Printable View
Just a page on how to stop hackers gaining knowledge about your computer :DQuote:
Any hacker who wants to attack your systems will start by trying to gather information about them. Your job is to make that as difficult as possible. Here are some tips to help you safeguard your Windows server information
Get it Here
One of the best things you can do is turn off the default shares on the box.
Windows NT and Windows 2000 open hidden shares on each installation for use by the system account. (Tip: You can view all of the shared folders on your computer by typing NET SHARE from a command prompt.) You can disable the default Administrative shares two ways. One is to stop or disable the Server service, which removes the ability to share folders on your computer. (However, you can still access shared folders on other computers.) When you disable the Server service (via Control Panel > Administration Tools > Services), be sure to click Manual or Disabled or else the service will start the next time the computer is restarted. The other way is via the Registry by editing HKeyLocal Machine\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters. For Servers edit AutoShareServer with a REG_DWORD Value of 0. For Workstations, the edit AutoShareWks. Keep in mind that disabling these shares provide an extra measure of security, but may cause problems with applications. Test your changes in a lab before disabling these in a production environment. The default hidden shares are:
Share Path and Function
C$ D$ E$ Root of each partition. For a Windows 2000 Professional computer, only members of the Administrators or Backup Operators group can connect to these shared folders. For a Windows 2000 Server computer, members of the Server Operators group can also connect to these shared folders
ADMIN$ %SYSTEMROOT% This share is used by the system during remote administration of a computer. The path of this resource is always the path to the Windows 2000 system root (the directory in which Windows 2000 is installed: for example, C:\Winnt).
FAX$ On Windows 2000 server, this used by fax clients in the process of sending a fax. The shared folder temporarily caches files and accesses cover pages stored on the server.
IPC$ Temporary connections between servers using named pipes essential for communication between programs. It is used during remote administration of a computer and when viewing a computer's shared resources
NetLogon This share is used by the Net Logon service of a Windows 2000 Server computer while processing domain logon requests.
PRINT$ %SYSTEMROOT%\SYSTEM32\SPOOL\DRIVERS Used during remote administration of printers.
If anyone is interested, I wrote a doc (comprised of info from many sources such as CERT, NSA, CC, etc) that will give you the ability to REALLY ratchet down a W32 server.
Regards!
Turning off shares on the box and closing all the ports is simply rubbish.... No offense intended.
Any server that provides public services, (or any workstation for that matter), should be located behind a properly configured firewall that allows _only_ the ports required to run the service through to the server. So if you are running a web server and a mail server with no POP allowed from outside the firewall then the firewall should have only ports 80 and 25 allowed - everything else should be implicitly denied....period.
Doing this means you can leave all your shares up - hell add a few more - you can run netmeeting, terminal services, telnet and anything else you like 'cos without compromising your firewall there isn't anything they can do to access the box in any other way than you have allowed. Of course, if you're firewall is compromised I'd say you're pretty much screwed anyhoo.....<s>
All this chat about how to lock a box is simply second line defense and, since it is an added level of complexity, is more prone to mistakes. The first line of defense should always be the firewall - it's relatively simple, (or should be), and it's a single point of entry, (choke point), where all things must pass and be scrutinized. Without the firewall you are potentially open to so many more things that you will never be able to sleep at night for wondering what it is you might have overlooked.
This, obviously, does not take into account attack from the inside - that's a whole different subject....... :)
Careful Tiger Shark, a firewall is not the end-all-be-all solution. If you are on your own personal network behind a firewall and are the only one on the network, then this is true; however, what if you are behind your corporate firewall or share the network with other people...Why should you turn off default shares, even with a firewall (and for that matter turn off any unneeded services)?
The best recent example I can think of is Nimda...
Say you have a web server on the inside of your network and it becomes infected or say one of your 'stupid users' clicks on an email attachment or browses to an infected site without the proper antivirus solution and they are now infected...Your nice little firewall now does nothing for you. You essentially have a hard shell on the outside and a soft gooey center and once something malicious enters your network, bad things could happen very fast because you haven't taken the proper precautions in turning off uneeded services and locking down your box (essentially a domino effect using trust relationships (which is what a share is)). In the case of Nimda, it liked to spread over shares, through domains, and the like. Now your default shares get targeted by your coworkers box...maybe you have your virus signatures up to date and are ok...maybe it is a new virus and you are not.
