Re: firewalls - what to block and why - your security at risk
Testing again-- to see whether I can reply to this post while quoting
it, Google search & all. But I think MEB has forgotten to put on his
tinfoil hat yet again!
PCR wrote:
| MEB wrote:
|| "PCR" <pcrrcp@netzero.net> wrote in message
|| news:OLN2TzV0HHA.1484@TK2MSFTNGP06.phx.gbl...
||| MEB wrote:
||| | PCR and Gram Pappy [among others] have been discussing firewall
||| | settings and what they can or should be used for.
|||
||| That's right. I installed...
|||
|
http://www.dslreports.com/faq/security/2.5.1.+Kerio+and+pre-v3.0+Tiny+PFW
|||
||| ...Kerio Personal Firewall v2.1.5 about 4 years ago & several months
||| later began a 17 year study of what to do with it. But I should have
||| spoke up sooner!
|||
||| | In the spirit of those discussions, I thought I would post some
||| | blocked activity from a SINGLE session/contact through my ISP and
||| | ONLY to this news server and my email accounts [via OE6]. This is
||| | from the firewall log [several of my normal settings/restrictions
||| | were specifically reset for this presentation].
|||
||| Thanks for jumping in. So, you wanted to see what would happen just
||| by connecting to the NET & using OE for mail & NG activity.
||
|| Well, ah no, actually I wanted to let other users who may not have
|| investigated or understand firewalls.
|
| Uh-huh. Naturally, you & I have advanced beyond that point.
|
|||
||| | No other Internet activity occurred [e.g., no external IE or
||| | browser usage or other activity]. All *allowed activity* has been
||| | removed, so that the addresses and activities blocked might be
||| | addressed for perhaps a greater understanding of the function of
||| | firewalls, what they can and are used for, and other aspects
||| | related thereto.
|||
||| Really, it's important to see what was allowed too. Where I thought
||| my Primary DNS Server rule would be used only by NetZero (they are
||| NetZero addresses in there)... really a whole bunch of apps were
||| using it! But that's in the other thread!
||
|| DNS is used by any program requiring addressing information.
|
| The sole purpose of my DNS Server rule(s)...
|
| Protocol.......... UDP
| Direction......... Both
| Local Endpoint
| Ports........... 1024-5000
| Application... Any (but now I've limited it to 5 apps
| by creating 5 of these rules)
| Remote Endpoint
| Addresses.... The entire NetZero range
| Port............. 53
|
| ... is to resolve NET addresses? Still, am I right to seek to limit it
| to the five apps I kind of have to trust? Otherwise, can't it be
| appropriated by some devious app to do ill?
|
|| The key
|| is to limit to the EXACT DNS server(s) NOT within your system [unless
|| for local network traffic] and the port [53] used by that (those)
|| server(s) with limited [chosen by previous monitoring] local ports
|| and applications.
|
| Why do I need to bother with ports, if I limit the DNS rule(s) to
| trusted apps & to trusted NetZero addresses? Unfortunately, Kerio does
| not permit a list of apps in a rule, the way it does with ports &
| addresses. So, currently I have coded 5 of them...!...
|
| (1) DNS Server-- EXEC.exe (NetZero)
| (2) DNS Server-- ASHWEBSV (avast! Web Scanner)
| (3) DNS Server-- AVAST.SETUP (There actually is no program)
| (4) DNS Server-- ASHMAISV (avast! e-Mail Scanner Service)
| (5) DNS Server-- IExplore
|
|| I will NOT post all my rules or what exactly I have configured
|| locally [that would supply the exact way to circumvent my
|| protection],
|
| OK.
|
|| however I will post this contact to retreive the
|| email/news messages [your posting], with a few more inclusions
|| [again, slightly modified rules and rule logging]. This was ONLY to
|| retreive mail and the newsgroups on Microsoft. Nothing else occurred
|| BUT the logon to the ISP.
|
| OK, limited to mail & NG activities, right.
|
|| 2,[28/Jul/2007 17:22:18] Rule 'AOL UDP pass': Permitted: Out UDP,
|| localhost:1030->XXX.XXX.XXX.X:7427, Owner: C:\PROGRAM FILES\AMERICA
|| ONLINE
|| 7.0\WAOL.EXE
|
| So... WAOL.exe (which was port 1030 on your computer) needed to
| resolve an address? And it did so at XXX.XXX.XXX.X, port7427? Is that
| what that says?
|
|| 1,[28/Jul/2007 17:22:18] Rule 'Other ICMP': Blocked: Out ICMP [10]
|| Router Solicitation, localhost->224.0.0.2, Owner: Tcpip Kernel Driver
|
| I get lots of those. Here is the last I recorded...
