MAC Address Filtering

The Media Access Control, or MAC, Address is one of the most universally present identity features in computer networking. Whether your computer uses Internet Protocol (the default and preferred protocol) or IPX/SPX or NetBEUI (possible alternates), as its Layer 3/4 transport, each networking device on your computer will have a MAC Address. Some devices will even have 2 MAC addresses, and here's where a problem starts. Besides the Universally Administered Address (UAA), which is assigned to a network device when it is assembled at the factory, some devices will be assigned a Locally Administered Address (LAA) by the network administrators, when a network is being setup.

Setting up an LAA is trivial in nature. The hard part is deciding what address to use. Once you decide that, just run the Network Adapter Settings Wizard. Depending upon the vendor, the ability to assign a LAA will be somewhere in the wizard. For 3Com, for instance, the Advanced tab will have a value "Network Address". TYpe in the LAA that you wish to use on the adapter in question, hit the OK buttons a couple times, and you're good to go.

If you change the MAC address of the WAN connection on your NAT router, you're setting a LAA there.

One of the most common security selections, when you setup a router, is the ability to filter by client MAC address, and permit network access to a select few addresses. Like hiding the SSID beacon, filtering by MAC address is just another form of security by obscurity. It's similar in effect to disabling DHCP, and manually issuing IP addresses to all computers.

An attacker who is interested in connecting to your WiFi network has only to learn the MAC address of a device on your network, and assign the observed address. As described above, assigning an address is a trivial exercise; and learning an address is the same. Learning an address is simply a prerequisite in interesting exercises such as a Man In The Middle attack, or WEP cracking.

The bottom line? MAC address filtering is probably the lamest form of WiFi security that you can try. It's easy to do, but easy to bypass too.

>> Top

Bundled AntiVirus and Personal Firewalls - A Windows Networking Challenge

For several years after antivirus and personal firewalls became typical (and highly recommended) components in personal computer protection, many computer owners would confuse the two. Typical comments

What do you mean my computer has a virus? I have a firewall.

or

How could my computer have been hacked? Norton AntiVirus says my protection is fine!

would be common in many help forums.

With Windows XP, Microsoft first gave us Internet Connection Firewall, later renamed as Windows Firewall. They then took Windows Firewall, paired it with their recently acquired Antivirus program, and called that Windows OneCare.

The name "OneCare" has always intrigued me. Any person of British personality might pronounce that, with an accent, as "WanKare". Please ask one of your British friends, if you have any, what "WanKare" implies.

So fast forward to the present, please. It appears that the firewall component in Windows OneCare doesn't integrate with Vista, as well as Windows Firewall does. With Windows Vista, when you change the Network Location Type to "Private", Windows Firewall automatically adjusts itself to permitting Windows Networking on that computer. Depending upon the state of NetBIOS Over TCP, Windows Firewall will open the correct TCP ports.

If you have Windows Vista with OneCare, and you can't get Windows Networking working, check the network NetBT, and firewall port, settings, carefully. Make sure that they are compatible, and make sure that the setup of your network, and all existing (and currently working) computers matches the Vista / OneCare settings.

It's possible that any third party firewall may work no better than OneCare, in terms of Network and Sharing integration. If you have a problem with Windows Networking (file / printer sharing), the most frequently seen cause of such problems is NetBT and / or personal firewall settings. This will apparently be true under Windows Vista, just as under any previous operating system.

>> Top

Windows Vista, And Administrative Shares

Under Windows XP and earlier versions of Windows, any administrator of a server could gain access to any portion of any drive on the server, through the network. Even if no share was defined, any drive was always available, in its entirety, to anybody with administrative access.

This ability was known as an administrative share. Besides any explicitly defined shares, every server would have a "C$" share (and a "D$", etc, for additional drives). The shares weren't browsable - they wouldn't show up in Network Neighbourhood, and a server with no explicitly defined shares would even show up, at all, under Windows XP. But anybody with administrative access could map a share to "C$" and have access to the entire C drive, instantly.

Windows Vista has removed the administrative share from the default server configuration. Fortunately for many, this ability can be restored, with a simple registry entry.

For registry key [HKLM\ Software\ Microsoft\ Windows\ CurrentVersion\ Policies\ system], add a DWord value LocalAccountTokenFilterPolicy of "1". Then restart the computer.

>> Top

SMB Protection Requires Careful Setup

Server Message Blocks, or SMBs, are the life blood of Windows Networking. On high security networks, you can create secure channels between the server and client, to ensure security of SMBs. You can provide authentication (digital signing) and / or encryption (digital encryption) of SMBs, similar in nature to WPA, as used in WiFi security.

However, just as WiFi connectivity being prevented by improper setup of WPA, necessary use of Windows Networking can be prevented by by improper setup of SMB protection. Both SMB Encryption and Signing must be setup consistently on your network. If any of your clients don't support either protection, it's best that you don't require it on your servers.

When you try to connect a Windows client computer to a server, you may see

The account is not authorized to log in from this station.

If a server requires SMB encryption or signing, all workstations must provide it, if they are going to connect to that server. SMB Signing has been supported since Windows 98 and NT V4.0. Non-Windows operating systems, such as Apple and Linux / Unix, may or may not support SMB Signing. Be consistent in your LAN, however you choose to set it up.

For computers in a workgroup, you configure SMB Encryption and Signing using the Local Security Policy editor. For computers in a domain, the Local Security Policy editor is available, but settings may be overridden by Group Policy.

You will have settings for both the server (incoming SMBs) and the workstation (outgoing SMBs), and settings for encryption (to prevent snooping) and signing (to prevent spoofing). You'll find settings under Local Policies - Security Options. Domain member, Microsoft network client, and Microsoft network server Policy Categories all contain relevant settings.

Note both server and workstation services, and thus these settings, apply to most Windows computers. And note the difference between Enabling SMB Signing (where both computers that enable SMB Signing, and those that don't, will be able to connect to each other) and Requiring SMB Signing (where only computers that enable SMB Signing will be able to connect to each other).

For more detail, see:

• Microsoft: (KB839499): You cannot open file shares or Group Policy snap-ins ...
• Microsoft: (KB887429): Overview of Server Message Block signing

>> Top

Beware The Honeypot

Many, Many years ago, when the USA was first settled, nobody worried about the neighbours. Anybody living in the wilderness was happy to see another human being - and if you went out to work in the fields during the day, you'd leave the front door latched (don't want the pigs or chickens wandering through the house), but nobody locked anything. If you had a front porch, you'd have an easy chair or two, and a bucket of water there for your guests. Anybody wandering by was free to "set a spell and have a drink".

When WiFi was first developed, nobody cared about freeloading. If you had a WiFi AP, you connected it to your Internet service, and left it open. Anybody wandering by was welcome to "set a spell, and borrow the connection". Then freeloading got serious - people like Walter Nowakowski, in Toronto, became common.

People would protect themselves, and WEP was developed. And people learned to crack WEP.

Some of the more ingenious WiFi owners became devious.

If I have a WiFi AP that's protected, and my neighbour has an AP not protected, any wardrivers will be using my neighbours, right? Nobody is going to go after a protected AP, when there's an unprotected one nearby?

and continued with

OK, if a wardriver sees 2 APs, he can't tell that's not two different people. I'll setup an unprotected AP, and wardrivers can use that.

Kind of like the front porch with the chairs and water bucket.
Yet there was more.

Why should I let folks use my connection, to download kiddie porn? The FBI will notify my ISP, and I'll lose my service. OK, disconnect the Internet from the open AP.

and the open AP became a Honey Pot. You can connect, but you aren't going anywhere.

Some WiFi security experts even laugh about the wanna be wardrivers. Maybe even keep logs by MAC address. The ones who really have idle time to kill might even use NetStumbler or similar software to seek out, by triangulating, the hapless wardriver, maybe take his picture or taunt him otherwise.