Regardless, if you take the time to properly administer your box, turning off uneeded services, setting proper permissions, removing default shares, you will not be nearly as at risk from other 'stupid users' or even insiduous insider attacks. IMHO, it is at the height of irresponsibility to not take the steps to properly lock down your OS (note I said OS and not just windows). Lastly, by turning off unnecessary services and removing shares, you also free up CPU and memory on your own system and get better perfomance.
A firewall is a good step, a firewall can buy you alot of protection, but you have to be sure that you don't have a good hardened perimeter, only to have your entire network infected/compromised due to a soft interior.
I kind of rushed the explanation (busy at work), so if that didn't make much sense I can elaborate further. This topic is kind of one of my pet peeves because I can't tell you how much grief I have had to go through after a huge swath of network becomes infested/falls like dominos because people didn't do the 'obvious things' to lock down their box...
/nebulus
Neb: I thought I covered your response in my last sentence....... :D
The point of my "rant" was that all this talk of "locking" your box lulls individuals into the sense that they don't need a firewall - that they can, with a little time, adequately secure a box open to the public. Frankly, and in deference to you with regard to it not being the be-all and end-all of security, a properly configured firewall is the _single_ item in your security "checklist" that gives the "biggest bang for the buck"..... period. I agree it does not even come close to making you Bulletproof and has no effect on malware/viruses that "legally" ingress but it keeps the masses out quickly and reliably.
There are a million cable/dsl connected computers out there right now where, those that have even thought about it, have decided that they can save on the expense of a firewall because they can see all this stuff about "locking your boxes". What percentage do you think might actually have the skill, understanding and diligence to do it successfully both initially and in the long term? My guess is in the fractions of one percent. Yet, for $80 they can go out and purchase a hardware device that covers the majority of their a$$ immediately.
I am not so concerned with the corporate chaps - they hire in people to cover this - or they should do..... It's all those individuals that get the impression that they can do without a firewall and that if they follow someone elses instructions they can be secure for the forseeable future.... IMO, that's naive.
Perhaps I should be a bit more clear. Firewalling is a given. In an enterprise environment, it is good practice to lock down workstations. 75% of attacks originate on the inside. In my case, the network was in such bad shape when I started here, the inside/outside was a gray area. My approach will give you significant protection against casual "hobbyist" hackers and the obvious worms and trojans that seem to creep into the network.
Woah, i can see the tension. better stay outa this one Darren. :D
Just make sure that when the claws really come out that they dont get me :P
Hoss: I did understand your intent however I firmly believe that whenever we talk about locking a box we should have a mandatory rider that sits at the bottom of each message stating that these measures are specifically for implementation on "corporate" boxes already protected by a properly configured firewall and accessible from within by unknown "entities".
Frankly, I see too many people on the security sites I visit that would take information such as this as being all the protection they might need and just go without a firewall. I actually see it as some kind of a responsibility to make sure that things are done "properly" if, for no other reason than, it would provide the skiddies with a few less points of attack if we could get more cable/dsl type users to buy a damned firewall - preferably a hardware one, (software ones are too easy to disable and forget about......
$66 - Linksys BEFSR41 - EtherFast Cable/DSL Router with 4-Port Switch is what I use at home. This is a great little product, especially for those who use ISPs who bridge their cable modems. I don't have to mention why bridge mode cable modems are a bad thing ;-)
Hoss: Linksys BEFSR41 is what I use at home..... funny old thing..... :D
It's also what I make all my users with cable or dsl connections at home buy before i will give them access to work's network across the internet..... I've sold enough of them now I think linksys should be giving me a commisiion.....<s>
See that, great minds think alike.
As for your stance on the mandatory disclaimer when locking boxes, perhaps we should do that. I just figured that folks here, in general, have more common sense than to believe that exposing ANY box directly to the internet is a good idea no matter what precautions have been taken.
