Firewalls

[Malak]

Make your post relevant and worth noting. Explain why or why not you think a firewall is necessary for the average home user(not servers). GO!

 

[AFB]

NAT is good enought if that's what you're asking.

 

[Zap Brannigan]

A firewall is key for the following reasons:

1. If configured properly it can make your computer safer from most hackers.

2. If you do not have a firewall your computer is visible and vulnerable to hackers as long as you are connected to the web

3. Trojan horses need to beam back to the mothership to work. A firewall will alert you to suspicious outgoing traffic and allow you to block acess.

4. Cable connections are "always on". If your computer is turned on you are connected to the net.

5. A firewall will block suspicious incoming traffic.

6. A computer with no fire wall is to malicious hacker what an open vault to a bank robber.

7. Infected PC's are often used to attack others so by proxy you could be respnsible for damage to others networks or pc's by ignorance or laziness.

8. Insert Mr. T-ism here.

 

[Malak]

Originally posted by: Zap Brannigan
A firewall is key for the following reasons:

1. If configured properly it can make your computer safer from most hackers.

2. If you do not have a firewall your computer is visible and vulnerable to hackers as long as you are connected to the web

3. Trojan horses need to beam back to the mothership to work. A firewall will alert you to suspicious outgoing traffic and allow you to block acess.

4. Cable connections are "always on". If your computer is turned on you are connected to the net.

5. A firewall will block suspicious incoming traffic.

6. A computer with no fire wall is to malicious hacker what an open vault to a bank robber.

7. Infected PC's are often used to attack others so by proxy you could be respnsible for damage to others networks or pc's by ignorance or laziness.

8. Insert Mr. T-ism here.

In my tests with blackice I found the only time I was probed was when I launched a web server application. Otherwise, nothing. I eventually discontinued use of said firewall and have never gotten another one. I also rarely run anti-virus, spybot S&D, and adaware, but when I do they never find anything. I believe a firewall is for the paranoid, but that's just from my own experience.

Do you have any experience showing how any of your points are worth noting? Ever been hacked? I keep my stuff updated(browser, OS, etc). Seems to me most exploits are used on a mass level after a patch is found. I use more secure software and keep it updated, so I am never hit with these attacks. Is my approach less safe than simply throwing the switch on a firewall?

 

[Zap Brannigan]

Secure Software? Ha!

Black Ice Defender was known to be a giant security hole awhile back. I assume and hope they fixed the problem by now.

Ping sweeps are as common as mosquitos!

Not to mention malware, spyware rootkits et cetera.

There is much going on underneath the carpet once lifted!

 

[Zap Brannigan]

Malak; do you have a router?

Many routers double as hardware firewalls.

 

[warcrow]

Originally posted by: Zap Brannigan
A firewall is key for the following reasons:

1. If configured properly it can make your computer safer from most hackers.

2. If you do not have a firewall your computer is visible and vulnerable to hackers as long as you are connected to the web

3. Trojan horses need to beam back to the mothership to work. A firewall will alert you to suspicious outgoing traffic and allow you to block acess.

4. Cable connections are "always on". If your computer is turned on you are connected to the net.

5. A firewall will block suspicious incoming traffic.

6. A computer with no fire wall is to malicious hacker what an open vault to a bank robber.

7. Infected PC's are often used to attack others so by proxy you could be respnsible for damage to others networks or pc's by ignorance or laziness.

8. Insert Mr. T-ism here.

.nuff said right there. Besides, if you have a router with a firewall, why wouldnt you want one?

 

[Malak]

Originally posted by: Zap Brannigan
Malak; do you have a router?

Many routers double as hardware firewalls.

I do now, but not always. I assume my router helps enough as it is, but even before the router I didn't have the need.

 

[JackMDS]

You can leave your Home and your Car unlocked. Nothing would happen for a while but that does not mean that it secure to do so.

When it would happen you would feel very sorry, and would say ?if I only Knew??

