Printable View
https://grc.com/x/ne.dll?bh0bkyd2
Wanna know what information people scanning your box over the internet can recieve?
Follow the link above and it will take you to a site that will scan your box and give you a summary of what it discovers.
I got the url above off of www.wbglinks.net
gives you a list of ports open, closed or in stealth mode, what files you are sharing over the internet etc etc :)
-sorry fyre
Shields-up and grc's scans have been around for a multitude of years, I can remember when he first started and then a couple of years ago released his self-proclaimed "nano-scan". His site might give you which ports are open, but after that, I don't think they're too helpful. There are a couple of other sites that provided scans as well, here's the sygate one.
http://scan.sygate.com/
You can do your own scans using nmap for linux and it is ported for windows also. And of course there are other scanners out there as well. By doing it yourself it's an opportunity to learn.
http://www.insecure.org/nmap/nmap_download.html
Kudos for the thought though.
cheers
here you can find some free tools (web based)
http://www.tatumweb.com/iptools.htm
that can be helpful on scanning too.
Yeah, I've been wondering about GRC. What kind of reputation does that hold in the security community? I've heard different opinions, but I'm really impressed that all his work seems to have been done with Assembly Language...That makes for crazy small programs, but you gotta be a frickin' genius to code in that!
grc.com and Steve Gibson get slammed often as he is very vocal about silly Microsoft programming choices. He jumped up and down about XP and RAW Sockets for some time.
He is also is own best cheerleader and that irks people.
The selfscan is fast and is a good tool for a quickie if you dont have access to a box to hit yourself with.
I think he is a pretty smart dude and a great writer when he can get out of his own way....
I have always loved this writeup about a DDOS attack againt his site....
http://www.grc.com/dos/grcdos.htm
SGS
That was amusing.. They basically repeated that they can't connect to netBIOS or any related ports and showed me that I have virtually no ports open or they are in "stealth" mode. Same for applications, etc. Very interesting, and shows I'm pretty well guarded against that type of riff raff.
well apparently my box is somewhat secure, most of my ports are stealthed and only 139 open for file sharing, outgoing only hahah!
Would you care to elaborate on that statement.... You say in your profile that you are really a *nix type but you have "139 open for file sharing, outgoing only hahah"..... If grc can see that I would suggest that your hahaha might be an issue....Quote:
well apparently my box is somewhat secure, most of my ports are stealthed and only 139 open for file sharing, outgoing only hahah!
More details would be nice.... ;)
i am a nix type. but i use xp home edition for my music. i use my doze box for fun and my 3 nix box's for learning. (I'm currently on my doze box)
What's your firewall?
excuse me i'm sorry. I use port 139 for internal file sharing. I should have been more specific. I use a linksys nat router btw. My friend and I live together, and her machine is a windows computer. I allow her to download music from me via that port. You know, window's file sharing.
Hey Hey,
I think that what TS is getting at is that it's appearing open to a port scan... That shouldn't be happening... especially if you are only using it internally... You have to stop and ask yourself why someone outside your computer can see port 139 open. Especially if you are using NAT on a linksys router. Is your computer in the DMZ? Do you have port forwarding? If so.. Why? There are many questions to ask yourself... You also didn't answer the firewall question. Do you run a firewall, or rely entirely on the NAT to protect you, this won't stop all outbound transactions and programs.
Btw It's Windows... not doze.. :P
Peace,
HT
No, i rely entirely on the NAT, and yes i forward port 139 internally. I'm by no means a security expert thats why im here, so take it easy on me boys!
Then there is no reason that grc should be able to see that port as open through a Linksys router unless you have port 139 forwarded on the router.
If this file sharing takes place _entirely_ within the NAT zone of the router then you have no reason to be forwarding the port at the router. Do me a favor:-
Open Browser
In the address bar enter http://192.168.1.1 (unless you changed the address, then use that)
Select Advanced - Forwarding and make sure that any enties you have there on port 139 are not checked "Enable" in the last column.
If there is one, please uncheck it and click Apply.
While you are there please go to the Password tab and change the password
If I'm teaching you to "suck eggs" I apologize but if GRC can see port 139 open then the whole world can too and it's very exploitable. There is no need for you to adjust the router for file sharing that takes place within it. If you are having problems internally it isn't the router's fault, it's something else.
HT.... There's a possibility she's right.... But this is why I like you... ;)Quote:
Btw It's Windows... not doze.. :P
Hey Hey,Quote:
Originally posted here by WKAFC
No, i rely entirely on the NAT, and yes i forward port 139 internally. I'm by no means a security expert thats why im here, so take it easy on me boys!
Not trying to attack ya... just getting the ball rolling....