The really nasty ones might attach a computer, with a spoofing DNS server, and let you think (initially) that you're connecting to "www.google.com". Then they will try to serve you the hack of the week, from their computer. An old 486 laying around would be perfect for this task. Who cares if it takes 5 minutes to respond? That wardriver isn't going anywhere. Who cares if he gives up?

So, if you are using WiFi, and you're attached to an easy and seemingly available AP that you don't know about, use common sense.

• Use PingPlotter or a similar tool to make sure that it actually connects somewhere.
• And, for heavens sake, protect your computer!
• And learn the difference between seeing

  Connected to XXXXXXX - Signal quality xxxxx.

  and actually having a connection, to the legitimate Internet.

Think.

>> Top

Using The Internet As A WAN Link? Use A VPN.

Stable and secure Windows Networking depends upon properly designed, routed, subnets. IP routing was designed to make Local Area Networks connect, yet still observe geographical relationships. Using routers between LANs allows localisation of some domain services (browsing, name resolution), but wide spread availability of others.

When you route IP connectivity thru wiring that you own and control, that's behind a firewall, each connected LAN is as safe as any of the other LANs. Threats on the outside (Internet) stay on the outside. Two geographically separate LANs, connected by a dedicated, leased communication line, are as safe as each other is safe.

What if you have 2 LANs, distant from each other, and can't justify the expense (initial or ongoing) of a leased or owned communication line? If both LANs have Internet access, you can still connect them; just use the Internet as the WAN link.

But wait! I hope you know how dangerous the Internet can be. It's bad enough when accessing it as clients. Plain old web browsing is bad enough, how about running a server on the Internet? OK, how about running all of the computers on your LANs thru the Internet? Why not hold up a $100 bill, and stroll thru Times Square in New York City? See if you get anywhere alive.

But you can connect your LANs thru the Internet, if you design the connection properly. A controlled, encrypted tunnel between your LANs, using routers that support a Virtual Private Network (aka VPN) will do this fine.

A VPN will be a lot easier to setup, and more stable and secure, when properly planned.

• All sites have a fixed IP address on the WAN (Internet).
• All sites use compatible VPN routers (identical make / model is best).
• The internal (LAN) subnets are different.
• You use DNS for name resolution.
• You use domains, not workgroups, to make browsing (Network Neighbourhood) reliable.
• You standardise connectivity between each LAN and the Internet.
• You standardise security policies between each LAN.

>> Top

Each LAN Is Addressed By Its WAN Address.
The VPN routers setup static tunnels between each other. Setting up a VPN router requires identifying the other router(s), by its IP address as well as by a pre installed certificate (aka pre shared authentication key). If you can't provide a fixed IP address for each router, you'll have to use a domain name, registered with a dynamic DNS service like DynDNS, TZO, or the like.

>> Top

Hardware Compatibilty Is A Must.
There are various conventions and standards for establishing, and conducting, authentication and encryption in a VPN. Each router manufacturer will likely have some variation, however small. The easiest, and most stable, VPNs will use router hardware of the same make, model, and firmware level at each end of a VPN tunnel.

>> Top

LAN Subnets Must Be Unique.
A VPN provides a routed connection between LANs. In order for routing to work best, you have to have different subnets on each LAN. When you setup a VPN between LANs that were setup before being connected, you may have some LANs using the same subnet. You can't have stable LANs, each having the same subnet, connected by a router.

>> Top

Use DNS For Reliable Name Resolution.
On most small LANs, you'll use broadcasts for name resolution. Broadcasts aren't routable; each IP subnet is, by definition, a broadcast domain. If you want computers on one subnet to access computers on another (which is, presumably, why you're setting up a VPN), you'll find computer names more convenient than IP addresses. Some VPNs will, if configured, pass SMBs for name resolution and browsing, but this will likely slow down Windows Networking. DNS based name resolution is the best way to go, for anything more complex than a single local cluster of computers.

>> Top

Use Domains, Not Workgroups.
If you use Network Neighbourhood to identify and access other computers, you'll need browsing to work between the subnets connected thru the VPN. A properly designed domain structure will make browsing work much better.

>> Top

Connectivity Between Any LAN And The Internet Can Affect Its Connection With The Others.
A VPN connection between any two LANs requires regular interchange of control information, and irregular application data. Balanced connectivity makes both more predictable. If one LAN has a dual WAN business class DSL service, and the other has residential class dialup, how secure and stable will that VPN be?

>> Top

Security On Any LAN Can Affect The Others.
VPNs are used to connect geographically separate LANs, and imply some degree of trust between those LANs. The computers on any LAN, connected to a VPN, are only as secure as the computers on the LAN with the weakest security policies. Review, and synchronise security policies before setting up a VPN.

If you wish to setup a VPN between your home network and your work network, security at your work may be compromised. You should always get permission from LAN administration, before doing this. You may be legally at risk without such precautions.

>> Top

Increased Sophistication and Excess Bandwidth Mitigates These Issues.
As availability of VPNs has increased, with VPN capable hardware sold in WalMart and similar convenience stores, and as VPN firmware becomes more sophisticated, each endpoint in a VPN relationship will be better able to adjust to differences between its own environment and the environment present at the other end. Many of the above issues won't be quite as relevant in the future. But if you start out being aware of the issues, you will be prepared to deal with them when they do become relevant.

>> Top

If You Have Windows XP, Without SP2, Please Upgrade Today!

One of the problems with Windows, in general, is its stability and security problems. One of the causes of stability and security problems is the need for Windows to support various versions of different software, its own as well as third party products.

Periodically, Microsoft issues rollup updates, which give it a baseline to work from when supporting their own product. SP2 was one of those rollups. By continuing to use Windows SP1, and by possibly encouraging others to do so, you are requiring useless complexity in Windows.

Now, any pretty good knowledge of computer security is a good start, but any real knowledge will tell you that keeping your computer up to date is essential.

XP SP2 has been out for an extremely long time. Its time to put SP1 to bed, and prepare for SP3 or Vista, which ever comes first. As Windows customers move to SP3 or Vista, support for SP2 will continue. But support for SP1 should not.

Move to SP2. Windows is bad enough with it - its worse without it.

Having applied SP2, proceed directly to malware analysis. If you've been running with SP1 this long, you probably have something you're not aware of.

Now if you're reading this specifically because your computer has problems, but you already did malware analysis, yet you can't find the source of the problem, your computer may be now part of a botnet. In this case, the only solution is for you to "flatten and pave".

• Immediately, disconnect from the network.
• Repartition, and reformat the drive.
• Re install Windows XP.
• Upgrade to SP2, and all security patches.
• Reconnect to the network.

I'm aware that this is brutal, and maybe rude, advice. But if you're advised any less, we're essentially saying

Look, you can solve your computer problems without upgrading to XP SP2. It's OK to run XP SP1.

But, it's not OK. Windows XP SP1 isn't supported by Microsoft, as of October 2006. Period.

>> Top

Setup WiFi - And WPA - Carefully

Setting up a WiFi LAN is a great experience. The convenience of surfing the web from your back yard, or sharing files between your main computer and your music server, without running wires here and there, is exhilarating. But there is stress involved.

When you connect a computer to a WiFi LAN, with WPA (and WPA-PSK is absolutely the minimum security measure that you should - no must - take), you are testing a number of things, simultaneously.

• The WiFi router.
• Your computer.
• Your WPA setup.

Now if you do this carefully, and with a small amount of preparation, the whole project can take an hour - or less. Plan it wrong, or make a mistake, and you could be days figuring out the problems. Use a layered strategy - similar to layered testing.

1. Get each computer connected, by Ethernet, to each other.
2. Setup, and copy, a key set to each computer.
3. Get each computer connected, by WiFi, with no security.
4. Setup WPA on the router, and on each WiFi client.

The different WiFi router vendors have different ideas what type of key their WPA security should work with. Steve Gibson's GRC "Perfect Passwords" Generator will give you a choice of 3. Here's an example of what you might be provided when you click the latter link. Try it, and see.

