{"id":158,"date":"2021-08-30T06:39:41","date_gmt":"2021-08-30T06:39:41","guid":{"rendered":"https:\/\/www.practicallynetworked.com\/?page_id=158"},"modified":"2021-10-05T17:00:08","modified_gmt":"2021-10-05T17:00:08","slug":"lan-security-threats","status":"publish","type":"post","link":"https:\/\/www.practicallynetworked.com\/lan-security-threats\/","title":{"rendered":"LAN Security Threats"},"content":{"rendered":"<p>(Be sure to read the &#8220;<a href=\"https:\/\/www.practicallynetworked.com\/securnet.htm\"><b>Secure your Lan<\/b><\/a>&#8221; page!)<\/p>\n<p>LAN security risks come in different forms.\u00a0 Here is some information on the most common ones.<\/p>\n<p><b><span style=\"font-family: Arial; font-size: large;\">Viruses<\/span><\/b><br \/>\nViruses are generally not a &#8220;<em>security<\/em>&#8221; threat to the computers on your LAN (although they\u00a0<em>can<\/em>\u00a0cause plenty of problems).\u00a0 The main effect of viruses can be erratic operation of your computers, possible data loss, and the ability to pass on the virus to other networked users.<\/p>\n<p>Viruses are most commonly spread through two methods:<\/p>\n<ul>\n<li>floppy disks or other removable media that are used to transfer files from one computer to another<\/li>\n<li>email attachments<\/li>\n<\/ul>\n<p>Your best defense against viruses is to run a good anti-virus program and<b><i>\u00a0keep the virus database updated\u00a0<\/i><\/b>(at least monthly).<\/p>\n<p><b><span style=\"font-family: Arial; font-size: medium;\">Email Attachments<\/span><\/b><br \/>\nIn case you&#8217;ve just come out of a coma or have returned to the planet after a long absence,\u00a0 I&#8217;m doing my cyber-civic duty by repeating what should be firmly embedded in your brain by now:<\/p>\n<ul>\n<li>\n<p align=\"left\"><i><b><span style=\"color: #ff0000; font-family: Arial;\">Rule #1: Never, never, never open email attachments that come from people that you don&#8217;t know.<br \/>\nJ U S T\u00a0 P R E S S\u00a0 D E L E T E !<\/span><\/b><\/i><\/p>\n<\/li>\n<li>\n<p align=\"left\"><span style=\"font-family: Arial;\"><b>Rule #2:\u00a0<\/b>If the attachment is a\u00a0<i><b>forwarded<\/b><\/i>\u00a0joke, video, audio, .vbs or whatever kind of file\u00a0<\/span><i><b><span style=\"color: #ff0000; font-family: Arial;\"><br \/>\nJ U S T\u00a0 P R E S S\u00a0 D E L E T E !<\/span><\/b><\/i><\/p>\n<\/li>\n<li>\n<p align=\"left\"><b><span style=\"font-family: Arial;\">Rule #3:<i><span style=\"color: #ff0000;\">\u00a0<\/span><\/i><\/span><\/b><span style=\"font-family: Arial;\">As\u00a0<b>Melissa<\/b>\u00a0and\u00a0<b>LoveBug<\/b>\u00a0and their variants have shown, if you receive an unexpected email attachment from someone that you\u00a0<i><b>do<\/b><\/i>\u00a0know, check with them\u00a0<b><i>before opening it<\/i><\/b>\u00a0to be sure that they meant to send it and to find out what is in it.<\/span><\/p>\n<\/li>\n<li>\n<p align=\"left\"><b><span style=\"font-family: Arial;\">Rule #4:<i><span style=\"color: #ff0000;\">\u00a0<\/span><\/i><\/span><\/b><span style=\"font-family: Arial;\">If the attachment is a legitimate file from a known source, you should still scan it with up to date anti-virus software before opening it.<br \/>\n(Your anti-virus program should have a mode where it will do this scan automatically, but you should check and make sure that it is running!)<\/span><\/p>\n<\/li>\n<\/ul>\n<p>Get the picture?\u00a0 If in doubt, throw it out!\u00a0 If it&#8217;s a legitimate file, it can always be resent, after you check with the sender!\u00a0 The people who create these things are getting nastier and cleverer, and it just isn&#8217;t worth taking the risk of losing even one file due to what boils down to curiousity!