So just in case, copy and paste these links and keep them handy.

Link: Basic Protection for Broadband Internet Installation.

Link to: Internet infestation - Or, how you are getting Internet "Junk" in and compromise your Computer/Network?

Link to: Basic Steps in cleaning Internet "Junk".

:sun:

 

[Nothinman]

I do now, but not always. I assume my router helps enough as it is, but even before the router I didn't have the need.

It takes longer to download all of the available Windows patches than it does to get infected while on the Internet. While a "hardware" router will protect you from that, it won't do anything for "rogue" software on your machine like spyware, trojans, etc.

 

[Malak]

Originally posted by: JackMDS
You can leave your Home and your Car unlocked. Nothing would happen for a while but that does not mean that it secure to do so.

When it would happen you would feel very sorry, and would say ?if I only Knew??

I locked my car and they broke the window. I kept the car unlocked and they simply took the stuff. It was less pain to keep it unlocked.

However, this is not a good comparison. There is nothing to steal on my computer.

 

[AFB]

Originally posted by: malak

Originally posted by: JackMDS
You can leave your Home and your Car unlocked. Nothing would happen for a while but that does not mean that it secure to do so.

When it would happen you would feel very sorry, and would say ?if I only Knew??

I locked my car and they broke the window. I kept the car unlocked and they simply took the stuff. It was less pain to keep it unlocked.

However, this is not a good comparison. There is nothing to steal on my computer.

Then why do you ask? Please don't start threads just to have an arguement.

 

[Nothinman]

However, this is not a good comparison. There is nothing to steal on my computer.

Sure there is, bandwidth and CPU time. Maybe you'll be lucky enough to participate in the next big DoS attack on some company.

 

[drag]

Originally posted by: malak

Originally posted by: JackMDS
You can leave your Home and your Car unlocked. Nothing would happen for a while but that does not mean that it secure to do so.

When it would happen you would feel very sorry, and would say ?if I only Knew??

I locked my car and they broke the window. I kept the car unlocked and they simply took the stuff. It was less pain to keep it unlocked.

However, this is not a good comparison. There is nothing to steal on my computer.

Ever buy anything online? Ever use your computer to look at your bank statements, pay bills, get insurance, look at credit card statements, balance your taxes.

Ever by Ebay?
Paypal?
amazon?
any online store?
any anything?

If you do any of those things, then there is something to steal on your computer.

 

[Malak]

Originally posted by: drag

Originally posted by: malak

Originally posted by: JackMDS
You can leave your Home and your Car unlocked. Nothing would happen for a while but that does not mean that it secure to do so.

When it would happen you would feel very sorry, and would say ?if I only Knew??

I locked my car and they broke the window. I kept the car unlocked and they simply took the stuff. It was less pain to keep it unlocked.

However, this is not a good comparison. There is nothing to steal on my computer.

Ever buy anything online? Ever use your computer to look at your bank statements, pay bills, get insurance, look at credit card statements, balance your taxes.

Ever by Ebay?
Paypal?
amazon?
any online store?
any anything?

If you do any of those things, then there is something to steal on your computer.

Point out one thing on my computer that links to any of that. One thing that will allow them to access any of it. I've done every single thing you've listed.

 

[Malak]

Originally posted by: amdfanboy
Then why do you ask? Please don't start threads just to have an arguement.

But that's the only way to learn. Be it myself or others. Perhaps you are wasting space on your harddrive having a firewall installed. Perhaps I'm vulnerable. My experience says I'm right and I think it's pointless to have a firewall running, let alone most real-time protection. That's why I started this thread. If you have nothing to contribute, then don't post.