• 64 random hexadecimal characters (0-9 and A-F) (not case sensitive):
  

  1DBE12287EC82B22233C74B356BAC5E4EDC1447168B5F5A9C985C154220E0568

  
  
• 63 random printable ASCII characters (case sensitive):
  

  Hb+r#^S-T/1!JTP0_~SB 4&rQ7|s"q)7S`teMB`]x_uGATQQ-{B:=%W/_")$w6h

  
  
• 63 random alpha-numeric characters (a-z, A-Z, 0-9):
  

  0btNigYpFmG5MGDBahRnw203t6jQlCYCNcuvCYgGAZVCFSLSwp7deBMj9Iy7Vfr

  
  

All I do is to go to the web page (where it generates a new key set each time - try it), copy the six lines (as in the above list) to a Notepad file, and save the file. Then, with all computers connected by Ethernet (step 1 above), copy the file to each computer. Depending upon the router, one key may work properly, while another won't. Having 3 possibilities, in an identical set on each computer, means repeatedly copying and pasting, without having to worry about getting the computer back online, by other means, to simply copy another file.

After you copy the key set to each computer, start up the WiFi radio, and the WiFi clients. Start with WiFi in open (unencrypted) mode. Make sure that the router works, and you have a working signal, by testing without setting up security.

Since you'll probably be testing the router connection by loading a web page, decide how comfortable you are with giving your neighbourhood open Internet access while you test. If you're not comfortable, then disconnect the Internet feed from the router, while you test, and load the router management web page for your test. Reconnect the Internet service after you get WPA security working.

After you can connect the computer without security, and all network functions work, add WPA-PSK security.

• Configure the router - copy the appropriate portion of 64 random hexadecimal characters into the router management program.
• Copy the identical portion of 64 random hexadecimal characters into the client computer WiFi client manager setup wizard.
• Test the WiFi client. If it works, fine. If not, repeat these steps, trying the 63 random printable ASCII characters, and finally the 63 random alpha-numeric characters.

This is 3 times as complex as it needs to be, and after you've done this a few times, you'll be able to simplify these procedures. But for the first couple times you do this, the careful planning, and the lowered stress level, will make it easier to not make mistakes. By not making mistakes, you're more likely for this to work. And making it work is the reason for my writing this in the first place.

>> Top

Bad Websites? Don't Go There

One of the best ways of protecting your computer from websites which serve malicious content is not to go to those websites. If their content includes malicious code, why would you think that any of their content is desirable? Don't go there, or if you do, go armed with knowledge.

If you must surf to dodgy web sites, know which web sites are known to be malicious. The power of the Internet includes online, real time advice from the good guys.

Besides online malicious web site analysis, the classic protection strategy was plain old avoidance. Various security experts provide lists of websites that you should avoid, and they distribute the lists on the web. These lists are pretty big, and change frequently - generally each month. And, to prevent you from having to examine a list, by hand, each time you consider following a given link, you put these lists into the Hosts file on your computer, and let the computer do the work for you.

You can get a Hosts file from several trusted sources.

• HPGuru.
  
• MVPS.
  
• As part of Spybot S&D.
  

The Hosts file is a simple text file, stored in a recognised location on your computer. The operating system finds it from registry entry [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath]. Generally, this entry points to "%SystemRoot%\System32\drivers\etc", though malicious software, if installed on your computer, may change this entry.

If you use a Hosts file from only one of the above sources, you'll simply copy the file into the folder, as discussed above. If you do as I do, and use combined sources (since each source has different criteria what undesirable content is out there), you'll not want to edit and merge the file by hand. So there are several tools for doing this.

• eDexter.
  
• Hostess.
  
• Hostsman.
  

All of the above are free, and reliable. But, if you're skeptical about whether to trust any of the sources listed above, that's good. Do some research.

With exception to the issue below, using a Hosts file, as part of a layered security strategy, is simple yet effective. Use of the Hosts file is built in to every network operating system that uses Internet Protocol. Installing the Hosts file simply consists of merging entries into the existing file (as described above), or copying a file into the folder, if there is none in use right now.

Now, using a Hosts file is not without cost. A Hosts file entry identifies one individual subdomain, in any given domain. If "hackersrus.net" has separate addresses for "servera", "serverb", and "serverc", you'll need

127.0.0.1 servera.hackersrus.net
127.0.0.1 serverb.hackersrus.net
127.0.0.1 serverc.hackersrus.net

and this can make the Hosts file pretty large. With the HPGuru Hosts file, the file is well over 1M in size.

If you're running the DNS Client service, which provides a centrally managed DNS / Hosts lookup, the Hosts file is cached automatically. When the system starts up, and anytime you update the Hosts file, the DNS Client service will recache the file. This is a very CPU intensive process - on my computer (the last time I used it), the service would take 10 - 15 minutes to cache the file; during that time, the computer was pretty useless.

The solution, in that case, is to Stop and Disable the DNS Client service.

This should be a relevant issue only on small LANs that don't have a dedicated DNS server. If your domain includes a DNS server for local name resolution, you need to setup both the clients and the server very carefully. In that case, you'll want to centralise your website blocking, not have separate files on each client. If you don't have a dedicated DNS server, there are free DNS server utilities, that will provide local caching of DNS information, without having to precache the Hosts file.

Note one of the downsides of Hosts file based protection is latency. For you to surf safely, you have to be using the most up to date Hosts file. How often do you intend to update yours? If your Internet activity consists mainly of browsing, a browser add-on that references an online database makes much more sense.

>> Top

Using Public WiFi Networks

Setting up and using WiFi, as an alternative to Ethernet in your home, is a tricky project. Wifi will never be a true alternative to Ethernet.

There are things that you can't control, as a domestic WiFi LAN owner.

• Noise on the channel (analogue interference).
• Neighbors sharing the WiFi spectrum (digital interference).

When you take your portable computer to the local coffeeshop, you are still subject to the problems of a domestic WiFi LAN. You have additional problems too, issues that you (as a mere customer) can't control.

• Security used by the hotspot, to control access, and to keep the customers safe.
  
• Other customers at the hotspot (digital interference).
  
• The Internet service used by the hotspot.
  

These issues all apply after you are connected to the hotspot.

Security Issues - and the Initial Connection
Initial hotspot connection is a big issue. And authentication / encryption is a part of the connection problem.

• Authentication identifies you to the hotspot Access Point, letting only those who have legitimate access use the network. Authentication prevents unauthorised active use of the network.
  
• Encryption encodes the network activity between your computer and the access point, so no hackers can snoop on your activity. Encryption prevents unauthorised passive use of the network.
  
• WEP, which is the original standard for WiFi security, only provided encryption, with a static encryption key. The hackers figured out how to break the key, so WEP was dismissed as insecure.
  
• WPA / WPA2 has several versions of authentication and encryption. You will probably use the simplest in your home WiFi LAN: WPA-PSK with TKIP. PSK is a pre-shared key, similar to the key used in WEP, but more complex. TKIP is an encryption protocol which starts off by using the pre-shared key, but changes the encryption key regularly, to keep hackers from breaking the key. By preventing unauthorised access (by using authentication), and snooping (by using encryption), a WiFi LAN is safer.
  
• At most big hotspot chains, like T-Mobile, they have dismissed using WPA (or even WEP), because it's a pain to setup and to manage. If you setup a home LAN, you will (should) use WPA or better, because you control the LAN, and because you need to keep YOUR LAN (with maybe some non-WiFi computers even) secure. But how can you do that, if you don't control or can't meet the customers and their computers?
  • Not every Starbucks customer, with a laptop, is capable of setting up a WPA client, without help.
  • Very few hotspots have anybody on staff, even remotely proficient in setting up WPA security, and available during store hours.
  
  

With most hotspot chains, the hotspot AP itself will be open, and use a captive portal for access restriction. You connect to the hotspot, THEN you authenticate using your credit card (or maybe a token provided by the store running the hotspot). Using a hotspot provides challenges similar to, but not limited to, those involved when using a public computer.

To really understand the differences between WEP / WPA / WPA2, and open (with credit card / token), authentication, you have to start with some understanding of the OSI network model, and network layers.

