Bots And You #2

Computers controlled by somebody who is not their legal or physical owner, aka "bots" or "zombies", have been a known fact of life in the Internet, for several years. Successful hackers, though, don't bother with individual computers, they control armies of botted computers, each numbering in the thousands.

One of the defenses against bots is the use of CAPTCHAs, or puzzles that "humans can solve, but computers can't". If you use the Internet much at all, you've seen, and solved, more than one. Unfortunately, CAPTCHAs are easily solved by scripts and online users. The people who produce web products like email, online forums, and blogging platforms may not yet realise that detail, however.

This is not an academic issue, it's commercial, and it's very real. Here's the specifications for a commercial product used to manage attacks against online forums, and place spam posts there. I've viewed an online movie which showed XRumer in action (movie since removed), and my computers haven't been attacked, but I would still visit that web site only from a computer carefully protected with a good layered security strategy.


Let's "make a new project".



Having setup the content and style of the attack, let's see what it will look like when placed in a typical forum.



Posting to multiple forums, simultaneously, is the key here. We need the ability to determine how many forums to attack, simultaneously. Here, we see hundreds of forums under attack.



Here we have a very matter of fact demonstration of how useless captchas are. Note the log entries "captcha recognized", showing that the forums in use asked for captcha entries, which were simply resolved by the XRumer script. Not even worthy of a feature balloon in the demo.



This product, XRumer (note "Version 3.0"), appears to be a Windows XP application. It's well designed, with plenty of features that make it persistent, robust, and versatile. It's apparently designed for placing spam posts into online forums. Note that the demo doesn't show us any detail about posting into any one forum, it simply shows the spam posts being placed to the forums. This is simply an advertising demo, for a mature and probably popular product.

And the individual forum postings are being processed, simultaneously, by bots. Presumably "one thread" = "one bot". Note the URL: www.botmaster.net.

I have no doubt that similar products are marketed, to generate and deliver spam through email, to register and generate splog farms in the Blogger world, and even to send comment spam to blogs and web sites. Note that this demo is several years old - surely shinier, more robust, and more versatile products are available today. And just as surely as "Coca-Cola" has a competitor "Pepsi-Cola" (with neither outshining the other for very long), "XRumer" has competitors too.

This is why you see spam in online forums, spam in your email box, and spam blogs on the Internet. It's a commercial process, with automated tools.

>> Top

New Equipment In Your LAN

Every week, someone writes for advice

I just got a new router, and now I can't access my computers from each other.

or

I just got a new router, and none of my computers can access the Internet.

Frequently, the cause of these problems will fall in two categories - new features, and settings.

New Features
Many new, and high end, routers come with protection that emphasise Internet access, and make file sharing an optional activity, to protect the individual computers from each other. Look carefully in the Owner's Manual, for a "DMZ", "Isolation Mode", "Virtual Server", or "VLAN" setting - either on a single port, or affecting the entire LAN.

And if you are setting up a WiFi router, make sure that the radio is turned on. Some WiFi equipment is delivered with the radio turned off, to ensure that you will intentionally activate it, and be prepared for when this is done.

Settings
Any time that I was changing my network equipment, I would take a snapshot of all network settings from all computers. You can never tell when this might be a life saver. Logs from "browstat status", "ipconfig /all", "net config server", and "net config workstation" could all be useful when troubleshooting. Make a set before, and after, any change. Compare each, line by line, and if you spot any differences, explain or fix them before continuing.

If you're having trouble accessing the Internet, check to see if your computers are using manual assignments. New equipment will probably include an IP address change for the router - some vendors provide a default LAN on 192.168.0.0/24, others 192.168.1.0/24, and others have additional variations. Maybe the router handles DNS differently too.

If you're having trouble with Windows Networking, either an Error 5 aka "Access Denied" or an Error 53 aka "Name not Found" may be seen, or you may simply not see any computers in Network Neighbourhood. If this is the problem, check the security components on the computers - since a new router will probably result in a new subnet address, check personal firewalls and anti-worm programs, for settings that are IP address sensitive.

If All Else Fails
Get into Troubleshooting Internet Connectivity, or into Troubleshooting Network Neighbourhood, depending upon the problem being observed.

And of course, make sure that the new router has the current firmware, obtained from the vendor.

>> Top

MAC Address Filtering

The Media Access Control, or MAC, Address is one of the most universally present identity features in computer networking. Whether your computer uses Internet Protocol (the default and preferred protocol) or IPX/SPX or NetBEUI (possible alternates), as its Layer 3/4 transport, each networking device on your computer will have a MAC Address. Some devices will even have 2 MAC addresses, and here's where a problem starts. Besides the Universally Administered Address (UAA), which is assigned to a network device when it is assembled at the factory, some devices will be assigned a Locally Administered Address (LAA) by the network administrators, when a network is being setup.

Setting up an LAA is trivial in nature. The hard part is deciding what address to use. Once you decide that, just run the Network Adapter Settings Wizard. Depending upon the vendor, the ability to assign a LAA will be somewhere in the wizard. For 3Com, for instance, the Advanced tab will have a value "Network Address". TYpe in the LAA that you wish to use on the adapter in question, hit the OK buttons a couple times, and you're good to go.

If you change the MAC address of the WAN connection on your NAT router, you're setting a LAA there.

One of the most common security selections, when you setup a router, is the ability to filter by client MAC address, and permit network access to a select few addresses. Like hiding the SSID beacon, filtering by MAC address is just another form of security by obscurity. It's similar in effect to disabling DHCP, and manually issuing IP addresses to all computers.

An attacker who is interested in connecting to your WiFi network has only to learn the MAC address of a device on your network, and assign the observed address. As described above, assigning an address is a trivial exercise; and learning an address is the same. Learning an address is simply a prerequisite in interesting exercises such as a Man In The Middle attack, or WEP cracking.

The bottom line? MAC address filtering is probably the lamest form of WiFi security that you can try. It's easy to do, but easy to bypass too.

>> Top

Setting The MTU In Windows Vista

Long ago, when I first heard of the dynamic tuning in the Windows Vista TCP/IP stack, I envisioned the manual setting of the static MTU to be a thing of the past. Unfortunately, I was wrong - the MTU is still a fixed setting, in Vista.

The legendary tool, DrTCP, which is used by everybody to change the MTU in Windows 2000 and XP, doesn't work under Windows Vista. Fortunately, Microsoft now allows us to adjust the MTU using the "netsh" command. As other commands in Windows Vista, you run "netsh" using the command window, in Administrative mode.

To see what interfaces you have on your computer, type

netsh interface ipv4 show subinterfaces

To change the MTU, type

netsh interface ipv4 set subinterface "Local Area Connection" mtu=nnnn store=persistent

where

Local Area Connection is the name of the network connection on your computer, from the list obtained above.
nnnn is the desired value for MTU.

Reboot after making the change.

>> Top

Windows Vista And The IPX/SPX Protocol

Along with providing IPV6 as a default network protocol in Windows Vista, Microsoft made another major change to the protocol stack there - they eliminated the optional IPX/SPX selection. Microsoft now does not support IPX/SPX, in any way.

Note:
Windows Vista does not provide a NetWare client or the IPX/SPX protocol.

You can get a Novell client, from Novell. We haven't confirmed that this is IPX/SPX, though.

>> Top