Computer threat - continued

Another threat to the computer and network as follows:

Denial of Service (DoS)

This type entangling the hacker and or a certain party to send a number of ICMP echo request to the broadcast address. Remember that the address of sender request have been disguised so difficult to tracks.

Protection to the network can be done by selection to the reciprocation of ICMP echo, another way is do not activate the directed broadcast at the router. Permit out package only and the sender address same with internal network address. This is important to the network security

The other level of Denial of Service(DoS) is Distributed Denial of Service (DDoS).
This type will increase the traffic and combine the bandwidth from some of host to one target host or network.

Spoofing

Is the creation of TCP/IP packets using somebody else's IP address. Routers use the "destination IP" address in order to forward packets through the Internet, but ignore the "source IP" address. That address is only used by the destination machine when it responds back to the source.

Broadcast Amplification

By using broadcast amplification, an attacker can direct machines at one site to flood another site with network packets. If huge amounts of packets are sent to a site, it goes down under the load, causing denial of service. To prevent this technique from being used, the document's authors suggest that companies turn off the capability to forward directed broadcast or multicast traffic.

TCP SYN attack

is an attack based on bogus TCP connection requests, created with a spoofed source IP address, sent to the attacked system. Connections are not completed, thus soon it will fill up the connection request table of the attacked system, preventing it from accepting any further valid connection request.

The source host for the attack sends a SYN packet to the target host. The target hosts replies with a SYN/ACK back to the legitimate user of the forged IP source address.

Since the spoofed source IP address is unreachable, the attacked system will never receive the corresponding ACK packets in return, and the connection request table on the

Attacked system will soon be filled up.The attack works if the spoofed source IP address is not reachable by the attacked system. If the spoofed source IP address where reachable by the attacked system, then the legitimate owner of the source IP address would respond with a RST packet back to the target host, closing the connection and defeating the attack.

TCP SYN flood is a denial of service attack that sends a host more TCP SYN packets than the protocol implementation can handle.

This is a resource starvation DoS attack because once the connection table is full, the server is unable to service legitimate requests.

Computer threat - Network Security

Every TCP package have 'flag bit’ defining content and intention of each package.

Example:

A package with flag bit contain "SYN or SYNCHRONIZE" will undertake to conduct initiation connection from sender to recipient. A package with flag bit contain "ACK" will undertake to inform receiver about sender information.
While a TCP package with beet flag contain "FIN" or "FINISH" undertaking to stop connection from sender to recipient.

To build a TCP connection, need data transfer package between two host, transfer of this data recognized by the name of "TCP Three-Way Handshake" as below picture.

Computer Network Threat

Threat is very harmful to the entire system and also by application at internal and external network.

The threat as follows:

Remote Login - this matter happened when someone capable to connect to a computer and have ability to control to several things related to resource found on the host or computer.

Application Backdoors - some program have special ability to access with long distance (remote access). Some bug program, exactly contain a backdoor or hidden access providing level control the computer and program.

SMTP session hijacking - SMTP is most commonly method used to deliver E-mail. By getting E-mail mailing-list, someone can deliver undesirable E-mail to thousands of or more users. This matter is called unsolicited junk mail or spam.

Spamming conducted with joining SMTP server which not suspect, then deliver thousands of E-mail called redirecting process, so that complicate to detect who is the real sender of the Mail Spam.

Operating system bugs – In application, some operation system have conducive security gap to be exploited illegally.

E-mail bombs - is an Individual attack, someone send hundreds or thousands of E-mail to one address so the victim E-mail cannot accept E-mail anymore.

Macro - To make simple or facilitate procedure an application, many application program permit us to make command which can be run by the program (script). By exploiting ability of script or macro, attacker can cause damage of data at computer.

Virus – Most known to make trouble at computer. The growth of virus from method, way of, making, effectiveness, damage storey, and also speed of spreading is different each other.

