Hacker Attack P2

I Know Where You Live
Another feature of a high-speed connection is that you never have to dial into the
Internet. Your high-speed connection is always on, like TV. But here’s the rub: with an
always-on connection, your virtual door is always open to the big, bad outside world.
Broadband connections give you a permanent Internet (IP) address. The Internet address
to your computer never changes. Stop and think of the implications: To a hacker, it’s the
equivalent of I know where you live!
When you use the old slow, modem dial-up Internet connection, a different IP address is
dynamically assigned each time you dial in. When the phone connection is broken because
you shut down your browser or e-mail reader program, or turn off the computer—that tem-
porary IP address evaporates.
But with the new high-speed connections, you get a stable, lasting IP address, just like
your permanent phone number or house address. Chapter 7 goes into detail about the
dangers you face from these new connections, but be aware that your personal exposure to
hackers becomes considerably greater when you open your computer to the Internet world
with an unchanging IP address that’s always “on.”
Free Long-Distance Phone Calls for Everyone!
Here’s How…
The IP address is a unique number assigned to each computer on the
Internet. For example, when you click a link to go to a Web site, the
words in the link (such as microsoft.com) are automatically translated
into an IP address. The human-friendly words of an Internet address
like microsoft.com are changed into the computer-friendly digits of an
IP address. IP addresses are made up of four numbers, separated by
periods. Here’s a typical example:
212.53.166.236
Sometimes you might want to give a friend your IP address (if you
have a permanent one). For instance, you might want to save yourself
a lot of money if you have friends overseas. You can use Microsoft’s
NetMeeting utility to send typed “chat” messages back and forth; to
send files or graphics; or if you have a sound card, plug a microphone

Like Spiders to Flies
5
2830ch01.qxd 8/29/00 8:45 PM Page 5
Free Long-Distance Phone Calls for Everyone!
Here’s How… (continued )
into it (a cheapie from Radio Shack or CompUSA works just fine) and
you can have long-distance phone conversations with a similarly
equipped friend anywhere in the world. These calls cost nothing and
you can talk as long as you want. I recently spent an hour talking with
a friend in Athens, Greece. Imagine how much that would have cost
via a traditional telephone. There can be a little echo, but ordinary
phone calls aren’t exactly high fidelity either.
NetMeeting is packaged with Internet Explorer 5, which in turn is pack-
aged with Windows 98 and 2000. So to run NetMeeting, click your Start but-
ton, then click Programs and scroll down until you see NetMeeting. (If you
don’t see it there, look in Start ➢ Programs ➢ Accessories ➢ Internet Tools.)
If you haven’t used it before, it will take you through the setup process.
Once it’s installed, use it to make a call to your friend in Athens by
choosing Call ➢ New Call from its menus. Type in your friend’s IP
address, as shown in the following graphic:
Chapter 1 • Danger on the Internet
6
2830ch01.qxd 8/29/00 8:45 PM Page 6
Free Long-Distance Phone Calls for Everyone!
Here’s How… (continued )
You or your friend must find out your (or their) IP address, so it can
be typed into NetMeeting and make the connection. To find out what
your IP address is, first connect to the Internet using your browser or
e-mail program. Once you’re connected, click Windows’s Start button,
then choose Run, and type WINIPCFG. Click the OK button, and the

Windows IP utility executes, as shown in the following graphic:
Exploring the Three Windows Protocols
Windows includes three primary protocols (sets of rules) that facilitate communication
between computers. The three protocols are IPX/SPX, NetBEUI, and TCP/IP.
IPX/SPX A set of two protocols that permit network interconnections for people
who use Novell’s NetWare clients and servers.
NetBEUI (NetBIOS Extended User Interface) An augmentation of NetBIOS,
a utility that facilitates LAN communications. NetBEUI was originally created
by IBM, but has since been embraced by Microsoft for use with NT and
Windows 95/98.
TCP/IP This familiar Internet standard can also be used in LANs and WANs, as
well as the main communication over Internet connections. The TCP (Transmission
Exploring the Three Windows Protocols
7
2830ch01.qxd 8/29/00 8:45 PM Page 7
Control Protocol) part of this protocol divides your message into small pieces (pack-
ets) and then rebuilds those packets back into the original message when the TCP
program on the receiving end gets the packets. The IP (Internet Protocol) part of
TCP/IP deals with the addressing—ensuring that each of the packets is routed to
the right computer (there are lots of computers on the Internet at any given time).
Riding on the back of TCP/IP are additional protocols such as FTP (File Transfer
Protocol) and HTTP (Hypertext Transfer Protocol). Hypertext is the computer lan-
guage that is used to describe most elements of a Web page—it’s colors, typefaces,
and so on.
The point of all these layers of protocols is that they can be connected between appli-
cations, such as your browser, and the hardware that has a wire snaking out to the phone
company or the cable company. This wire is your physical connection to the Internet, and
it’s through this wire that a hacker can get into your computer. But short of cutting the
wire, or turning off all power—you can protect yourself by, for example, specifying that
you do not permit file sharing. That way, even if you have open ports on your computer,