|
| 1,[27/Jul/2007 17:40:12] Rule 'Kill ICMP (Log)': Blocked: In ICMP [8]
| Echo Request, 4.232.192.209->localhost, Owner: Tcpip Kernel Driver
|
| ..., but, beginning yesterday, I have chosen NOT to log those
| anymore. I have two rules above that blocker. One allows ICMP
| incoming for... [0] Echo Reply, [3] Destination Unreachable, [11]
| Time Exceeded
|
| The other allows it outgoing for...
| [3] Destination Unreachable, [8] Echo Request
|
| I think that's probably finalized for ICMP. In this case, specific
| apps & ports are not possible in the rules-- only specific endpoint
| addresses are. But mine apply to any address.
|
|| 2,[28/Jul/2007 17:22:18] Rule 'AOL UDP pass': Permitted: In UDP,
|| XXX.XXX.XXX.X:7427->localhost:1030, Owner: C:\PROGRAM FILES\AMERICA
|| ONLINE
|| 7.0\WAOL.EXE
|
|| 1,[28/Jul/2007 17:22:22] Rule 'Other ICMP': Blocked: Out ICMP [10]
|| Router Solicitation, localhost->ALL-ROUTERS.MCAST.NET [224.0.0.2],
|| Owner: Tcpip Kernel Driver
|
| I've never seen an ALL-ROUTERS.MCAST.NET. But this would also be
| blocked in my machine!
|
|| 1,[28/Jul/2007 17:22:24] Rule 'Other ICMP': Blocked: Out ICMP [10]
|| Router Solicitation, localhost->ALL-ROUTERS.MCAST.NET [224.0.0.2],
|| Owner: Tcpip Kernel Driver
|
|| 1,[28/Jul/2007 17:23:58] Rule 'Incoming ICMP': Blocked: In ICMP [8]
|| Echo Request, XXX.XXX.XX.XXX->localhost, Owner: Tcpip Kernel Driver
|
|| 1,[28/Jul/2007 17:26:56] Rule 'Incoming ICMP': Blocked: In ICMP [8]
|| Echo Request, XXX.XXX.XXX.XXX->localhost, Owner: Tcpip Kernel Driver
|
|| 1,[28/Jul/2007 17:29:12] Rule 'Shaw Comm block': Blocked: In UDP,
|| 24.64.192.20:17898->localhost:1026, Owner: no owner
|
| I used to get these Kerio alert's about Shaw Comm...
|
| Someone from 24.64.9.177, port 3222 wants to send UDP datagram to
| port 1027 owned by 'Distributed COM Services' on your computer.
|
| ..., but they are prevented now with a rule that specifically blocks
| RPCSS.exe (which is Distributed COM Services & which establishes the
| port 1027) from using UDP/TCP. Eventually, I hope to remove that block
| rule (& 4 others)-- after I have completed my UDP & TCP permit rules
| for speific, trusted apps/addresses. Then, RPCSS.exe will be blocked
| along with the others by virtue of not being included in the
| PERMITs-- & having one single BLOCK after them.
|
|| 1,[28/Jul/2007 17:29:12] Rule 'Shaw Comm block': Blocked: In UDP,
|| 24.64.192.20:17898->localhost:1027, Owner: no owner
|
|| 1,[28/Jul/2007 17:29:12] Rule 'Shaw Comm block': Blocked: In UDP,
|| 24.64.192.20:17898->localhost:1028, Owner: no owner
|
|| 1,[28/Jul/2007 17:29:12] Rule 'TCP ack packet attack': Blocked: In
|| TCP, 207.46.248.16:119->localhost:1072, Owner: no owner
|
| I haven't begun to finalize my TCP rules yet. That's probably where I
| go next, once UDP is done!
|
|| at which point I disconnected having retrieved mail and the news
|| messages.
|
| Nothing ELSE tried to use UDP? Not even RNAAPP.exe, RPCSS.exe,
| PersFW.exe, & PFWadMin.exe-- which are just some of the ones using it
| in here before I recently have prevented them! Well, I guess it may
| require the clicking of an URL for those to kick in.
|
|| NOTE specifically the *ALL_ROUTERS* from MCAST.NET, and the tcpip
|| Kernel requests.
|
| What specifically is notable about them?
|
|||
||| | For those who do not understand firewalls, these activities would
||| | or may have been allowed as they followed either programs IN USE
||| | [allowed activity], or through addressing [broadcast or otherwise]
||| | had a firewall not been used.
|||
||| That is right. Without a firewall with a good set of denial rules,
||| all activity is allowed. Hopefully, if a virus or a trojan or a spy
||| can sneak in that way, a good virus detector will prevent it from
||| executing. Also, there may have been an MS fix or two to prevent
||| some forms of abuse along these lines (I don't know).