Redirect bombs – Hacker or Cracker can use ICMP to change direction of information and attack to other router.

Source routing - At many case, a data package which work through one or some network determined by router pass to route information by the router, but sometime hacker used the package as the real sender.

Another type of computer attack are from (next posted about this) :

Denial of Service (DoS)
Spoofing
Broadcast Amplification
TCP SYN

The method to run the threat above, can be conducted variously including using virus.

Network security - protecting PC

Tapping by hacker is an annoying problem when we are on surfing internet.

We have to learn how to hack but shall be used for protection from attack.

Following is tips and some software assisting to protect PC from online tapping.

Often we forget to protect our PC “attacking” from online tapping when we surf the internet.

Many civil people feel enough in protecting its PC with a program a kind of firewall desktop and anti spy firewall.

In fact, still many gap at firewall which you used, can be exploited by online watcher hacking on your PC

Below is a tips to protect PC from internet tapping in a LAN party, W-LAN or home connection as my experience.

Activated your Firewall:

In course of online tapping or infection, usually the first step do by hacker is collect information and data concerning victim to be tapped. Usually hacker use information compiler tools like “ Nmap” ( http://www.insecure.org/nmap), hereinafter hacker will check open port at victim PC and also TCP/IP package sent from PC into Network. This matter to get specific information is called print finger from victim PC.

The others way, hacker usually try to get deeper information by delivering an E-mail bait to victim (victim will open the e-mail through Microsoft Outlook program which integrated in its Windows). From bait E-mail answered, hence hacker directly can check what kind of E-mail software and server client install in victim PC.

A lot of “software bug” site, discuss about weak of E-mail software and server client according to each version, but I’m not talking about that weak at this post.

So how to avoid that attack ?

The way of which you can use as protection early is firewall desktop. If you do not wish to use special firewall or commercial, hence you enough activate personal firewall that found on Windows XP service pack 2. Comprehend firewall application path and activity which you use in order not to harm you.

Ascertaining your pc clear of Virus and Trojan, before install the firewall.
Configure your firewall with carefully in each application requiring to access online and also access sharing file in existing network.

Encrypt the Important Folder and WebMail connection.

After getting information about victim PC, usually hacker can start tapping, it is of course with two important tools that is " Ethereal" and "ARP-Spoofer". With ARP-Spoofer, hacker can take information which pass by victim PC with Gateway Internet access and that information package can be opened with “Ethereal (http://www.ethereal.com)”.

To overcome matter above, we have to encrypt our Webmail connection through https band. Do not use http band, better avoid to use ftp band and telnet, because can be sabotaged by hacker. You can use SSH connection to replace ftp band or the telnet. The existing constraint is there is very rare web server providing https service and the SSH.

One of the common Mail which use HTTPS is GMail. Whereas for the important and confidential folder in the PC better do Encrypt. Its data content with right click on folder that you want to Encrypt, its way open part: Properties – Advanced – Encrypt content to protect data. But this matter can be done if your XP windows system file is use NTFS type. By use NTFS system file, we also can block out to access rights access certain consumer.

Use Good Firewall.

With DNS spoofing, hacker can do deflection instructing PC victim to spurious website. This deflection is easy to do because DNS protocol is not have any security mechanism. This matter can be prevented by using good firewall application.

At firewall nowadays, usually DNS cache keep with elegantly, so when we ever visit to previous website, hence DNS spoofing we can prevent.

Recognize to access autoexec at registry

If hacker have succeeded tap your pc, usually they always prepare backdoor to facilitate hacking access in other opportunity. One of the effort draw up backdoor is by altering victim pc system file. But this matter can be easy to detect to through antivirus program.

The way of more realistic to all hacker by placing Trojan in our PC, then run through one of the "Autoexec" what running with autoexec in other Windows system. In anticipating this matter, which we do with install additional tools “Autorun” from Sysinternalsi (http://www.systernals.com).

