paulsreef
12-15-2003, 04:40 PM
Apparently one of the users of this site discovered that they had been port scanned and it caused them quite a bit of concern. Being a network security person, I thought I would write a few lines to help newbie's understand what's going on and what some of the jargon means.
First let me say that if you're not running a personal firewall, you need to be. No excuses, you're crazy if you don't. Luckily the individual in this case was (they were running Zone Alarm... an excellent FREE personal firewall). If that person had not been been using that FW, many bad things could have happened.
So, let's just talk about port scans for a moment. In and of themselves, they aren't bad things. I use them all the time to check security on our networks and on customers' networks. They're simply a System Administration tool that tells you what ports on a system are open to outside connections and what services are running on those ports. Services could be anything like http (web) or FTP. Many services have standard ports. For example, http usually runs on port 80. Port scanners can take many different forms. Many are built right into the operating systems that you use everyday. In windows, you can see what ports are open on your own system by using the command line utility netstat.exe. There are many tools out there, however, that are designed with malicious intent. One of the great Windows security holes is port 139, the infamous NetBIOS port. If you leave this port open to the internet I can literally have full access to your C drive. That's bad. There are many less obvious security holes in Windows, but I won't go into them now (don't want to give anyone any ideas) ;-)
If you're wondering how vulnerable you are, do a simple test. Go to www.grc.com and do the Shields Up test. Gibson has a ton of Windows security material written for lay people there that will give you a basic understanding of the dangers. Shields Up will also tell you where you may be exposed and how to fix it. If your running a personal FW, do the test anyways to see if you're not covering something you should be.
If your running something like Zone Alarm, it will tell you when an attack has been thwarted and it will give you the IP address of the machine that originated the "attack." The best thing you can do with that info is go to www.samspade.org and do a IP Whois lookup. Its near the bottom of the page, so scroll down (4th from the bottom to be exact). That will do a query against the ARIN (American Registry of Internet Numbers) and give you all kinds of information about who owns the IP and where to complain about abuses. Ultimately it depends on what the networks Acceptable Use Policy says about things like port scans, so you'll have to ask. Port Scanning isn't in itself breaking in... its more like knocking on the door to see if anyone's home. Its what someone does with the info afterwards that can be construed as a crime. The bottom line is cover your butt and run a FW. Also check for adware, spyware, Trojans, etc. It amazes me everyday how many people are trying to get into my systems in many, many ways (with new ways popping up all the time). Just as a personal note... I get port scanned at least once a week. At work we have what security experts call a "honey pot." Its a machine with absolutely no security, but with all kinds of tracking tools. We use it to catch people... bad people. :-)
Hope that little primer helped some. If you have questions, please let me know.
Paul
First let me say that if you're not running a personal firewall, you need to be. No excuses, you're crazy if you don't. Luckily the individual in this case was (they were running Zone Alarm... an excellent FREE personal firewall). If that person had not been been using that FW, many bad things could have happened.
So, let's just talk about port scans for a moment. In and of themselves, they aren't bad things. I use them all the time to check security on our networks and on customers' networks. They're simply a System Administration tool that tells you what ports on a system are open to outside connections and what services are running on those ports. Services could be anything like http (web) or FTP. Many services have standard ports. For example, http usually runs on port 80. Port scanners can take many different forms. Many are built right into the operating systems that you use everyday. In windows, you can see what ports are open on your own system by using the command line utility netstat.exe. There are many tools out there, however, that are designed with malicious intent. One of the great Windows security holes is port 139, the infamous NetBIOS port. If you leave this port open to the internet I can literally have full access to your C drive. That's bad. There are many less obvious security holes in Windows, but I won't go into them now (don't want to give anyone any ideas) ;-)
If you're wondering how vulnerable you are, do a simple test. Go to www.grc.com and do the Shields Up test. Gibson has a ton of Windows security material written for lay people there that will give you a basic understanding of the dangers. Shields Up will also tell you where you may be exposed and how to fix it. If your running a personal FW, do the test anyways to see if you're not covering something you should be.
If your running something like Zone Alarm, it will tell you when an attack has been thwarted and it will give you the IP address of the machine that originated the "attack." The best thing you can do with that info is go to www.samspade.org and do a IP Whois lookup. Its near the bottom of the page, so scroll down (4th from the bottom to be exact). That will do a query against the ARIN (American Registry of Internet Numbers) and give you all kinds of information about who owns the IP and where to complain about abuses. Ultimately it depends on what the networks Acceptable Use Policy says about things like port scans, so you'll have to ask. Port Scanning isn't in itself breaking in... its more like knocking on the door to see if anyone's home. Its what someone does with the info afterwards that can be construed as a crime. The bottom line is cover your butt and run a FW. Also check for adware, spyware, Trojans, etc. It amazes me everyday how many people are trying to get into my systems in many, many ways (with new ways popping up all the time). Just as a personal note... I get port scanned at least once a week. At work we have what security experts call a "honey pot." Its a machine with absolutely no security, but with all kinds of tracking tools. We use it to catch people... bad people. :-)
Hope that little primer helped some. If you have questions, please let me know.
Paul