most hackers can’t get to your hard drive. (You shouldn’t have open ports, in any case—as
explained later in this chapter.)
Understanding Windows
Internet Security
When the various versions of Windows are installed, they don’t offer, by default, the
greatest protection against Internet-based hackers. Windows is designed to permit vari-
ous kinds of networking—connecting different computers together either locally (LAN,
local area networking) or over long distance (WAN, wide area networking).
It’s obviously a trade-off between sharing and protecting: You want to be able to share
files and other resources, such as printers, with your friends or co-workers. On the other
hand, you don’t want to share things with strangers, especially hackers.
Later chapters go into more detail on some of these topics, but it’s good to get an over-
all view of the inherent problem.
File Sharing Is a No-No
Leaving file sharing turned on is so wrong for most people’s systems that I’m repeating
this central advice more than once in this book. Turn off file sharing in Windows 98 by
choosing Start ➢ Settings ➢ Control Panel. Double-click the Network icon. On the
Chapter 1 • Danger on the Internet
8
2830ch01.qxd 8/29/00 8:45 PM Page 8
Configuration page of the dialog box, click the File and Print Sharing button. Uncheck
the check box next to “I want to be able to give others access to my files.” Click OK twice
to close the dialog boxes.
Most of us have no reason to permit the IPX/SPX or NetBEUI protocols to be actively
available on our Internet connection. Nor do you want your Windows Personal Web
Server features gaping open on the Internet.
All that most of us need to expose in order to exchange e-mail or surf the Web is
our TCP/IP protocol. In practical terms, you should not need to expose various ports
(entrances), server behaviors (such as Personal Web Server), and other elements of your
computer.

Knocking at Your Own Door
Enough theory, let’s try an experiment to see how much of your computer you’re exposing
to the Internet. An excellent site known as Gibson Research Corporation has several
helpful features including Shields Up! (more about this site in Chapter 8).
For now, you can use its test facilities to probe your system for weaknesses. Go to the
Web page: www.grc.com.
Testing Your Shields and Ports
Click the Shields Up! links (you need to click two links on two different pages) to go to
the test page. Scroll down and you’ll see two buttons: Test My Shields! and Probe My
Ports!
If you’re on a network, get permission from your computer depart-
ment before conducting this kind of test.
If you’re not on a network, or have gotten permission to try the tests, click the Test
My Shields! button. Your IP address will be identified, and the tests will begin. In my
computer, a series of problems were reported (in clear, understandable English). For one
thing, Port 139 was yawning open for all to see (and probe). This port permitted Shields
Up! to connect to my NetBIOS file and printer sharing port. To put it bluntly, my com-
puter had an open port that could be exploited by anyone who detected it. Remember
Knocking at Your Own Door
9
2830ch01.qxd 8/29/00 8:45 PM Page 9
that hackers use programs that fly around the Internet testing IP addresses for just such
an exposed entrance to somebody’s machine. I don’t want strangers to use this entrance to
gain access to any information about me or my hard drive—but this is precisely what’s
happening. I need to take steps to either shield or close Port 139!
It’s Creepy When Your Personal
Information Leaks
Additional probing by Shields Up! during the Test My Shields! investigation revealed
that a connection via NetBIOS turned out to be blocked, but nonetheless, my username,
computer name, and workgroup were all being made public. I do have printer and file

sharing turned off on my machine, so no connections are being permitted through this
open NetBIOS port. But you’ll agree that it’s creepy that some of my personal informa-
tion is sitting there for all to see.
Further tests revealed that the Media Access Control (MAC) address of my Ethernet
(networking) card can be read by anyone as well. This card is used to connect my com-
puter to my cable modem. Strangers not only can see my user, computer, and workgroup
names, they can also uniquely identify my machine. The MAC is your Ethernet’s unique
serial number. No other card has this number. So it’s as identifiably yours as your DNA.
There are times when all of us want our transactions on the Internet, such as banking and
investing activities, to be private. That there is a unique ID associated with my online
activity, and that this ID is public, is of serious concern to me.
When I tried Shields Up!’s Probe My Ports! button, the results confirmed my prob-
lems. The probe tested 10 common ports (remember there are over 60,000 ports, so this
probe only checked some of those that are popular hacker targets). Again, Port 139 was
demonstrated to be open. Steve Gibson, the creator of the Shields Up! utility, says on the
same Web page where you get your results that “The NetBIOS File Sharing port is the
single largest security hole for networked Windows machines.”
Notice that I’ve got a live “network” even though I’m not on a network. It’s possible to
be exposing network connections in your computer to the Internet (itself a huge WAN),
even if, like me, you don’t actually belong to any physical network. I work here at my
home, alone. I use the one computer, connected to no other. Why, I don’t even have any
close neighbors! I thought I was safe, private, anonymous, and secure when plugging into
the Internet. In my case, that Ethernet card, which is required by my cable modem com-
pany, identifies me to the world. In addition, the port probe also revealed that all of the
Chapter 1 • Danger on the Internet
10
2830ch01.qxd 8/29/00 8:45 PM Page 10
10 ports checked were acknowledged by my computer. In other words, it told strangers:
yes, this port does exist on this machine at this IP address, though it’s currently closed.
Crackers make lists of such ports and try, try again to gain entry.

Ideally, all ports would be entirely invisible to outside probes: they wouldn’t even be
able to detect the existence of any ports, much less whether any were open or closed.
Fortunately, there are solutions to all these problems.
The Best Solutions to Hacker Probing
If, like me, you get disturbing results from the Shields Up! tests, you can read the various
pages in Steve Gibson’s site that show you how to block probes, turn off ports, and other-
wise solve problems. Another approach is to install the free, powerful, and excellent utility
called ZoneAlarm. This personal firewall will cloak your computer in a stealth shield—
your system will appear less substantial than a ghost’s smile. If you want to get protected
right now, turn to the instructions in the section titled “Set up a ZoneAlarm” in Chapter 8.
It’s easy, sturdy, and fast. And—unless you’re a business, government, or educational insti-
tution—it’s free.
Knocking at Your Own Door
11
2830ch01.qxd 8/29/00 8:45 PM Page 11
2830ch01.qxd 8/29/00 8:45 PM Page 12