With this tool can display lot of autoexec exist in our system. Autoruns also can show signature from autoexec exist in our pc system. If found autoexec entry which unknown and identify as trigger Trojan, hence Autoruns can turn off it. With this tool, we assisted in eliminating against backdoor which is possible left by hacker in our pc.

Besides trick above, to avoid tapping, suggested do not use User Administrator when surf in internet, then arrange your explorer internet security setting to High Level Security setting.

And don't forget to always Update your Windows, especially when newest update improve many Security system on your PC.

General Computer Port list

Just another General Computer port. Computer Network Administrator must know below computer port and my previous posted about Computer Port List.

What is TCP/UDP?
TCP and UDP are transport protocols used for communication between computers.

TCP:Abbreviation of Transmission Control Protocol, and pronounced as separate letters. TCP is one of the main protocols in TCP/IP networks. Whereas the IP protocol deals only with packets, TCP enables two hosts to establish a connection and exchange streams of data. TCP guarantees delivery of data and also guarantees that packets will be delivered in the same order in which they were sent.

UDP:Short for User Datagram Protocol, a connectionless protocol that, like TCP, runs on top of IP networks. Unlike TCP/IP, UDP/IP provides very few error recovery services, offering instead a direct way to send and receive datagrams over an IP network. It's used primarily for broadcasting messages over a network.

Service Name	UDP	TCP
Browsing datagram responses of NETBIOS over TCP/IP	138
Browsing requests of NetBIOS over TCP/IP	137
Client/Server Communication		135
Common Internet File System (CIFS)	445	139,445
Content Replication Service		560
Cybercash Administration		8001
Cybercash Coin Gateway		8002
Cybercash Credit Gateway		8000
DCOM (SCM uses UDP/TCP to dynamically assign ports for DCOM)	135	135
DHCP Client		67
DHCP Server		68
DHCP Manager		135
DNS Administration		139
DNS client to server lookup (varies)	53	53
Exchange Server 5.0
Client Server Communication		135
Exchange Administration		135
IMAP		143
IMAP (SSL)		993
LDAP		389
LDAP (SSL)		636
MTA – X.400 over TCP/IP		102
POP3		110
POP3 (SSL)		995
RPC		135
SMTP		25
NNTP		119
NNTP (SSL)		563
File shares name lookup	137
File shares session		139
FTP		21
FTP-data		20
HTTP		80
HTTP-Secure Sockets Layer (SSL)		443
Internet Information Services (IIS)		80
IMAP		143
IMAP (SSL)		993
IKE	500
IRC		531
ISPMOD (SBA 2nd tier DNS registration wizard)		1234
Kerberos de-multiplexer		2053
Kerberos klogin		543
Kerberos kpasswd (v5)	464	464
Kerberos krb5	88	88
Kerberos kshell		544
L2TP	1701
LDAP		389
LDAP (SSL)		636
Login Sequence	137, 138	139
Macintosh, File Services (AFP/IP)		548
Membership DPA		568
Membership MSN		569
Microsoft Chat Client to server		6667
Microsoft Chat server to server		6665
Microsoft Message Queue Client	1801	1801
Microsoft Message Queue Server	3527	135,2101
Microsoft Message Queue Server		2103, 2105
MTA – X.400 over TCP/IP		102
NetBT datagrams	138
NetBT name lookups	137
NetBT service sessions		139
NetLogon	138
NetMeeting Audio Call Control		1731
NetMeeting H.323 Call Setup		1720
NetMeeting H.323 streaming RTP over UDP	Dynamic
NetMeeting Internet Locator Server ILS		389
NetMeeting RTP audio stream	Dynamic
NetMeeting T.120		1503
NetMeeting User Location Service		522
NetMeeting user location service ULS		522
Network Load Balancing	2504
NNTP		119
NNTP (SSL)		563
Outlook (see “Exchange” for ports
Pass Through Verification	137, 138	139
POP3		110
POP3 (SSL)		995
PPTP control		1723
Printer sharing name lookup	137
Printer sharing session		139
Radius accounting (Routing and Remote Access)	1646/1813
Radius Authentication (Routing and Remote Acces)	1645/1812
Remote Install TFTP		69
RPC Client Fixed port session Queries		1500
RPC Client Using a Fixed port session Replication		2500
RPC Session Ports		Dynamic
RPC User Manager, Service Manager, Port Manager		135
SCM Used by DCOM	135	135
SMTP		25
SNMP	161
SNMP Trap	162
SQL Named Pipes Encryption Over Other Protocols Name Lookup	137
SQL RPC Encryption Over Other Protocols Name Lookup	137
SQL Session		139
SQL Session		1433
SQL Session		1024 - 5000
SQL Session Mapper		135
SQL TCP Client Name Lookup	53	53
TelNet		23
Terminal Server		3389
UNIX Printing		515
WINS Manager		135
WINS NetBios Over TCP/IP Name Service	137
WINS Proxy	137
WINS Registration		137
WINS Replication		42
X400		102

