddiots to go, which is filtered on the fly once ZA is loaded.Quote:
Vorlin could files and such be accessed before login or would the box only be vunerable to some sorta Ddos attack? When ZA does load would it hen stop the attack?
Once again, this is my best knowledge of this, and could be wrong, jaded, miscommunicated, or otherwise full of shite, haha...please correct if I'm wrong (anyone).
Okay, I'll add what I know to this conversation - your 9x box, when sitting at the logon, is sharing and acting just like it was on a network. You can leave that machine on the login, go to another and pull files, share, etc. Since you have a cable connection you should be concerned about this. But Vorlin mentioned the use of a router - are you currently using a router for your home network? If so, then the router is probably performing at a minimum NAT. If so, the router would be the only device visible to the outside world; i.e. the outside world can't see that 9x box that is not logged into Windows.
Okay, back on track now - as far as ZA running before you log into Windows, I don't know for sure; I really don't even want to take a guess at it - I'm not running ZA anymore but when I get home tonight I'll reinstall it and try to check it out to see when it loads.
Good question...
Vorlin is right
You can access a Win box when it's still at the log on screen.
ping, finger, Dos, DDoS...
shares are processed.
Try it at home... share a drive on a Win box, log off
try - with another pc in your LAN - to 'ping' to the box or 'net use' to the drive it will work. You can access any shared device on this box when the pc is still at the log on screen.
I'am testing it right now to be sure:
ping is possible (ZA does not block until it has been loaded, after logon)
DoS and DDoS are possible
-> conclusion this is a security risk.
Yeah, all it does is either get it's information from the router, or it connects to the router (as the router's listed as the gateway in my setup). Other than that, nothing gets to the win9x box because all ports are closed outside of what ZA lets through in the "trusted network" part. Also, nothing inbound will make it through unless the port is listed in the "access control list" that the router has (I use the DLink DI704). Basically it's a port list that's allowed and you can set up groups and such...Quote:
If so, the router would be the only device visible to the outside world; i.e. the outside world can't see that 9x box that is not logged into Windows.
Even if you get the one port routers, from linksys or dlink, it's DEFINITELY worth every penny as it separates you from the outside. I mean, think about it, do you want a car with a firewall or without one? Yeah, I thought so, hehe...you want one with a firewall because if you got into a head-on without one, the engine would be in your lap...not a good idea, eh? Hehe... :D
Oh, VictorKaum: MS anything == security risk (to me anyways)
well there ya go...thx for the input all...one of those things that has been sitting in the back of my brain for a while...nagging me...it's the share issue that is most concerning...also you'd be potentially vulnerable to this even if you 'always' logged on...a power outage or some other unattended crash will put you at that logon dialog on reboot...(provide you're not nat'ed safely behind a firewall)
...btw...just had a rtfm moment and checked the za site...no mention of this potential problem anywhere...course they'll say...it's a problem with win9x...and don't do that...but i'd bet a lot of folks think they're protected but aren't..
easiest solution to your prob is: use some Linux box configured as router/firewall or a hardware router/firewall.
And what concerns ZA, it states after log on:
"ZoneAlarm is now loaded, you are protected"
hadn't worried about it too much...since it's only a game box...and i had...been relying on za to "protect me' but i do realize the danger being a unknowing ddos participant...but it's all good...getting a firebox soho next week...:D