• WEP / WPA / WPA2 authentication and encryption occurs at layer 2, the Data Link layer. Data link authorisation / encryption occurs between your computer, and the hotspot Access Point, with a mere minimum of information transmitted in the clear (ie visible to any hackers). Based upon the WPA shared key and settings on your computer and on the Access Point, a lot of initial conversation takes place, between your computer and the access point, that you don't see.
• Open, followed by credit card / token, authorisation, involves a brief initial conversation, between your computer and the access point, that you don't see (layer 2 again). This is followed by with some portions of the transaction transmitted in clear (unencrypted), and readable by any nearby hackers.
  • Initial connection to the hotspot AP is open to anybody. This eliminates the need for setting up WEP / WPA authentication for each WiFi customer.
  • Once a (Layer 2) connection between the AP and a client computer is established, you the customer see a "Please Login" screen in your browser, and can either enter a credit card number (if connectivity is open to everybody paying), or a token (if connectivity is sold by the store running the hotspot). Generally, the browser will use an encrypted protocol between the browser and the hotspot; if so, you will see the familiar padlock icon in your browser. This allows you to use your credit card with some degree of security (but still be careful).
  • Since you have an open connection (with maybe the credit card transaction encrypted), any Internet use will be unencrypted. Whatever you do with your browser, or any other Internet traffic, is available for snooping by any nearby hackers.
  
  
• Any Internet activity between your home LAN (or a public access point) and a distant Internet server, unless transmitted securely (with the padlock), is open to any Internet snooper. Traffic volume on the Internet is immense though, and merely snooping Internet traffic is likely to be a waste of time. With a properly setup home network, all WiFi traffic between your computer and the access point is encrypted; with a hotspot, this may not be the case. A hacker, snooping local traffic on an unprotected WiFi LAN, is much more likely to pick up relevant secrets from unwary customers.
  

Don't be an unwary hotspot customer. As with using any public computer (and even if you carry your own computer with you), protect yourself when using any LAN that you don't control.

>>Top

Other Customers at the Hotspot

As discussed in my other articles, you have to share the bandwidth. If there are other customers at the hotspot, they will be accessing the Internet too. If they are just browsing the web, and you are doing likewise, you can likely share just fine.

If either you or another customer is using a hotspot to download large music or video files, the other customers may suffer from degraded service. As with any WiFi LAN, depending upon how the hotspot is setup, those with intense network activity (such as downloading large files) may cause unfairly degraded service for the other users.

• Don't go to a crowded hotspot and download large files during peak use periods.
• Don't be surprised when your network performance drops during peak use periods.

>>Top

The Internet Service Provided By The Hotspot
As in your home, the quality of the Internet service provided, to any hotspot, may vary. Cable broadband based Internet service will vary depending upon time of day (and Internet access by the cable customers who are immediate neighbours to the hotspot). DSL based Internet service will vary depending upon the distance from the hotspot to the telephone connection office.

Issues like the WiFi channel used, which you would change at home to avoid interference by the neighbours, will be ones that you won't be able to control. And service outages, that you can only report to your ISP from home, you won't be able to report to the hotspot service provider. They will affect you, nonetheless.

Windows XP and Service Packs

Every version of Windows, from Windows 3.1 and Windows For Workgroups to Windows eXPerience, has been full of flaws. From logistics and usability design problems, to security holes, to out and out instability problems, Windows has them. I help people with problems - it's how I got to be an MVP. The problems just don't stop.

Periodically you see somebody ask for help in an online forum, and as part of the system description, admit that they have one or more computers with Service Pack 1 (occasionally, no service pack) on their network. They all have good reasons for not applying SP2.

• I never got around to applying it.
  
• I heard too many stories about how unstable it is.
  
• My brother (cousin, neighbor, barber,...) told me not to apply it.
  
• It uses too many resources.
  
• I don't need it, it was just security enhancements, and my computer is safer without it.
  
• I don't need it, I can protect my computer without it.
  
• My computer is fine right now. You can't fix what isn't broken.
  
• ... and endless variations.
  

One of the problems with Windows, in general, is its stability and security problems. One of the causes of stability and security problems is the need for Windows to support multiple versions of different software, whether its own, or third party products.

Periodically, Microsoft issues rollup updates, which give it a baseline to work from when supporting their own product. SP2 was one of those rollups. By continuing to use Windows SP1, and by encouraging others to do so, you are requiring useless complexity in Windows.

Yes, your layered security, and your knowledge of proper computer use, avoids your need for SP2, within limits. If your computer is fine right now, and you don't plan to ever add any new hardware or software, you're only vulnerable to problems (and newly discovered security issues) in the current hardware and software. Maybe you can live with that. I'm not sure that I could.

What if you plan to add any hardware or software to your computer? Maybe one day the video card will die on you. Maybe you'll add a new game, or maybe a newer version of your browser, Instant Messenger, or audio / video player? Will the new hardware or software be tested for SP1? Will it even run under SP1?

All hardware requires drivers, that have to support the Service Pack. If you have to buy a new network or video card, can you find one that supports SP1? Take a look at Walmart next time you're there.

No software company has unlimited resources. Do you expect new software to be designed to work under SP1? Do you expect new software to be tested under SP1? For how long? How about the web sites that you surf to? Will they support your old browser, that supports XP SP1, forever?

XP SP2 has been out for a long time. Its time to put SP1 to bed, and prepare for SP3 or Vista, which ever comes first. As Windows customers move to SP3 or Vista, support for SP2 will continue. But support for SP1 should not.

Move to SP2. Windows is bad enough with it - its worse without it. And do it before you have to upgrade your browser, or install a new network or video card. Upgrading to SP2 is stressful. Upgrading to SP2 AND replacing your network card, simultaneously, will be far worse. That said, plan your upgrade, and fix all active problems first.

Watching What Your Computer Is Doing

Your computer, as it runs the many programs that you (or others) start on it, and access other computers on your local or wide area network, is very busy. Even when you aren't doing anything intentionally, your computer is still busy. Sometimes, knowing what your computer is actually doing, at any time, is a critical need.

Long years ago, a computer would be pictured in a movie as a big metal box, with lots of flashing lights. Those lights were used, at that time, to tell what the computer was doing. Those computers ran very slowly (sometimes, not at all), and the flashing lights were critical to knowing what was going on, at any time.

The equivalent of a Blue Screen Of Death was known as (among other terms, some of which won't ever be discussed here) a Hard Stop. When a Hard Stop occurred (which could be many times / day, depending upon what programs were running), the lights would be used to describe what the computer had been doing, and to display the contents of memory and registers.

Today, no computer could ever drive enough lights to tell you anything useful. You typically have three lights on your computer. These lights tell you that the computer is doing something, Period.

1. Disk activity.
   
2. Network activity.
   
3. Power.
   

If you want to have any idea what your computer is doing, you'll have to at least list the tasks it's running. Task Manager is provided as a native component in Windows. Process Explorer (free) from the SysInternals division of Microsoft, provides more detail than Task Manager.

Knowing what tasks are running is a good place to start, but it's only a start. How do you know what each task is doing? I use Filemon and Regmon (both free, and both again from SysInternals).

• Filemon lists files, as accessed (read and / or written) by any given process.
  
• Regmon lists registry values, as accessed (read and / or written) by any given process.
  

You can use both programs simultaneously, or either program separately, at your convenience.

1. Open the application that interests you.
   
2. Identify the application in Process Explorer, and get its PID. Maybe use the Process Finder to automatically locate the entry for any visible window.
   
3. Start Filemon / Regmon.
   
4. Create a filter in either application, ":PID" where PID is the PID of the application in question.
   
5. Go back to your application, make the change, and watch what Filemon / Regmon displays.
   
6. When you find an interesting entry in Filemon, you can double click on it, to open Windows Explorer, and display the folder containing it.
   
7. When you find an interesting entry in Regmon, you can double click on it, to automatically open Regedit, and display the registry entry in question.
   
8. The filter used by Filemon and Regmon is very simple, and easy to use - it's a simple text string. If you know a process name, or file or registry path, you can filter on whatever you know. Use your imagination.
   
