Re: Trojan Horses Popular To The Malicious Hackers

From: Art Kopp (artnpeg@claymania.com)
Date: 11/21/02 

From: artnpeg@claymania.com (Art Kopp)
Date: Thu, 21 Nov 2002 15:46:05 GMT

On Thu, 21 Nov 2002 11:29:43 +0000, Mike <du@b> wrote:

>Question...
>Say the target is running an clean OS like Win2k or XP Pro and
>has a decent AV program running. Also, the mark has disabled
>browser JS, ActiveX, etc., only accepts emails from trusted
>sources (the rest being deleted at the server) and *never* runs
>any 'cute' little .exe files. Our mark has also taken the time to
>disable any and all unnecessary NT "services" and doesn't even
>have the likes of IIS installed.
>
>Ok? So we have a relatively clean OS connected to the net 24/7.
>
>However, there's *no* firewall...
>
>Can a hacker compromise that system and if so, how?

I have a similar question except I use Win 98 original. I'd like to
know if there is any way a hacker can get root access. I'll outline my
situation:

I've unbound NetBios per Steve Gibson's procedure for '98 here:

http://grc.com/su-rebinding9x.htm

I've checked through the use of both programs and web sites that all
64K of my ports are normally closed.

I use no firewall and I'm not on a LAN of any kind. Nobody else has
access to my PC.

I have DSL service with dynamic IP. It is connected usually
continuously all day long. The PC is normally just powered down at
night.

I use Pegasus for email and Free Agent for newsgroups. I've eradicated
both IE and Outbreak. I use Moz based browsers, mostly K-MELEON since
it is quite fast on my aging PC. I sometimes use Mozilla. I leave
scripting enabled while browsing since I know of no vulnerabilities.

I d/l av updates using homemade programs based on the internet file
fetcher WGET.EXE I use only DOS av scanners but I find that I hardly
ever really use them any more since my habits and "safe hex"
discipline are such that av scanning is practically unnecessary. I
sometimes scan email attachments out of curiosity just to identify the
names of the latest crud in circulation :)

Is there some known vulnerability somewhere here that I'm not aware
of? Is there a _real_ possibility of a buffer overrun type of attack,
assuming someone wanted to bother trying? Again, my question is
limited soley to hacking and the possibility of root access.

Art
http://www.epix.net/~artnpeg
artnpeg@claymania.com

Relevant Pages

  • Re: Trojan Horses Popular To The Malicious Hackers
    ... >has a decent AV program running. ... >browser JS, ActiveX, etc., only accepts emails from trusted ... Our mark has also taken the time to ... So we have a relatively clean OS connected to the net 24/7. ...
    (comp.security.firewalls)
  • Re: Trojan Horses Popular To The Malicious Hackers
    ... >has a decent AV program running. ... >browser JS, ActiveX, etc., only accepts emails from trusted ... Our mark has also taken the time to ... So we have a relatively clean OS connected to the net 24/7. ...
    (microsoft.public.security)
  • Re: Trojan Horses Popular To The Malicious Hackers
    ... >has a decent AV program running. ... >browser JS, ActiveX, etc., only accepts emails from trusted ... Our mark has also taken the time to ... So we have a relatively clean OS connected to the net 24/7. ...
    (comp.security.firewalls)
  • Re: Trojan Horses Popular To The Malicious Hackers
    ... >has a decent AV program running. ... >browser JS, ActiveX, etc., only accepts emails from trusted ... Our mark has also taken the time to ... So we have a relatively clean OS connected to the net 24/7. ...
    (microsoft.public.security)
  • Re: Trojan Horses Popular To The Malicious Hackers
    ... >has a decent AV program running. ... >browser JS, ActiveX, etc., only accepts emails from trusted ... Our mark has also taken the time to ... So we have a relatively clean OS connected to the net 24/7. ...
    (comp.security.misc)