Why are you forwarding it? If you forward it on the router that's not internally... That's external to internal.. If you have two computers behind the NAT (192.168.1.100 and 192.168.1.101 or whatever).... Then they'll use port 139 on their own without any forwarding... The Port Forwarding config on the linksys web interface is to forward external ports on your public IP Address to internal ports on the various private IP Address.
Peace,
HT
HT is right. I believe to bring up the interface for most linksys router's it is 192.168.1.1 in your browser. and the password is like: admin or something. But i would assume you knew that as you have been forwarding ports. port 139 is netbios.. beware my friend for it is a dangerous one. Disable port forwarding of 139, and use file/print sharing.
ok ok ill work on it. So i don't need to mess with ports to share files internally?
WK:
If _both_ computers are inside the Linksys router, (ie: they are both plugged in to the back of the Linksys in ports that do not have WAN written under them), then there is no reason at all to have to forward ports.... Please block it ASAP.... We''ll deal with the possible problems it has caused later.... For now, the advice has been good so far.....
Yes, when the jumping was rather unnecessary as we (myself and others) had been telling him on his news server for some time. I used to hit up grc's news servers quite a bit before Sept. 11, 2001, but after watching a bunch of the arabs membership get verbally abused quite heavily (to the point of death threats) by other membership, and watching none of the mods (or Mr. Gibson himself) do anything about it I decided it wasn't the place for me, so I left. You'll note my signup date here coincides with around the time I stopped going to GRC. :DQuote:
Originally posted here by ss2chef
grc.com and Steve Gibson get slammed often as he is very vocal about silly Microsoft programming choices. He jumped up and down about XP and RAW Sockets for some time.
All of his stuff reads like the Inquirer, but by and large he does know how to write assembly. Big deal, writing assembly doesn't make you a genius nor a security expert.Quote:
He is also is own best cheerleader and that irks people.
The selfscan is fast and is a good tool for a quickie if you dont have access to a box to hit yourself with.
I think he is a pretty smart dude and a great writer when he can get out of his own way....
I have always loved this writeup about a DDOS attack againt his site....
http://www.grc.com/dos/grcdos.htm
One of the issues I have with the scan is that it considers everything closed to be bad, which is not the case. Back when I frequented GRC, Steve held the opinion that "stealth" (no reply) was better than "closed" (reply that the port is closed). I personally made an effort to show to him that it really didn't matter as there are always ways to tell if a host is up or not. I provided evidence, he dismissed it at the time as being "too advanced for your average hacker", another irrelevant point, given that anyone enumerating a network of home PCs will treat an all-closed system in the same light as a non-existant system.
wow. i'm not that stupid. i did setup the network you know ;)Quote:
Originally posted here by Tiger Shark
WK:
(ie: they are both plugged in to the back of the Linksys in ports that do not have WAN written under them).
Yea, until today I had not been there in a while.Quote:
Originally posted here by chsh
All of his stuff reads like the Inquirer, but by and large he does know how to write assembly. Big deal, writing assembly doesn't make you a genius nor a security expert.
The site does provide some comedy tho if you need to scratch the laugh itch.
I think he has some knowledge to share yet his approach will leave people on the respect fence.
SGS
WK:
Ma'am, with all due respect, if I had a dollar for everyone who had told me they know what they are doing when it comes to computers, networking and security I can assure you I wouldn't be typing here now..... ;)Quote:
wow. i'm not that stupid. i did setup the network you know
Furthermore, I believe it is important for me to be concise in the instructions I give so that others reading this thread who may not be at the same level of competence as yourself can work their way through it without making any mistakes..... fair enough?
You might also want to note that while you appear to be able to construct a network your understanding of firewalls and NAT seems to be a little "off target" shall we say.
For now, look at it this way. A firewall has two "zones". There is the external, (or on the Linksys the WAN), and the trusted. Anything plugged into the trusted ports is protected from the external _unless_ ports are forwarded from the external to machines on the trusted, which is sort of like punching a hole through your "wall". Machines on the trusted network are unaffected by the firewall and can communicate directly with each other without assistance from the firewall.
For those of you about to jump in and tell me about DMZ's etc..... Little steps, people.. little steps... I'm not writing a tutorial on firewalls here.... ;)
Maybe not to a pro like yourself, but to guys like me who barely survived Assembly Language class by the skin of his teeth, it's most impressive. :DQuote:
Big deal, writing assembly doesn't make you a genius nor a security expert.
Yeah, I used to hold to his whole "stealth ports" thing until some of you guys around here started teaching me otherwise. I'm very curious to learn how you proved that some day...Quote:
Steve held the opinion that "stealth" (no reply) was better than "closed" (reply that the port is closed). I personally made an effort to show to him that it really didn't matter as there are always ways to tell if a host is up or not.