<\/p>\n<p><b><span style=\"font-family: Arial; font-size: large;\">Probes<\/span><\/b><br \/>\n<em>Probes<\/em>\u00a0or\u00a0<em>port scanners<\/em>\u00a0check for improperly secured servers or services that may be running on computers on your LAN (especially the one that is directly connected to the Internet).\u00a0 These checks are usually performed by programs that take a range of IP addresses selected by the person running the program, and look for common services like Web, mail, FTP, Telnet, pcAnywhere, or proxy servers.\u00a0 (<a href=\"http:\/\/www.isi.edu\/in-notes\/iana\/assignments\/port-numbers\" target=\"_offsite\" rel=\"noopener\"><b>Check here<\/b><\/a>\u00a0for a list of &#8220;well-known&#8221; TCP\/IP port numbers).<\/p>\n<p>If any of these (or other) services are found, the program tries to see if it can login or otherwise gain access to that service.\u00a0 If it can, it flags that IP address and service to the person running the program and what happens after that depends on what they have in mind for your system!<\/p>\n<p>Your best defense against probes is to not run any servers or services that you don&#8217;t understand, or are not sure what they are used for.\u00a0 You also should properly secure any services that you do run.\u00a0 Finally, if you are a relative &#8220;newbie&#8221; and\/or especially paranoid about intruders,\u00a0<em>don&#8217;t run the free Wingate 2.1d version<\/em>, which is easily misconfigured and can allow intruders into your LAN.<\/p>\n<p><b><span style=\"font-family: Arial; font-size: large;\"><a name=\"Trojan\"><\/a>Trojan Horses<\/span><\/b><br \/>\n&#8220;Trojan Horses&#8221;, are programs that are somehow downloaded and installed on computers in your LAN.\u00a0 Although physical access to the target computer is a common method of installation,\u00a0 these programs can be installed via network access to an unprotected shared network drive.<\/p>\n<p><a href=\"http:\/\/www.nwinternet.com\/~pchelp\/bo\/bo.html\" target=\"_offsite\" rel=\"noopener\"><b>Back Orifice<\/b><\/a>\u00a0and\u00a0<a href=\"http:\/\/www.nwinternet.com\/~pchelp\/nb\/netbus.htm\" target=\"_offsite\" rel=\"noopener\"><b>NetBus<\/b><\/a>\u00a0are perhaps the most infamous in the Windows world. \u00a0<span style=\"color: #ff0000;\"><em><b>\u00a0They can allow an unknown person to do almost anything that they want with the computer that B.O. is running on<\/b><\/em><\/span>.\u00a0 (<a href=\"http:\/\/www.sans.org\/newlook\/resources\/IDFAQ\/oddports.htm\" target=\"_offsite\" rel=\"noopener\"><b>Check here<\/b><\/a>\u00a0or\u00a0<b><a href=\"http:\/\/www.simovits.com\/trojans\/trojans.html\" target=\"_offsite\" rel=\"noopener\">here<\/a><\/b>\u00a0for a list of port numbers commonly used by &#8220;Trojan horse&#8221; programs.)<\/p>\n<p>Your best defense against B.O. and other Trojan horses is to\u00a0<em><b>never<\/b><\/em>\u00a0open any email attachments that come from people who you don&#8217;t know, or that come as part of a widely distributed or forwarded email.\u00a0 If in doubt about any file attachment,\u00a0<em>delete it first, and ask questions later!<\/em><\/p>\n<p><b><span style=\"color: #ff0000; font-family: Arial Narrow; font-size: medium;\">3\/18\/00 <\/span><a name=\"Worms\"><\/a><span style=\"font-family: Arial; font-size: large;\">Worms<br \/>\n<\/span><\/b>These troublemakers are self-replicating, self-propagating programs that are spread through the Internet and generally don&#8217;t require any action on the part of the computer owner to be activated.\u00a0 All they need is an unprotected connection to the Internet.