Computer Port list

What is Computer port ?

An interface on a computer to which you can connect a device. Personal computers have various types of ports. Internally, there are several ports for connecting disk drives, display screens, and keyboards.

Externally, personal computers have ports for connecting modems, printers, mice, and other peripheral devices.

Almost all personal computers come with a serial RS-232C port or RS-422 port for connecting a modem or mouse and a parallel port for connecting a printer.

On PCs, the parallel port is a Centronics interface that uses a 25-pin connector. SCSI (Small Computer System Interface) ports support higher transmission speeds than do conventional ports and enable you to attach up to seven devices to the same port.

In TCP/IP and UDP networks, an endpoint to a logical connection. The port number identifies what type of port it is.

For Network administrator must know about the computer Port, to identify network attack and network function purposed.

Below is a general computer port list and the service port name:

Service Name	Port Number
Windows Services
Browsing DHCP Lease DHCP Manager Directory Replication DNS Administration DNS Resolution Event Viewer File Sharing Logon Sequence NetLogon Pass Through Validation Performance Monitor PPTP Printing Registry Editor Server Manager Trusts User Manager WinNT Diagnostics WinNT Secure channel Wins Replication Wins Manager Wins Registration Direct Hosting of SMB over TCP/IP	UDP:137,138 UDP:67,68 TCP:135 UDP:138 TCP:139 TCP:135 UDP:53 TCP:139 TCP:139 UDP:137,138 TCP:139 UDP:138 UDP:137,138 TCP:139 TCP:139 TCP:1723 IP Protocol:47 (GRE) UDP:137,138 TCP:139 TCP:139 TCP:139 UDP:137,138 TCP:139 TCP:139 TCP:139 UDP:137,138 TCP:139 TCP:42 TCP:135 TCP:137 TCP,UDP:445

Service Name	Port Number
Windows Load balancing System (WLBS) & convoy for cluster Control
Convoy WLBS	UDP:1717 UDP:2504
Microsoft Exchange
Client/Server Comm. Exchange Administrator IMAP IMAP (SSL) LDAP LDAP (SSL) MTA – X.400 over TCP/IP POP3 POP3 (SSL) RPC SMTP NNTP NNTP (SSL)	TCP:135 TCP:135 TCP:143 TCP:993 TCP:389 TCP:636 TCP:102 TCP:110 TCP:995 TCP:135 TCP:25 TCP:119 TCP:563
Windows Terminal Services
RDP Client (Microsoft) ActiveX Client (TSAC) ICA Client (Citrix) Terminal Server IPSec ISAKMP ESP AH Karberos Karberos RSVP RSVP	TCP:3389 TCP:80,3389 TCP:1494 TCP:3389 UDP:500 IP Protocol 50 IP Protocol 51 TCP;UDP:88 IP Protocol:46