||
|| What would make you think any anti-spyware or anti-virus programs
|| would check or correct these types of activities?
|
| I do believe an actual executable can be read into a machine through
| malicious use of these NET packets, although I'm not sure which
| precise protocols can do it. Once it is read in &/or tries to run,
| one hopes one's virus/malware scanner WILL catch it, before it
| delivers its payload!
|
|| Anti-spyware programs MAY block certain addresses and perhaps some
|| ActiveX, or other. Anti-virus MIGHT catch scripting or attempts to
|| infect something, or emails or files which contain hacks or other.
|
| It is still quick enough, in the cases when this bad stuff makes it
| through the firewall (or the lack of one), for these other apps to
| catch them trying to do their ill work-- if they can!
|
| BUT, I'm sure some ill-conceived packet can possibly do ill without
| delivering an executable that can be caught in another way. Somewhere
| in my 12th year of study I will know what these packets are & the
| protocols they use! But I'm hoping to get my Kerio rules solidified a
| lot sooner!
|
|| Host or lmhost files catch what they have been configured to catch
|| via addressing/name. These, however, are *network use* activities
|| WITHIN the TCP/IP and other aspects of Internet/network usage.
|| Firewalls, proxies, packet sniffers, client servers, the TCP/IP
|| kernel, and the like, are what handle these activities.
|| Of course the above is an overly simplified explanation.
|
| This isn't the year for me to really want to know every little detail,
| anyhow.
|
|||
||| | NOTE: this is contact through a dial-up connection[phone]/ISP
||| | [which is indicated via some of these addresses], ALWAYS ON
||| | connections are even more of a security risk.
|||
||| Uhuh. I am Dial-Up too. That way, you get a new IP address each
||| connect.
||
|| Only if that is what the ISP requires or desires.
|
| OK. For me, it does happen that way, I'm fairly sure.
|
|||
||| | Hopefully, this discussion will be useful to those interested and
||| | provide theory and answers to various issues.
||| | Rule sets or other settings for various firewalls would naturally
||| | be of interest.
||| |
||| | 1,[28/Jul/2007 01:33:36] Rule 'Packet to unopened port received':
||| | Blocked: In UDP, 67.170.2.174:43511->localhost:29081, Owner: no
||| | owner
|||
||| I find I have to guess as to the meaning of that. Looks like someone
||| at
||| 67.170.2.174, who is Comcast...
|||
|||
http://www.networksolutions.com/whois/results.jsp?ip=67.170.2.174
|
||| .....Quote...........
||| 67.170.2.174
||| Record Type: IP Address
|||
||| Comcast Cable Communications, Inc. ATT-COMCAST (NET-67-160-0-0-1)
||| 67.160.0.0 - 67.191.255.255
||| Comcast Cable Communications, IP Services WASHINGTON-6
||| (NET-67-170-0-0-1)
||| 67.170.0.0 - 67.170.127.255
||| .....EOQ.............
|||
||| ...sent a UDP datagram to port 29081 on your machine. But I don't
||| know...
|||
||| (1) did the port exist without an owner, & would it have received
||| the datagram (except the rule blocked it)?
||| (The name of that rule suggests the answer is no.)
||
|| The data request would have been received and likely honored.
|| The port would have been opened/created to allow this activity.
|
| I'm still thinking the port has to already be open to receive a
| packet. Is there documentation that may say otherwise?
|
|||
||| (2) did the the port once exist & at that time have an owner,
||| but somehow was closed before the datagram arrived?
||| Therefore, it couldn't get it, anyhow, even if not blocked?
||
|| If it would have been ALLOWED activity [e.g., without proxy or
|| firewall monitoring or exculsion, or within a hosts or lmhosts, or
|| other]], then a search would have been made for an available port,
|| and then created/opened. Look again at this:
|| 1,[28/Jul/2007 17:29:12] Rule 'Shaw Comm block': Blocked: In UDP,
|| 24.64.192.20:17898->localhost:1026, Owner: no owner
|| 1,[28/Jul/2007 17:29:12] Rule 'Shaw Comm block': Blocked: In UDP,
|| 24.64.192.20:17898->localhost:1027, Owner: no owner
|| 1,[28/Jul/2007 17:29:12] Rule 'Shaw Comm block': Blocked: In UDP,
|| 24.64.192.20:17898->localhost:1028, Owner: no owner
||
|| See the attempt to find or create an open port?
|
| Looks like Shaw Comm is trying to FIND one. If it could create one,
| why wouldn't it stop & just create 1026?
|
| It might still be worthwhile to block these-- but I wouldn't want to
| block them on an individual basis per abuser like Shaw Comm.