9. Both Filemon and Regmon use a context menu (right mouse click) for displayed entries, and a toolbar with several other possibilities. Both can display changes continually (automatically scrolling as you watch), or will let you freeze the display, and manually scroll, at your convenience.
   

Besides knowing what your computer is doing right now, it is useful sometimes to know what your computer did when it started up. A lot of processes - legitimate, not legitimate, and some in between the two, are started, by other processes, when the computer starts up. Knowing how any process starts up can be important to knowing what it's doing right now. Autoruns (another SysInternals product) and HijackThis are key tools (both free) that I use for this purpose.

Now all of the above tools are used to monitor your computer, and what it's doing on its own. Most computers are used on a network, and make connections to other computers. TCPView, another SysInternals product, shows you what other computers your computer is connected to, local and distant.

If your computer uses WiFi for connectivity, knowing who shares the WiFi spectrum with you could be relevant.

And remember that most computers running Windows contain some server functionality. If your computer is on a local network with other Windows computers, sometimes knowing who else is accessing it is useful too.

>> Top

Using A Public Computer? Protect Yourself

It seems like, wherever you go, there is always a computer available for public use. Computer access, whether for reading email, or surfing the web, is almost a necessity today.

But don't let these public conveniences misguide you. If not properly used, they can place your bank account, or your identity, at risk. Any time you use a public computer, for anything other than anonymous web access, take precautions. Using a public computer may involve many of the same security risks as using a public WiFi network. It will also present additional security challenges.

• Take note of your surroundings. Don't use a public computer unless absolutely necessary, where it's within casual view of any passerby.
  
• If you must use a public computer for any authenticated activity, like reading web email, you will be entering your account name and password. Try and block the view of the keyboard, and the monitor, from any casual passerby or nearby customers, as you enter your account and password. Watch the stranger next to you, using a cellphone (camera?).
  
• Remember what you're reading, and writing, is visible to anybody near you. This may not be the best place to start a long involved letter to anybody with any privacy concerns. Treat your friends (the recepients of your email) with respect.
  
• When you're on a public computer, would you walk away and leave your purse or notebook sitting on a table? I'd bet not. Don't go strolling to the restroom, either, while logged in. Get your coffee, etc, before you login.
  
• When you leave, make sure that you leave no traces of your presence. Don't leave yourself exposed to the next user of that computer.
  
  
  
  • Always log off whatever services you were using.
    
  • Never select "Remember Me" or anything similar, on any website or program, when asked for a name, nym, or password. You do not want to be remembered. Always plan on logging in, each time.
    
  • If at all possible, clear all cookies, and delete temporary Internet files. Here's where knowing the menu options on the browser becomes essential. You don't want to have to go ask a staff member at the coffeeshop how to clear your cookies (as if they would know).
    
  • If convenient, shut down and restart the computer before leaving. Watch it until it goes into the BIOS check, to ensure that it is shutting down. A shutdown and restart is the best way to refresh memory, and ensure that no memory based traces of your visit remain.
    
  
  

You don't have to be paranoid - 9 out of 10 of the folks watching you are simply wishing that they knew how to use the computer so confidently. Or they're waiting their turn (will he hurry up and finish!). Regardless, take reasonable precautions. Don't become an identity theft victim, from using a public computer.

A Hidden Personal Firewall - The nVidia nForce Network Adapter

The nVidia corporation, probably best known for their industry leading video cards like the GeForce, is now marketing a hardware based personal firewall. The nForce comes in two forms - an Ethernet adapter PCI card, and a motherboard with an embedded Ethernet adapter.

The nForce is an ICSA certified firewall, with full firewall functionality, that sits inside your computer.

If you're having a Windows Networking, or file sharing, problem, and you have an nForce component in your computer, you need to know this. During January and February 2006, I assisted in diagnosing several network issues that involved the nForce. In at least one case, the person with the computer had no idea what he had purchased, and innocently installed.

Run an "ipconfig /all" on your computer. If you see something like

Windows IP Configuration

Host Name . . . . . . . . . . . . : PChuck1
Primary Dns Suffix  . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : NVIDIA nforce Networking Controller

and you're having any type of problem pinging that computer, seeing it in Network Neighborhood, or otherwise accessing that computer thru the network, take a few minutes and read the manual. Or peruse the nVidia Support Forum, and in particular, POST HERE, Problems with nvidia network port. And my latest effort, Firewall Behaviour - And Windows Networking.

And be aware - the drivers for the nVidia nForce Versions 2, 3, and 4 contain shared components. And the installable component in the firewall, the nVidia Access Manager, has been reported to fail open. That is, if you don't install NAM, or don't activate it, the firewall blocks traffic, and not necessarily all traffic.

Be aware of what you're buying, please.

Disenchanted nVidia Customers
Here are some individual discussions and / or threads from folks who have experienced this problem first hand:

• 2006/09/16: Even WikiPedia is involved now. Markus, in Updating Firewall rules for ActiveArmor Network Access Manager provides the link to WikiPedia: NForce4: Flaws, which contains an interesting summary of the problem.
• 2006/08/13: NVIDIA "hidden firewall" causes networking problem, which makes immediate reference to a very long thread in the forum. Usenet technical details require that I archive the end of the thread here, since all posts by the person experiencing the problem are being removed:
  

• 
  >>>>>Good Morning, Chuck. And for the twentieth time, I appeciate your
  >>>>>tenacity and effort in trying to help me solve this frustrating
  >>>>>problem.
  
  >>>>>Update:
  >>>>>I think I followed your suggestions properly. Here's what I did:
  >>>>>1. Established a new account on all three (ASUS-AMD is back up!)
  >>>>>computers. They are adminstrative accounts with identical passwords.
  >>>>>2. Simple file sharing disabled on all three.
  >>>>>3. Created a test folder on AMD64, with full permissions for everyone
  >>>>>under "sharing" tab, and with "read" permissions for each user and
  >>>>>group under the "security" tab. (Some were greyed out).
  >>>>>4. Activated this user name on each computer with "net user name
  >>>>>/active:yes"
  >>>>>5. Checked TCP/IP for correct settings and did "repair" to flush.
  >>>>>6. Put remote registry service on automatic. There are very few
  >>>>>services now disabled (alerter, messenger, clip book)
  >>>>>6. Rebooted.
  >>>>>7. Tested system...Result --->No change. Working from amd64, I can
  >>>>>easily see and copy files from the other two computers. Working from
  >>>>>either asus-amd or mbx-notebook, I can see files and folders on amd64,
  >>>>>but I cannot open them. Tried again with all firewalls disabled. No
  >>>>>change.
  
  >>>>>
  
  >>>
  >>>***********************************************************
  >>>Soooo, Chuck, I guess I am essentially out of luck, and if my
  >>>persistent search for a "hidden" firewall proves to be fruitless, I
  >>>guess I must accept defeat. Or reinstall Windows.
  
  >>>Nothing came of the NVIDIA forum post except the one reply I quoted,
  >>>and there is nothing there which applies to my situation, although
  >>>they've had lots of firewall and driver problems, but not this kind.
  
  >>>I sincerely appreciate all your time and effort.
  >>>I will post a followup.
  >>>Of course if you have any other suggestions (please!), I'll be most
  >>>eager to pursue them
  
  >>>Jack
  
  >>Hello Chuck,
  >>Well, finally some good news. Success! You were right all along in
  >>suspecting a "hidden firewall" in the NVIDIA system. Apparently when I
  >>installed the latest drivers, a network manager was installed. This
  >>was acting as a firewall despite not having the actual NVIDIA firewall
  >>installed and despite not activating the firewall software (Active
  >>Armor or Armor On or something like that.) Fortunately, I was able to
  >>uninstall this manager without uninstalling the "NVIDIA drivers" which
  >>was a separate entity in the "Add-Remove programs". When I rebooted
  >>and went into Device Manager, I could see that there was now an older
  >>date on the driver for the NVIDIA network controller, which Windows
  >>must have silently installed.
  >>Caveat Emptor!
  >>My mind is so muddled now that I can't remember the exact name of the
  >>function I deleted.
  >>But I get easy access to the "server" now from the two secondary
  >>computers. Amen!
  >>Can't thank you enough for all the work you put in on this with me. I
  >>hope others may learn from this. If I have the energy (a bit burnt out
  >>now), I may go through this process again and make some notes to post
  >>for those who may be faced with this problem in the future. No help
  >>from NVIDIA or their forum, sadly.
  >>Sincere appreciation,
  >>Jack
  
  >All right, Jack!! Way to go!!
  