 

[t3hmuffinman]

Originally posted by: amdfanboy
Then why do you ask? Please don't start threads just to have an arguement.

lol, I am a little confused about this too. he had this thread and said make it worth while and worth noting, and I was thinking "that's a little demanding for advice on firewalls, but whatever" and then he started arguing with people trying to help... no one is forcing anyone to use firewalls and anti virus.

anyways, I use a router, a firewall, an antivirus, and I occassional do scans with 3 different spyware programs (okay, that part is paranoia, but it helps me sleep at night ). Recently i've found 0 things, but I know they work because before I was more acquainted with my computer I was full of spyware all sorts and it was horrible. Also, there are some trojans/viruses that get into your computer from just being connected to the internet... I recall an article saying the average time for an unprotected computer to become infected with a virus was 16 minutes.

 

[Malak]

Originally posted by: t3hmuffinman
anyways, I use a router, a firewall, an antivirus, and I occassional do scans with 3 different spyware programs (okay, that part is paranoia, but it helps me sleep at night ). Recently i've found 0 things, but I know they work because before I was more acquainted with my computer I was full of spyware all sorts and it was horrible. Also, there are some trojans/viruses that get into your computer from just being connected to the internet... I recall an article saying the average time for an unprotected computer to become infected with a virus was 16 minutes.

I never had an AV, firewall, or any type of spyware protection. A while after the whole spyware craze started I downloaded various free software to check my machine. Nothing. I've had this computer running for 2 years.

If I can go free of all this extra protection, why can't the rest of you? Is it really true that I am unprotected? Or are you overprotected? I do not believe I am the exception. And that is why I started this thread. Has anyone really tested the theory you can't last more than 16 minutes? I lasted a couple years.

 

[Nothinman]

Point out one thing on my computer that links to any of that. One thing that will allow them to access any of it. I've done every single thing you've listed.

The next IE bug that hasn't been uncovered yet. It's not like you know when one will pop up and you can't guarantee you'll have the patch installed before an exploit is put on some webpage.

And drag's point was that if you've ever used online bill pay, bought something via ebay, etc then there is personal information on your machine that someome might like to get their hands on, not that those specific actions open you up to exploitation.

 

[Malak]

Originally posted by: Nothinman

Point out one thing on my computer that links to any of that. One thing that will allow them to access any of it. I've done every single thing you've listed.

The next IE bug that hasn't been uncovered yet. It's not like you know when one will pop up and you can't guarantee you'll have the patch installed before an exploit is put on some webpage.

And drag's point was that if you've ever used online bill pay, bought something via ebay, etc then there is personal information on your machine that someome might like to get their hands on, not that those specific actions open you up to exploitation.

But where is this so-called personal information that supposedly sits on my computer waiting to be stolen? And I don't use IE, so any IE bug won't affect me.

 

[drag]

Originally posted by: malak

Originally posted by: drag

Originally posted by: malak

Originally posted by: JackMDS
You can leave your Home and your Car unlocked. Nothing would happen for a while but that does not mean that it secure to do so.

When it would happen you would feel very sorry, and would say ?if I only Knew??

I locked my car and they broke the window. I kept the car unlocked and they simply took the stuff. It was less pain to keep it unlocked.

However, this is not a good comparison. There is nothing to steal on my computer.

Ever buy anything online? Ever use your computer to look at your bank statements, pay bills, get insurance, look at credit card statements, balance your taxes.

Ever by Ebay?
Paypal?
amazon?
any online store?
any anything?

If you do any of those things, then there is something to steal on your computer.

Point out one thing on my computer that links to any of that. One thing that will allow them to access any of it. I've done every single thing you've listed.

What do you think that only information stored in files is usefull to a hacker? Every single thing that you do on your computer is capable of being monitored and interecepted. Hell a braindead guy could install a keylogger, or edit your hosts file to redirect DNS query results for hundreds of banks to go thru his online server were he can cache the data as you access it.

These are just simple brain-dead stuff and you probably wouldn't notice it. Then there are actual sophisticated things that a person can install that sit at a low level of your OS that will intercept system calls and such and make even gigabyte files invisable to the user and any scanning software.

There are all sorts of stuff that a person can do that undectable by virus scanners or anti-spyware software or by a user.