Sorry, but IMHO, this is a pretty poor article: it doesn't bring anything new to the table, and very little "not so new" information worthy of reading.... I mean just check this paragraph:Quote:
Could this say any less?! "Your server may be vulnerable to trojans. To make it secure, you should protect it against trojans" DUH!!!Quote:
All back-door Trojans have one thing in common: They allow unauthorised access to the infected computer. Just as the name implies, this is like having your back door propped open to let every hacker know they are welcome. A number of Trojan programs are designed to covertly monitor activity on a victim system -- typically employing keystroke and screen captures. The results are then emailed from the victim system by the Trojan to a specific email account at various intervals. In this way, a hacker can really find out a lot about a system, often including the local admin password and other sensitive information that can be used to compromise the system. As a result, part of protecting the information about your servers involves protecting them against Trojans.
Oh, and changing/hiding banners is known as "security through obscurity" and ain't worth nothing. Between, it would take only a few seconds to run an nmap scan with fingerprinting to know it's an w2k box, and if a webserver is running on port 80 and/or 443, you can pretty much assume it's IIS.
Oh, hey, did you know you should use an antivirus software?!!
Anyways, I know this is well intended, but you might try being a little more selective...
We already have heaps of tutorials that address this in a much better way.
Ammo
I didnt write it, nor did i know that anyone would not be interested in this. i only posted this here for all purpose general knowledge and for people to talk about. the last 10 posts have been producted. and yes, you are right, it could be a bit shorter, but i wasnt going out of my way to edit it :D
Ammo: That's a pretty odd statement at the end there..... The default ports for http and ssl are 80 & 443, it doesn't matter which web server you wanna put up the defaults are 80/443. So, if you are going to make the assumption that because a large number of web servers on the internet are Winboxes then you aren't being a very good hacker because you made an assumption that has somewhere close to a 50:50 chance of being wrong. Hack away baby.... you're probably wasting your time.Quote:
Originally posted here by ammo
Oh, and changing/hiding banners is known as "security through obscurity" and ain't worth nothing. Between, it would take only a few seconds to run an nmap scan with fingerprinting to know it's an w2k box, and if a webserver is running on port 80 and/or 443, you can pretty much assume it's IIS.
Ammo
Then lets look at the first part of the statement re: security through obscurity. I disagree somewhat in your definition of that. If you have a box with public services such as http, smtp, dns etc. out there then no matter what you do it isn't "security through obscurity" because you have advertised services there. IMO, security through obscurity is more akin to running a box that has no common public services but has a web server on port 5487 for example. No-one scans for that port because no-one expects to find an exploitable resource there. That's your obscurity - You can access the web site by calling http://mydomain.com:5487 but no-one else will even look there.
Changing banner is a lot like driving a Roll Royce but having Pinto logo's on it..... If the car thief is told to steal a Rolls Royce he will overlook yours with the Pinto stuff on. Changing the banners helps make the skiddies with their automated tools move on - cos they don't really know what a Rolls Royce looks like so they rely upon the information that is easily accessible.
Thats my 2c...anyhoo
The assumption is based on the fact that you already know you're probing a W2k box (by running a fingerprinting scan with nmap for example). If a W2k box is running a web server, what are the odds that that web server is IIS? I'd say at least 90%.
Secondly, security trough obscurity means that you're counting on the hacker to not no what he's looking at instead of knowing that your server is properly secured. To follow your analogy, it means that you're counting on the auto theif not being able to recognize that Rolls Royce instead of making sure that your doors are locked, that the alarm is on and your tracking mechanism working properly. The opposit of security trough obscurity would mean that even if the hacker knows what he's looking at, it doesn't matter because there's nothing for him to exploit (or no way for him to expoit it).
Ammo
Ammo: Ok. The way you wrote the original phrase the "hiding banners" bit came before the "nmap scan" bit implying to me that at the point the person was reading the banners he/she still didn't know what box s/he was looking at but would do if they subsequently ran the scan. I absolutely agree that if you are looking at a known winbox there is almost zero chance you aren't looking at IIS.
With regard to Security through obscurity the obscurity bit comes from not being able to be found, hence the web site on a port that is not normally ever scanned. Changing the banners/logos is not, IMO, obscurity since you are quite clearly there, it's just that the viewer doesn't recognize what he is looking at, he can see you, he just doesn't know what you are - that, to me, is security through ignorance/inattention to detail....... Maybe I'm just being pernickety... If the person was told to go find a RR and went to see what it looked like before going to find one the Pinto logo would be a waste of time and he would try to steal the car anyway. It wouldn't matter if the security was properly done - he would try to steal it because he knows it is what he was told to steal - the target was not obscured - it was simply obfuscated.