  >YOU will be the help to nVidia customers. Please write up what you can, and
  >whatever you write up will go into my article, and you will be able to help
  >other folks like you.
  
  Hi Chuck.
  I went through the process of reinstalling and uninstalling the
  troublesome NVIDIA network access manager, just so I could plan a post
  with some specific instructions for some unfortunate individual like
  me and try to save that person some time and frustration. So I plan to
  post it as a new topic under the heading
  
  "NVIDIA "hidden firewall" causes networking problem"
  
  I thought it might be more retrievable for someone with a similar
  problem if I put NVIDIA in the title of the topic.
  Many thanks again!
  
  Jack
  

>> Top

Proper Network Design

Setting up a network of computers is a lot of fun, even if you're getting paid to do the job. But maintaining, and using, a properly designed and setup network is a lot more fun than maintaining, and using, an improperly designed one. Be aware of some common pitfalls. Proper design, in many cases, is cheaper, and less complex, in the long run.

• Cabling. Making your own Ethernet cables may look like fun, but it's not.
  
• Grouping. Setting up a domain is not for everybody, but it will make your life easier in many ways.
  
• Networking. Using a NAT router for connecting just one computer to the Internet, or for connecting just 2 computers to each other, is cheaper and safer in the long term.
  
• Wired or Wireless LAN? Using WiFi is great - when you truly need it. But know the limitations.
  
• Firewire / USB Networking. In a pinch, a Firewire or USB port can work as an emergency network device. But they aren't good long term solutions.
  

>> Top

Ethernet Cabling - It's Not A Good First Time Project
An Ethernet cable is more than a simple group of small wires - it's actually an electrical system in its own right. The specifications for a 10M Ethernet cable are pretty complex - for 100M cable, you have to be more careful. And Gigabit Ethernet cable requires special equipment.

If you're a professional, and setting up a large office, hire an experienced and licensed electrician. If you're setting up your own small network, whether for a small office or for your home, and you're just starting with Computer Networking, buy premade, and tested, cables at a computer store.

Don't learn computer networking starting with making your own cables. Setting up an infrastructure, using reliable cabling, is cheaper, and easier in every respect. Don't start with do-it-yourself Ethernet cabling, when you're setting up a network.

>> Top

Domain vs Workgroup - A Little Effort Can Go A Long Way

Every Windows computer will act as a server, but only computers running a true server Operating System - Windows 2000 Server, or Server 2003 - can provide a domain. And setting up a domain is not a good project for your first network. But domains have their advantages as well as disadvantages.

If you have any network expertise, and a server operating system, consider setting up a domain. It's good for you, in the long run.

>> Top

Networking Computers Is Cheaper, and Simpler, With a NAT Router
If you have one computer, sitting in your office, and connected to nothing, you have just one computer. If you connect that computer to the Internet, or to another computer, you have a piece of, or the beginning of, a network.

• The simplest way to connect your single computer, to the Internet, is to connect the modem (Cable, dial-up, or DSL), externally, to your computer. Or install the modem internally.
  
• The simplest way to connect your two computers, to each other, is to connect them using a cross-over cable. Using a pair of WiFi adapters, one in each computer, you could eliminate the Ethernet cable, and have an ad-hoc WiFi network.
  

In neither case is this true, in the long term.

• Using a NAT router to connect as few as one (as well as multiple) computers, to your Internet service, is an essential component in layered security.
  
• Using a NAT router to share Internet service, between as few as two (as well as multiple) computers, is almost as cheap as using ICS. And it's far simpler. ICS was a good idea long ago, but it's not today.
  
• Using a NAT router to connect your computers, and / or to share your Internet service, is easily scalable. When you get your second (or third or whatever) computer, just connect it to an available router port. How do you do that with ICS and a cross-over cable?
  

When you get your first computer, buy your first NAT router. And make sure the router can share the Internet service.

• If the Internet service is dialup, make sure that you get an external dialup modem, and a router capable of handling dialup.
• If the Internet service is broadband, cable or DSL, make sure that you get a broadband modem with an Ethernet port. If the modem only has a USB port, get a better modem.

>> Top

Choosing A Wired or Wireless LAN Is An Important Decision
When you setup a network of computers, in your home or small office, a mass of Ethernet cables running everywhere can be a problem. WiFi, or Wireless networking, can provide relief from the mass of cables. But WiFi is NOT a replacement for Ethernet, for many reasons.

• Scalability. With a 100M Ethernet cable, you could have up to 200M of data flow (with send and receive simultaneously), between a single pair of computers. Each pair of computers in your office can conduct a separate, yet simultaneous, 200M conversation.
  
  With 54M WiFi, all of the computers in your home or office, and all of the computers in your neighbors home or office, will all share the same 54M channel. Actually, there are 3 54M channels - but if you have even 1 neighbor, chances are that you'll have more than 3, so you'll have to share with at least one other network. And all of your computers will share that one 54M channel. The 54M channel is not a maximum - a 108M channel is a possibility. But there are limitations to that possibility.
  
  And there are other factors which will prevent you from getting an actual 54M, let alone 108M, of data flow.
  
  
• Security. Ethernet cables stay in your home or office - when you lock your door, your cables, and computers, are secure. The WiFi signal, on the other hand, travels thru your walls, and down the block, to your neighbors computers. You have to use extra security precautions, with a WiFi LAN.
  
  
• Stability. Your WiFi neighbors will come and go, constantly. You have WiFi devices politely, and impolitely, sharing the channel. And, you'll have noise on the channel. Noise can come from many electronic sources.
  
  
  
  • Baby monitors.
    
  • Computers.
    
  • Cordless phones.
    
  • Microwave ovens.
    
  • Wireless stereo speakers.
    
  
  

If you truly need WiFi, then use it. The convenience of surfing the Internet from your bedroom is great. But know the limitations of WiFi, before investing a lot of time, and money, needlessly. For many LANs, Ethernet cabling will always be a better solution, excepting for one specific electrical code and safety issue.

>> Top

Firewire / USB Networking
Ethernet and WiFi are two dominant standards in networking. Ethernet for massive bandwidth (10G networks are coming closer), and WiFi for convenience. They both have tradeoffs.

Now just about any desktop computer that you may buy today will have an onboard Ethernet port. Most laptops that you buy will too, and most laptops will also have WiFi. And both desktop and laptop computers have a third networking possibility - Personal Area Networking, aka Firewire / USB. Firewire and USB are competing standards. Most computers will have one, if not both, ports. These ports allow you to connect most modern computer peripherals, such as a keyboard, pointing device (pka mouse), even a portable mass storage device (pka disk drive).

Properly designed Firewire / USB devices will use drivers already installed in Windows, and will support hot plugging. You'll be able to connect or disconnect such a device with the system running, at a moments notice.

And that's the strength of Personal Area Networks - the ability to attach and remove any accessory to your computer at will.

Now a PAN is a client (peripheral) - server (computer) relationship. The client attaches to the server (peripheral to computer). Networking computers is more or less a peer - peer relationship. But it's possible to buy a Firewire or USB cable, with an embedded hub, that will act like a client to the PAN bus, and like a peer to the networking stack in the operating system. With a special cable, you can setup a PAN between two computers.

So if one or more computers don't have an Ethernet or WiFi adapter, you can setup a physical network conveniently. But you will still have to define the logical network between the two computers. Setting up an IP based network, to share files between 2 computers, requires a significant amount of effort. That's in addition to loading the drivers to support the PAN itself. And there's no absolute guarantee that any PAN driver will work, between any 2 computers.