It's not a good idea to ever expose any Windows machine on the internet without a firewall protection. If your using a home NAT-style router were it assigns a private address to your computer then that is acceptable and there is no real need for a local firewall.

Sure if you keep your system up to date then you can avoid the occasional worm, but your sadly mistaken if you think that it would keep you safe from even a casually determined human attacker. The only thing that keeps you safe is the fact that your one of millions of potential targets.

The only thing I'd trust exposed on the internet is OpenBSD's default installation, or a tweaked and hardenned version of Linux or FreeBSD. There is a reason why MS gives you a firewall by default. You need it and should use it. A Nat firewall is good enough, but there is no reason not to use one of the wide veriaty of free firewall software aviable for your computer if it's not going to cause huge headaches.

 

[Nothinman]

But where is this so-called personal information that supposedly sits on my computer waiting to be stolen? And I don't use IE, so any IE bug won't affect me.

So an Opera bug or an AIM bug or an Outlook bug, the entry point is irrelevant. Do you mean to tell me you have no cookies on your machine from places that you've bought stuff from? And since you don't run any AV on your machine you could have a keylogger installed right now and not even know it.

 

[drag]

Originally posted by: malak

Originally posted by: t3hmuffinman
anyways, I use a router, a firewall, an antivirus, and I occassional do scans with 3 different spyware programs (okay, that part is paranoia, but it helps me sleep at night ). Recently i've found 0 things, but I know they work because before I was more acquainted with my computer I was full of spyware all sorts and it was horrible. Also, there are some trojans/viruses that get into your computer from just being connected to the internet... I recall an article saying the average time for an unprotected computer to become infected with a virus was 16 minutes.

I never had an AV, firewall, or any type of spyware protection. A while after the whole spyware craze started I downloaded various free software to check my machine. Nothing. I've had this computer running for 2 years.

If I can go free of all this extra protection, why can't the rest of you? Is it really true that I am unprotected? Or are you overprotected? I do not believe I am the exception. And that is why I started this thread. Has anyone really tested the theory you can't last more than 16 minutes? I lasted a couple years.

The tests your talking about are done on unpatched Windows XP with SP1 machines installed from retail or OEM software packages by default. They lasted only a few minutes before the first worms found them and isntall themselves on those machines.

if you keep a Windows Xp machine up to date constantly you can aviod most of the malicious software out there, but those are automated dumb attacks. They mearly emulate the actions of a human going after the most common and most easily exploitable flaws. To defend yourself from a individual is much more difficult.

 

[Malak]

And I've heard lots of headaches using this protective software, which is why I avoid it. Frankly, all you've shown is theories, what ifs, and paranoia. Has any of this happened to you? Like I said, I don't use protective software like AVs and firewalls because I never get attacked. How do you know you ever get attacked?

 

[Nothinman]

Frankly, all you've shown is theories, what ifs, and paranoia. Has any of this happened to you?

No, because I use Linux on all of my machines but it's happened to pretty much everyone I know that uses Windows. Eventually one sneaks by, even if it's something stupid and small that just does something like constantly resetting your IE start page. And you don't have to tell me again that you don't use IE.

Like I said, I don't use protective software like AVs and firewalls because I never get attacked. How do you know you ever get attacked?

I do get attacked, pretty regularly actually. I just know they don't get in because I am paranoid and I've taken the time to secure my systems. Though most of the attacks I see are annoying IIS worms that don't affect me since I'm using Apache and ssh password guessing worms. Occasionally when browsing "racy" web sites I also see attempts to download dialers and other executables onto my machine, but since I use FF it just asks me if I want to save it or not so I just hit cancel.

