Re: Incoming port accesses from China

On Wed, 11 Jan 2006, in the Usenet newsgroup comp.security.firewalls, in article
<reCdnQHC17bE2ljeRVn-pg@xxxxxxxxxxxx>, Jeff B wrote:

>Windows users need to be paranoid on the use of 135-139,445 from the
>web. These ports are used heavily in a LAN environment for File/Print
>sharing amongst other things.

That may be, but WHY if you decide to share (or more correctly, if microsoft
decides you want to share) files or the printer, WHY OH WHY does anyone
think you want to share with the world? Do you really think that someone
half way around the world is going to need to use your printer? Do you
REALLY want to share your personal details, or that recipe for those
Neiman-Marcus cookies you paid US$250 for (www.bl.net/forwards/cookie.html)?
Get real!

Microsoft intentionally tries to scare people away from looking at
technical stuff, but the 'route print' command will show that windoze is
aware of three classes of computer, based on the IP address. It knows
about the loopback (meaning "this" computer), and the address range used
on the "local" LAN. It also knows about "everyone else". It doesn't have
to share BY DEFAULT with all three classes.

Is that to hard? OK, the mechanism they've added for Link Local (also
called ZeroConf - the 169.254.0.0 network the system defaults to when
it can't find a DHCP server because who ever set up the network screwed
up) has the TCP limitation of "time to live" set - packets using that
address are set to a TTL of "1" - meaning local network only.

Is your LAN so big that you have more than one sub-net? The 10.0.0.0
network with a 255.0.0.0 mask allows for 4.2 million computers on the
same wire, but only an idiot would have as many as a thousand. If you
have that many, you also have enough to engage the services of someone
who can spell 'TCP'. Even a drooler who has spent a thousand bucks to
memorize a few facts to pass the memory "test" to become an MCSE has
some idea of how it's done.

>The default freebe firewall and/or SP2 will automatically close these
>ports, but if you need sharing, then be sure to enable them ONLY on your
>private, non-routable lan addresses.

Why is that not the default configuration? If you don't HAVE a local
LAN, trying to share with a non-existent net won't matter. On the other
hand, the choice of "share with no-one" or "share with everyone" is about
as dumb as you can get. I don't know about you, but I don't know of anyone
who really needs to share their printer with the world, and the number of
those who need to share files with the world is quite limited.

>There are many trojans that use these ports to really mess with your life.

Isn't it interesting that other operating systems have had file and print
sharing as far back as the late 1970s and don't have this problem?

Old guy
.

Relevant Pages

  • Re: [Full-Disclosure] Blocking Music Sharing.
    ... and Network. ... Any connection allowed out by your firewall will probably let the return ... block the ports used for communication between the client & server ... Subject: Blocking Music Sharing. ...
    (Full-Disclosure)
  • Re: PC Tools Firewall Question
    ... So, it's to be assumed that the two machines that are connected to your router, the LAN or Local Area Network, are never to share resources or network between the two, which are the ports you're blocking below with the PFW. ...
    (comp.security.firewalls)
  • Re: How2 allow a local computer to access Internet, but not other locals - LAN/network/firewall conf
    ... You could look into BlackIce ... computer to the network, I have to tell BlackIce on all machines to Trust ... IPwanting access and still allow the sharing of the printer. ... > router but not access other computers on the LAN. ...
    (comp.security.firewalls)
  • Re: lack of a password challange
    ... >his PC's root open for sharing files, and had then given the admin's ... From his son's machine on the lan I ... Windows XP allows all users on all computers to access ... network password to the Guest account. ...
    (microsoft.public.windowsxp.network_web)
  • Re: networking mystery, unable to ping or access....
    ... > Unable to successfully ping between 2 XP Pro computers., ... Lights on each LAN ... > Used wizard to set up home network, and also tried running the network ... > File and Printer Sharing for Microsoft Networks ...
    (microsoft.public.windowsxp.network_web)