|
|| Now, should I have stayed online, there would have been continued
|| attempts [see your prior discussion where I was online longer],
|| though with different Shaw addressing and OUT ports, again stepping
|| through IN [local] ports in attempt to find or create.one.
|
| I'll look.
|
|||
||| (3) did the port 29081 never exist?
|||
||| Do any earlier log entries mention that port? You'd have to log all
||| activity of each "permit" rule to know for sure. But, if there is no
||| rule permitting the activity, then you would have received a Kerio
||| requestor mentioning the port.
||
|| No we don't need that.
|| Were an ALLOWED program or address using that aspect, then it would
|| NOT have created the denial.
|
| No, I wanted to know... did a PERMIT exist that came from port 29081?
| That would prove the port once existed & possibly initiated a
| communication with Shaw Comm. But, I'm fairly confident no such thing
| happened-- but it was Shaw Comm doing a probe. If it found it &
| activity was permitted-- mayhem such as pop-up ads or at least spying
| may have ensued, I think!
|
|| Either would have cascaded to find an
|| open port for use [as long as it was in the defined rule range].
|
| That's what I think-- it wants to find one that is already open.
|
|| AND you mention Kerio, which MUST have that turned on {requestor].
|
| Oops, that's right. "Kerio, Administration, Firewall tab" has to be
| set at "Ask me first". Then, when activity occurs that is not covered
| by a rule, an alert requestor will appear. It offers to create the
| rule, which later can be fine tuned. Yep, & that's a great feature!
|
|| Other firewalls, particularly those that automatically configure
|| themselves, MAY not pop-up anything unless it has been configured
|| that way. They also MAY pass through such requests if piggy-backed
|| from or on allowed activities/programs. Think "but all I want to know
|| is the user address". Think Microsoft's firewalls, imagine what they
|| are configured by default to allow.
|
| Yep. Kerio seems to have it all. It's highly configurable!
|
| ...snip of Kerio help page
||| | 1,[28/Jul/2007 01:34:00] Rule 'Packet to unopened port received':
||| | Blocked: In UDP, 200.112.1.7:8806->localhost:29081, Owner: no
||| | owner
|||
||| That one seems to be coming from...
|||
||| NetRange: 200.0.0.0 - 200.255.255.255
||| NetName: LACNIC-200
||
|| Yes, that is the key to your Firewall security.
|| Tracking each suspect activity to the originator, if possible.
|
| In the end, I just want to block them.
|
|| Actually were I to post prior complete TRACKING logs [which I
|| collect(ed) for specific use], say for one day's normal usage, vast
|| numbers of potentially dangerous attacks/attempts would be shown.
|
| By the way, how do you empty Kerio's Filter.log, when you think you've
| seen enough? (I've been deleting it in DOS along with Filter.log.idx.)
|
| ...snip of stuff not meant for me, but thanks for the additional URLs
| to research. And thanks for continuing to contribute to my
| understanding of it.
|
|| Of course SYSINTERNALS/WINTERNALS has some nice tools - look on
|| Microsoft's TechNet
||
|
| OK, I see here again are the other "no owner's"...
|
|||
||| | 1,[28/Jul/2007 01:34:06] Rule 'Packet to unopened port received':
||| | Blocked: In UDP, 218.10.137.139:55190->localhost:1026, Owner: no
||| | owner
|
| This is an attempt to send a UDP packet to port 1026. I still doubt it
| really needs to be blocked, if the port indeed does not exist. For
| UDP, I favor PERMITs of trusted apps from trusted addresses-- & one
| single block of UPD afterwards that will cover all others. (But I'm
| not even totally set up that way, myself, yet.) And I want to do it
| that way for TCP too.
|
| ...snip of other In UDP.
|
| 1,[28/Jul/2007 01:36:04] Rule 'Packet to unopened port
||| | received': Blocked: In TCP, 219.148.119.6:12200->localhost:7212,
||| | Owner: no owner
|
| Ah-- a TCP! Soon, I must do with TCP what I nearly am finishing with
| UDP!
|
| ...snip
||| | 1,[28/Jul/2007 01:36:08] Rule 'TCP ack packet attack': Blocked: In
||| | TCP, msnews.microsoft.com [207.46.248.16:119]->localhost:1186,
||| | Owner: no owner
|
| I don't believe I've seen one of those. Could be I'm just not tracking
| the rule that does it. Looks like msnews.microsoft.com was still
| trying to communicate after the NET connection was closed. What app
| controlled localhost:1186?
|
| ...snip of a bunch more of In UDPs & possibly In TCPs.
--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
Should things get worse after this,
PCR
pcrrcp@netzero.net
.