Ethernet and WiFi, on the other hand, are de facto standards for networking computers. They are designed for long term connection of computers. And there are a lot of people who know how to install, configure, and support Ethernet and WiFi.

And what if you have another device connected to the PAN bus on your computer? If you have a USB keyboard / mouse, and you're using a USB based network to connect to the Internet, your Internet access will have to share activity with your typing and cursor movement. The Ethernet bus was designed for inter computer connections, and is dedicated to that purpose.

In short, if you have an emergency, and can't open up your computer to install an Ethernet adapter, AND both computers in question have Firewire or USB ports, AND you have a Firewire or USB networking hub / cable, using Firewire or USB is a good short term solution. But in the long run, using Ethernet or WiFi to connect your computers makes more sense.

>> Top

NAT Routers With UPnP - Security Risk, or Benefit?

NAT routers, in general, only open ports when necessary. When an application, running on a client computer on your LAN, wants to communicate with a server outside the LAN, it sends a packet out. The NAT router does 4 things, in sequence:

1. Opens a port which points back to the client computer that sent the packet.
   
2. Sends the packet to the distant computer, giving its IP address, and the port that was just opened.
   
3. Waits for a return packet from the distant computer.
   
4. Forwards the return packet from the distant computer to the client computer that started the whole thing.
   

Now, NAT is stateful. This is a reason why a NAT router is said to provide protection like a firewall (though a NAT router is NOT a firewall). The port that is opened, from the outgoing packet, only responds to the address of the distant server. Thus when a port is opened, only replies from the distant server will be returned to the client computer on the LAN. Packets from any other computer, to that port, simply get dropped by the NAT router.

NAT, in its purest form, only supports client computers. Unless a client computer opens a port with an outgoing packet, no incoming traffic gets passed, by a NAT router, to any LAN computer.

So how do you use a server (a computer that waits for unsolicited incoming packets) behind a NAT router? Before UPnP, you would use either Port Forwarding, or Port Triggering.

• With Port Forwarding, you define fixed ports, to be forwarded to a fixed IP address. Those ports are opened when they are defined, and stay opened forever. The ports must be defined, and opened, before they are needed.
  
• With Port Triggering, you define fixed ports, to be forwarded, when specific other ports are opened, by any application on any computer. Those ports are opened when triggered, and stay open forever. The ports must be defined before the triggered port is needed.
  
• With UPnP, the UPnP capable application tells the router, precisely when needed, what ports are to be opened, and fowarded to what (potentially dynamic) IP address. And properly written UPnP applications will also tell the router when to close those ports.
  

Many well meaning security experts see UPnP as a security risk. If you have uncontrolled applications running on your computer, they can control your router, have it open ports at will, and create security risks.

If your computer has uncontrolled applications running on it, you've already lost that battle. You need to learn about detecting and removing malware (get rid of any existing untrustable software), and then you need to learn about protecting your computers properly (keep any future untrustable software off your computer).

UPnP is just as reliable, and as safe, as any applications running on your computer. If you control your computers properly, and ONLY trusted applications run on them, UPnP is perfectly safe. If you don't control your computers properly, applications hijacking UPnP to open holes in your router will be the least of your worries.

UPnP is actually more secure when your computers can be trusted. UPnP, as I state above, will dynamically instruct the router to close specific ports when they are not needed. Port forwarding, and port triggering, leave ports open forever.

The other advantage of UPnP is that it allows you to have servers on your LAN, using dynamic IP addressing. Port forwarding requires a server to have a fixed IP address. Port triggering, depending upon the NAT router, may or may not require a server to have a fixed IP address.

• With port forwarding, or port triggering, you can have only a single computer on the LAN running a given server application. A pre defined port can be forwarded to only one server.
• With UPnP forwarding, multiple computers can run the same UPnP compliant application, such as an IM program. The server application can negotiate with the router, as necessary, and have the port forwarded.

Bottom line? A properly written UPnP capable application is more functional, and no less secure, than an equivalent non-UPnP capable application. On a LAN with a properly designed layered security strategy, it will not create a security risk.

Corporate Security Policy

Every company that uses computers, and connects to the Internet in some way, needs a Corporate Security Policy.

A Corporate Security Policy can be simple, or complex.

• It can be as simple as "No surfing the web from company computers".
  
• It can be complex, and include multiple sections.
  
  
  
  • A business section, describing why the company needs Internet access, what it trusts its employees to do, and what they must not do.
    
  • A data protection section, inventorying what essential company data is retained in its computer network, how the data is protected and backed up, and how it will be restored in case of disaster. This is also known as a Business Recovery, or Contingency, Plan.
    
  • A security section, listing what protective measures are taken, both active and passive, including monitoring to ensure that its employees are using its resources properly.
    
  • A technical section, inventorying the company network, and describing the network devices and computers.
    
  • A response section, detailing what steps are to be taken when a problem is detected by its security.
    
  • A legal section, detailing how employees will be treated when they are determined to be in violation of the other sections.
    
  • An ongoing assessment section, describing how periodic evaluation of the CSP is to be conducted. Since a CSP is not static, it must be periodically reevaluated.
    
  
  
• It can include more or less, according to the needs of the company.
  

A CSP with any degree of complexity needs multiple personnel to develop, and approve, its content.

• Information Security.
  
• Information Technology.
  
• Human Resources.
  
• Legal.
  

Download Software Selectively

Usenet is a useful place to get advice for your technical issues. But accepting advice (which is validated by the other helpers in an open forum, constantly), and downloading software (which can't be easily validated by anybody, at all) are separate issues.

Bad advice, given in any trustable forum, does not remain undisputed very long. The experienced helpers in serious forums know the consequences of allowing bad advice to be given, and not contested. All regular helpers, in any forum, both actively and passively validate the advice given by the others. Software, from an unknown server, can't be validated by the helpers so easily.

Don't see where this is going? Checkout the DSLR Forums discussion Is your PC a drug mule?. In it, one of the posters, who signs himself as B, points out

I've always thought one would have to be a little crazy to trust executable software obtained via those channels. Movies and sounds, sure, but binary code? I don't think so. For all anyone knows those warez Photoshop installations have some nifty sleeping trojans.

This is a valid concern. If I were a bad guy, and wanted to spread my code to thousands of computers easily, I'd get some popular software, patch it with my bad code, and stick it on my server. Then, I'd log in to a help forum somewhere, and when a pigeon asked for help, I'd tell him to download my software. Quite likely, more than the pigeon would read my post, and hundreds of folks would download, and install, my bad software.

This is a lot easier than finding, and exploiting a weakness in network software. Get the pigeons to do the work for you. It's essentially the same strategy which leads to the devlopment of botnets.

So if I tell you to download some free software, like Filemon, Regmon, and Process Explorer (as an example), why should you trust me?

Whenever anybody tells you to download binary code (ie, software) from an unknown web address, do some research first.

• Checkout the forum where you see the recommendation for the software in question. Don't accept advice only given in dodgy forums.
  
• Checkout the link to the software. Google or Yahoo for previous references to the title. See if there are any complaints, or mentions in malware forums, about the link. See if any complimentary comments about that website were made by anybody. NEVER download software, even if it has a good reputation, from a dodgy or unknown website.
  
• Checkout the person recommending the software. Checkout prior posts, and coorelate them. See if there are any other posts by the same person, where that person was busted for giving bad advice. Make sure there ARE prior posts by that person - and check prior posts for a match in style and content. See if any complimentary comments about that person were made by others. Don't download software that's only recommended by dodgy or unknown persons.
  
• Checkout the software itself, by title. Again, Google or Yahoo. See if there are any complaints, or mentions in malware forums, about the title. See if any complimentary comments about that product were made by anybody. Don't download dodgy software.
  

My theory is that serious recommendations, by trusted helpers, in serious forums, probably points to safe software. If I see something mentioned in alt.comp.freeware, on the other hand, I consider the software itself, but I research before downloading.

