Category: Security

Generally speaking, few people on the Internet are out to get you specifically. In truth, they’re out to get anyone whose systems they can possibly gain access to. Obviously the Internet is a huge, immense place, so how do they find people? Well, the most basic tool employed by automated bots and those out to hack user systems is known as a port scanner. This software allows a hacker to input a range of IP addresses (typically those on high-speed networks like DSL), and then scan for a particular open port, or all open ports. In most cases, a hacker will scan for a single port associated with a known exploit, such as a virus or Trojan horse program that allows them to gain access to your PC. Using a port scanner allows then to look for that open port on thousands of systems in very little time. In fact, they can set up the scan, head to bed, and then be presented with a very comprehensive list of “attackable” systems in the morning.

In case you’re curious, this is one of the ways that providers also check to see whether you have servers on your home network, which is often not allowed under their terms of service.
One of the best ways for you to defend yourself is to scan your own public IP address looking for open ports. One easy (and free) piece of software to accomplish this is SuperScan, shown above. It can be downloaded from http://www.foundstone.com/resources/scanning.htm. Additionally, a number of web-based port scanners are available online, often referred to as firewall testing tools.

Earlier in this article we mentioned that a firewall could also be used to control the services that internal hosts can access on the Internet. While most hardware routers are initially configured to allow all hosts access to any Internet services by default, you can also control who can access the Internet, or certain services, using filtering features.

On a hardware router like the Linksys model we used for this article, both IP address and port filtering can be accomplished via the Filtering tab in the router configuration program. This tab allows you to configure both IP addresses that cannot access the Internet, along with ports that cannot be connected to. For example, if you were to filter the IP address 192.168.1.50, the client system with that address would not be able to access the Internet at all. This can be useful in situations where you need to control children accessing the Internet, for example.

Similarly, you can also block internal users from accessing certain ranges of ports. For example, blocking port 80 would stop internal users from accessing external websites, while blocking all ports except for port 80 would stop users from accessing anything except Web sites. Ultimately, the ability to control Internet access by IP address and port numbers gives you a higher degree of control over how people use your Internet connection, and most importantly, your bandwidth.

Although a firewall will block all requests from the outside world by default, there may be times when you actually want to allow external users into your network. For example, maybe you’re running an FTP server internally that you want to gain access to while on the road, or maybe you have a Web server configured that you want to allow Internet users to access. Because the default configuration of most firewalls blocks all external requests, you’ll need to open things up using a feature known as port forwarding.
Remember that in almost all cases, your internal network will be configured to use private IP addresses. Because of this, you’ll need to configure your firewall to take requests destined for your public or “real” IP address and forward them to the appropriate internal server. For example, let’s say that you have a Web server configured on a system with the IP address 192.168.1.50, a private address. In order to allow external users to access this server, you’ll need to configure your firewall to “listen” for Web server requests on the external IP address, and then forward them to the internal server at 192.168.1.50. Unfortunately, to make all this work, you need to know one additional piece of information – namely the port to which Web requests are made.
When a user on the Internet needs to contact a Web server, the request is forwarded to the IP address of the server, and the port on which the Web server service is running. By default, all Web server software (such as IIS or Apache) listens for requests on TCP port 80. So, what you would need to do in this case is tell the firewall that every time your public IP address receives a request destined for TCP port 80, it should forward the request to TCP port 80 on the Web server running on 192.168.1.50. The manner in which this is configured depends upon the firewall you are using. The stepped instructions below provide details for configuring port forwarding on a hardware device, in this case a Linksys router – note that the exact steps will probably be different based on your hardware.

If you don’t see the service that you want to configure on the list, you can define your own forwarding rules by clicking the Add button and specifying a name for the service, as well as an IP address and port number(s).

Example: Allow access to your internal FTP server from the Internet using your Linksys router.

Step 1: Open a web browser and access address http://192.168.1.1. This is the default address to access the router configuration. Enter your password (check your documentation) and press Enter.

Step 2: Click on the Advanced tab at the top of the screen. This will bring you into advanced configuration options for the router, such as port forwarding and filtering. Click the forwarding tab.

Step 3: In the first line of Service Port Range numbers, enter 21 in both boxes, and then the IP address of your internal FTP server in the IP Address box. In this case, an FTP server is located at 192.168.1.150. Click Apply. Test everything by attempting to connect to your external IP with an FTP client program and see if you reach your internal server.

If you’re planning to connect your network to the Internet, chances are good that your ISP will provide you with only a single “real” IP address. The good news is that’s all you’ll need for multiple internal PCs to connect to the Internet. Network Address Translation (NAT) is a feature that allows systems on an internal network to use private IP addresses (such as those in the 192.168.0.0 range) to connect to the Internet using only one “real” IP address. When an internal system needs to access an Internet resource such as a Web server, the request is sent to the default gateway, which would be running NAT. The NAT server would take that request, translate the “source” IP address in the request to be the “real” IP address assigned by your ISP, and then forward the request along to the site you are trying to connect to. The reply will be sent back to this “real” address as well, where the NAT server will change the destination address to be that of the internal client that originally made the request. To keep everything organized, the NAT system maintains a table that maps internal requests to external requests, allowing multiple internal systems to share a single “real” IP address.