<\/p>\n<p><b><span style=\"font-family: Arial; font-size: medium;\">The &#8220;netlog&#8221; worm<\/span><span style=\"font-family: Arial; font-size: large;\"><br \/>\n<\/span><\/b>I recently encountered one of these in the form of the\u00a0<b>netlog<\/b>\u00a0<b>worm<\/b>\u00a0(read about it\u00a0<b><a href=\"http:\/\/vil.mcafee.com\/dispVirus.asp?virus_k=98477&amp;\" target=\"_offsite\" rel=\"noopener\">here<\/a><\/b>).\u00a0 I run a dialup connection that I\u00a0<i><b>thought<\/b><\/i>\u00a0I had properly secured and haven&#8217;t had any problems before now.\u00a0 But I had recently run a webserver log analysis that required me to keep my computer connected to the Net overnight, and had left my\u00a0<b>C drive shared with no password<\/b>\u00a0and had left\u00a0<b>Client for Microsoft Networks and File and Printer Sharing for MS Networks bound to my Dialup Adapter&#8217;s copy of TCP\/I<\/b>P. Stupid, Stupid, Stupid!<\/p>\n<p>My system had been acting funny for a few days, i.e. very sluggish, slow Internet connection, the clock was losing time. I thought it was &#8220;normal&#8221; Windows stuff.\u00a0 On the third day, I finally decided to run the Windows System Monitor and found my\u00a0<b>Processor Useage was solidly at 100%<\/b>.\u00a0 I closed all the programs I was running. Still at 100%. Closed all the programs on my System Tray. Still at 100%.\u00a0 Finally brought up the &#8220;Close Program&#8221; box and saw &#8220;<b>Wscript<\/b>&#8221; running.\u00a0 Killed it and the Processor Useage went to 0!<\/p>\n<p>Checked my Startup folder and found a shortcut to a file called &#8220;<b>network.vbs<\/b>&#8220;. Searched my C drive and found about 5 copies of this sucker.\u00a0 I right-clicked on them to Edit them and found that some were the legitimate Windows Scripting Host sample program that is supplied by Microsoft as part of the Win98 Install.\u00a0 But the one in my startup folder started out like this:<\/p>\n<pre>dim octa\r\ndim octb\r\ndim octc\r\ndim octd\r\ndim rand\r\ndim dot<\/pre>\n<p>and was\u00a0<b><i>not<\/i><\/b>\u00a0from Redmond! Needless to say, I deleted all copies of the file and immediately updated my anti-virus program DAT file (which had been recently updated to catch this worm.)!<\/p>\n<p><b>Moral of the story:\u00a0<\/b>Follow your own advice! &lt;blush&gt;<br \/>\nNow that you know what you&#8217;re up against, you might want to use some of the tools on\u00a0<a href=\"https:\/\/www.practicallynetworked.com\/securitytools.htm\"><b>this page<\/b><\/a>\u00a0to help detect and remove threats to your LAN&#8217;s security.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Be sure to read the &#8220;Secure your Lan&#8221; page!) LAN security risks come in different forms.\u00a0 Here is some information on the most common ones. Viruses Viruses are generally not a &#8220;security&#8221; threat to the computers on your LAN (although they\u00a0can\u00a0cause plenty of problems).\u00a0 The main effect of viruses can be erratic operation of your computers, possible data loss, and the ability to pass on the virus to other networked users. Viruses are most commonly spread through two methods: floppy disks or other removable media that are used to transfer files from one computer to another email attachments Your best <\/p>\n","protected":false},"author":2,"featured_media":5599,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/posts\/158"}],"collection":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/comments?post=158"}],"version-history":[{"count":0,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/posts\/158\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/media\/5599"}],"wp:attachment":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/media?parent=158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/categories?post=158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/tags?post=158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}