In some cases, an AntiTrojan and AntiVirus scan of anything downloaded, before installing, is a good idea too. Since you'd be doing a one-time scan of an individual file, even an online multi vendor scan would not be a needless precaution. Better an hour wasted researching, before installing software, than a couple days wasted diagnosing a damaged system or network.

How To Not Be Seen

Caption on screen: 'HM GOVERNMENT, PUBLIC SERVICE FILM NO. 42 PARA 6. "HOW NOT TO BE SEEN"�

Cut to a wide-angle shot of hedgerows, fields and trees.

VOICE OVER (John Cleese): In this picture there are forty people. None of them can be seen. In this film we hope to show you how not to be seen.

VOICE OVER: In this film we hope to show how not to be seen. This is Mr. E.R. Bradshaw of Napier Court, Black Lion Road London SE5. He can not be seen. Now I am going to ask him to stand up. Mr. Bradshaw will you stand up please

In the distance Mr Bradshaw stands up. There is a loud gunshot as Mr Bradshaw is shot in the stomach. He crumples to the ground.

VOICE OVER: This demonstrates the value of not being seen.




Cut to another location - an empty area of scrubland.

VOICE OVER: In this picture we cannot see Mrs. B.J. Smegma of 13, The Crescent, Belmont. Mrs Smegma will you stand up please.

To the right of the area Mrs Smegma stands up. A gunshot rings out, and Mrs. Smegma leaps into the air, and falls to the ground dead.






Cut to another area, however this time there is a bush in the middle.

VOICE OVER: This is Mr Nesbitt of Harlow New Town. Mr Nesbitt would you stand up please. (after a pause - nothing happens) Mr Nesbitt has learnt the value of not being seen. However he has chosen a very obvious piece of cover.

The bush explodes and we hear a muffled scream.






Cut to another scene with three bushes.

VOICE OVER: Mr. E.V. Lambert of Homeleigh, The Burrows, Oswestry, has presented us with a poser. We do not know which bush he is behind, but we can soon find out.






The left-hand bush explodes, then the right-hand bush explodes, and then finally the middle bush explodes. There is a muffled scream.

VOICE OVER: Yes it was the middle one.


Cut to a shot of a farmland area with a water butt, a wall, a pile of leaves, a bushy tree, a parked car, and lots of bushes in the distance.

VOICE OVER: Mr Ken Andrews, of Leighton Road, Slough has concealed himself extremely well. He could be almost anywhere. He could be behind the wall, inside the water barrel, beneath a pile of leaves, up in the tree, squatting down behind the car, concealed in a hollow, or crouched behind any one of a hundred bushes. However we happen to know he's in the water barrel.

The water barrel just blows up in a huge explosion. Cut to a panning shot from the beach huts to beach across the sea.

VOICE OVER: Mr. and Mrs. Watson of Ivy Cottage, Worplesdon Road, Hull, chose a very cunning way of not being seen. When we called at their house, we found that they had gone away on two weeks holiday. They had not left any forwarding address, and they had bolted and barred the house to prevent us from getting in. However a neighbour told us where they were.

The camera pans around and stops on a obvious looking hut, which blows up. Cut to a house with a Gumby standing out front.

VOICE OVER: And here is the neighbour (he blows up, leaving just his boots. Cut to a shack in the desert) Here is where he lived (shack blows up - cut to a building) And this is where Lord Langdon lived who refused to speak to us (it blows up). so did the gentleman who lived here....(shot of a house - it blows up) and here.....(another building blows up) and of course here.....(a series of various atom and hydrogen bomb explosions.)

Protect Yourself - Restrict Your Privileges

One of the advantages of having your own computer is all the things that you can do with it. From surfing the web, and holding instant audio / video conferences with friends and family, to paying your bills and maintaining data used in your various hobbies, your computer lets you do marvelous things.

Unfortunately, what your computer can do, the bad guys can use, if you don't stop them. Would you want unknown persons having access to lists of your bank accounts? Would you want unkown persons having the ability to create files and folders on your system, without you knowing about them? How about if somebody were to encrypt the contents of your system, and provide the ability for YOU to use what's on YOUR computer, only after you pay them?

Back when the web was just getting started, a browser (like Internet Explorer) was used to display text documents, that used hypertext to reference other documents. Then somebody added the ability to display pictures. Every web page needs at least a picture or two - look at the upper right portion of this windows - do you see the MVP logo? That's a picture (and one that I'm pretty proud of too). Click on the logo, and you can see my picture too.

Unfortunately, with every ability given to your browser, comes the ability of the bad guys to use that ability against you.

Are you using Internet Explorer right now? Download one of the absolutely neatest utilities that you can get for Windows NT based (NT, 2000, 2003, XP) operating systems. Process Explorer will tell you 100 times as many details as the native Windows Task Manager will. Process Explorer is free, and does not require any installation process - just drop it into an available folder. Please don't drop it into the root of C:, or anywhere into the C:\Windows structure - create a folder for it, such as "C:\Utilities", or "C:\Program Files\Process Explorer".

Now Process Explorer, and other utilities like it, is provided to us by SysInternals and Mark Russinovich, the guy who caught Sony with their pants down. You can trust anything from SysInternals (my professional opinion anyway). And you can trust anything else that I tell you about - really. I don't recommend any products - free or otherwise - that I don't use myself. But please don't indiscriminately download software from the web.

So, did you just download Process Explorer? Did you do that using Internet Explorer? If so, you used a scripting program known as ActiveX. That window, like a small Windows Explorer, that popped up asking you where to put the file being downloaded is written in ActiveX. A lot of small programs (we call them applets generally) are written in ActiveX. Unfortunately, the mini-Explorer applet, like most ActiveX scripts, can be used by you locally, or thru your browser.

What happens if you surf to Hackerz-R-Us, and download one of the games there? Do it using Internet Explorer, and you may find yourself Owned. An ActiveX script that has system level capabilities, and can be called from your browser, has enormous potential to do you harm.

Having said that, it would NOT be in your interest, even if you could, to delete the ActiveX libraries. Nor can you even remove ActiveX totally from Internet Explorer. Windows Update, which you absolutely better use regularly, depends upon ActiveX to update your system.

Short of something stupid, you can do several things.

• Restrict browser ability to indiscriminately run code from unknown websites.
  
• Restrict your surfing.
  
• Restrict your access when using the system.
  

Use The Browser As A Restricted User
Knowing that Internet Explorer would be essential to your using Windows, Microsoft built into it the ability for you to designate some websites (such as WindowsUpdate) as absolutely trustworthy, and others (such as Hackerz-R-Us) as absolutely untrustworthy. And you can disable ActiveX, and other dangerous browser features, for untrusted websites.

One of the best known security experts on the web, Eric Howes, explains how to do this, and provides a regularly updated database of known dangerous websites.

Don't Surf To Dangerous Websites
Right. Do't go there. Stay away from http://www.hackerzrus.org! Unfortunately, this may not be an effective strategy. A DNS hijack, whether local (using your Hosts file), or networked (using your DNS server), could redirect traffic for windowsupdate.microsoft.com to www.hackerzrus.org.

Use The Computer As A Restricted User
How often do you install software? Most useful software requires you to close all open applications, and / or forces you to restart the system after installing. If you're like me, you install once / day, or once / week.

So why should you login to your computer as an adminstrator routinely? If you do all of your web surfing as a non-adminstrator, and you accidentally (yeah right) surf to http://www.hackerzrus.org, don't run any scripts there. View the pictures, and read the text, just don't run any of their programs.

But what if you surf to a malicious website, but one with a benevolent name? How about http://www.sys1nternals.com?

One of the best ways to protect yourself is to NOT use Internet Explorer, by policy, except when doing Windows Updates. When you're surfing the web, sign in as a user, and a user with non-adminstrative privilege.

Aaron Margosis, a Microsoft security expert, has a very dynamic blog discussing the pros and cons of running with limited privilege. And Derek Melber, of WindowsSecurity, has Using Dual Accounts for Administrators.