Dec 22 10:27:56 server_hostname sshd[19767]: Failed password for nobody from ::ffff:211.21.67.66 port 46975 ssh2
Dec 22 10:28:00 server_hostname sshd[19772]: Failed password for illegal user patrick from ::ffff:211.21.67.66 port 47162 ssh2
Dec 22 10:28:03 server_hostname sshd[19775]: Failed password for illegal user patrick from ::ffff:211.21.67.66 port 47271 ssh2
Dec 22 10:28:07 server_hostname sshd[19777]: Failed password for root from ::ffff:211.21.67.66 port 47346 ssh2
Dec 22 10:28:10 server_hostname sshd[19780]: Failed password for root from ::ffff:211.21.67.66 port 47416 ssh2
Dec 22 10:28:13 server_hostname sshd[19785]: Failed password for root from ::ffff:211.21.67.66 port 47498 ssh2
Dec 22 10:28:17 server_hostname sshd[19787]: Failed password for root from ::ffff:211.21.67.66 port 47573 ssh2
Dec 22 10:28:20 server_hostname sshd[19790]: Failed password for root from ::ffff:211.21.67.66 port 47653 ssh2
Dec 22 10:28:23 server_hostname sshd[19793]: Failed password for illegal user rolo from ::ffff:211.21.67.66 port 47727 ssh2
Dec 22 10:28:27 server_hostname sshd[19795]: Failed password for illegal user iceuser from ::ffff:211.21.67.66 port 47809 ssh2
Dec 22 10:28:30 server_hostname sshd[19798]: Failed password for illegal user horde from ::ffff:211.21.67.66 port 47880 ssh2
Dec 22 10:28:33 server_hostname sshd[19801]: Failed password for illegal user cyrus from ::ffff:211.21.67.66 port 47959 ssh2
Dec 22 10:28:36 server_hostname sshd[19803]: Failed password for illegal user www from ::ffff:211.21.67.66 port 48033 ssh2
Dec 22 10:28:39 server_hostname sshd[19806]: Failed password for illegal user wwwrun from ::ffff:211.21.67.66 port 48108 ssh2
Dec 22 10:28:43 server_hostname sshd[19811]: Failed password for illegal user matt from ::ffff:211.21.67.66 port 48181 ssh2
Dec 22 10:28:46 server_hostname sshd[19813]: Failed password for illegal user test from ::ffff:211.21.67.66 port 48258 ssh2
Dec 22 10:28:49 server_hostname sshd[19816]: Failed password for illegal user test from ::ffff:211.21.67.66 port 48342 ssh2
Dec 22 10:28:53 server_hostname sshd[19819]: Failed password for illegal user test from ::ffff:211.21.67.66 port 48415 ssh2
Dec 22 10:28:56 server_hostname sshd[19821]: Failed password for illegal user test from ::ffff:211.21.67.66 port 48495 ssh2

--

adsl-67-113-84-15.dsl.lsan03.pacbell.net - - [30/Dec/2004:13:47:56 -0500] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-" "-"
adsl-67-113-84-15.dsl.lsan03.pacbell.net - - [30/Dec/2004:13:47:57 -0500] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-" "-"
adsl-67-113-84-15.dsl.lsan03.pacbell.net - - [30/Dec/2004:13:47:57 -0500] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-" "-"
adsl-67-113-84-15.dsl.lsan03.pacbell.net - - [30/Dec/2004:13:48:01 -0500] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215 "-" "-"
adsl-67-113-84-15.dsl.lsan03.pacbell.net - - [30/Dec/2004:13:48:01 -0500] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215 "-" "-"
adsl-67-113-84-15.dsl.lsan03.pacbell.net - - [30/Dec/2004:13:48:02 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "-" "-"
adsl-67-113-84-15.dsl.lsan03.pacbell.net - - [30/Dec/2004:13:48:03 -0500] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "-" "-"
c-67-165-85-194.client.comcast.net - - [31/Dec/2004:11:31:29 -0500] "POST /_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1" 404 235 "-" "-"
c-67-165-85-194.client.comcast.net - - [01/Jan/2005:02:38:20 -0500] "POST /_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1" 404 235 "-" "-"