Thankfully, configuring NAT does not take a degree in rocket science. All home routers are configured as NAT servers by default – all you need to do is connect everything correctly, configure clients to obtain their IP addresses automatically (via DHCP), and the rest is history – NAT is up and running, and there’s nothing left for you to do. Same goes if you’re sharing an Internet connection using the ICS feature in Windows 98/ME/XP – ICS effectively is a type of NAT implementation, although Microsoft has given it a catchier name. Again, as long as ICS is enabled and clients are configured to obtain their IP addresses automatically, you’re good to go. Both ICS and almost all hardware routers include integrated DHCP server functionality to allocate IP addresses to clients on your internal network.

Although the basic DHCP server functionality included with most NAT devices and software (like ICS) makes it easier for users to configure their home network, there may be times when you want to allocate dedicated static IP addresses to internal clients. For example, you might be running an internal Web server, and not want its IP address to change, which may occur with DHCP. Although Microsoft explicitly states that clients must be using DHCP in order to function on an ICS network, this technically isn’t true. You can definitely assign static IP addresses to clients, but you’ll have to be careful about the addresses you use.

For example, when ICS is configured, the internal interface of the ICS system will be configured with an IP address of 192.168.1.1 – this cannot be changed, as other clients will use it as their default gateway. Then ICS will hand out addresses using DHCP starting with 192.168.1.2, moving upwards to 192.168.1.3, and so forth. You cannot configure the addresses that will be allocated with ICS, but you can give a client a sufficiently “high” address that ICS will likely never reach. In this example, you might give a client the static address 192.168.1.100 – an address that ICS is unlikely to hand out unless you have almost 100 computers on your network.

Choosing a high number allows you to avoid potential conflicts, which is the main reason for Microsoft’s “warning”. Besides specifying a “higher” IP address, be sure to use the correct subnet mask (255.255.255.0), as well as the correct default gateway (192.168.1.1) used by ICS, and everything will work fine. One other note – when your network is using ICS, you should not configure clients with the address of a DNS server, since the ICS system will handle DNS requests on behalf of clients.

If you’re using a hardware router that includes DHCP functionality, you can usually control the IP addresses that are handed out by the router. To avoid conflicts, assign static addresses that are outside of the configured DHCP pool.

While once strictly the domain of UNIX geeks and enterprise network administrators, almost all PC users today have at least heard of a firewall. At the most basic level, a firewall is a hardware device or software application that allows you to control the types of network traffic that travel into and out of a network. For example, a company might configure their firewall to allow internal users to connect to Web and FTP servers on the Internet, but block them from connecting to other services like MSN or Yahoo Messenger. In large companies, a firewall is typically a dedicated hardware device capable of handling anywhere from hundreds to thousands of simultaneous connections. For home users, firewall-type functionality is typically built into home Internet-sharing routers, or implemented using software such as ZoneAlarm. Windows XP also includes a dedicated software firewall in the form of its Windows Firewall feature.

The most common reason for implementing a firewall is to block external users from accessing systems on your internal network. The default configuration of most home firewall hardware and software allows all traffic that originates internally to access the Internet, but blocks all requests from external users by default. This is simply the most logical default configuration, especially for new users – it keeps the bad guys out, while allowing internal users to access Internet resources without issue. In some cases you may want to allow Internet users to connect to an internal system, such as an FTP or game server – we’ll explore how to address that need in a future article.

When implementing a home network that has any Internet connection (such as DSL, or even dial-up), a firewall should be considered mandatory, not optional. All internal network systems should be located “behind” the firewall. If you share an Internet connection through a device like a Linksys router, the router would act as your firewall. If you’re sharing an Internet connection with a Windows feature like Internet Connection Sharing (ICS), then the system running ICS should be configured with firewall software.

It’s one thing to have a firewall, and quite another to ensure it is functioning correctly. Almost all hardware and software firewalls (including ICF) support a “logging” function. This is usually disabled by default, but enabling it is a good idea – it will provide you with information about all external users who have attempted to connect to your network in a file called C:\Windows\pfirewall.log by default. Programs like ZoneAlarm can also be configured to display an on-screen message any time an external user attempts to connect to the firewall system.

Forensics is becoming a popular following, thanks to the multitude of TV shows that show crime scene technicians collecting evidence, spending a few minutes in the lab determining the guilt of the culprit, and wrapping up the case at the end of the show. But in real life, forensics, like other complex issues distilled on TV, is much more time-consuming, process intensive, and sometimes inconclusive. The art and science of computer forensics is no different. Digital forensics is gaining in popularity as the next must-have skill set in the IT job market arsenal. However, computer forensics technicians and analysts require some intensive and usually expensive training.

Since computer-related incidences are sometimes few and far between (the ones that are discovered, anyway), most companies don’t see an immediate return on investment by hiring someone exclusively devoted to that task. Only a few more see some value in expensive training for the support technicians and system administrators that are already working for them, since they may never have a need for these skills. As a result, when incidents do happen and are actually discovered, the company may find itself in a situation where the “server guy” or other support technician may be called upon to do the initial response to the incident. Despite lack of training or experience, this article is here to help you with a few critical points that can make or break your investigation and ensure that key evidence is not contaminated or rendered unusable in administrative or legal actions. We’re not going to make you a forensics expert, but you will at least be able to handle the critical first response tasks.