malicious?

Lord Lien

I bow to your superior knowledge. How do you know when a link is malicious before you visit it and get the pox?

Is it because you don't visit any links? Is it because you visit only websites that are impossible in the lifetime of the universe to be compromised?

I too am paranoid, but also know how ANY website can harbour mischeif. ANY website can be compromised (even if not the server, then their DNS can be made to point elsewhere). The excuse that something ONLY works if you click a malicious link just means that someone has to place the link where you will click it... and you do click links somewhere.

sorry nurse, I'll take the pills now

Oh the porcinity!

Damn those evil sausages!

Port 25

Meh!

I stopped using port 25 for SMTP years ago, heck I've not been using plain text e-mail for years too. Okay I know there is always the chance that SSH encrypted mail could be comprimised and the security is only as good as it's weakest link.

I dare say that this problem isn't because the routers run Linux, for starters, Linux is just the kernel. Could maybe be down to the default settings of how the router handles ports (can't remember name of the package, it's too early in the morning and I haven't had my McDonalds breakfast yet!)

Rob

not a problem

A quick google for "open ports tester" or similar will find lots of web-based thingies that you can use to test.

Hope that helps, mine's a strong coffee with a large shot of something medicinal, in this weather.

PEBKAC

I also use and love NoScript. But as a web developer I can tell you it's trivial to develop a website entirely in Javascript that displays a simple "This site requires Javascript enabled" message to a NoScript user. If that user has been given the impression that the site contains something he or she wants, they'll automatically reach for that NoScript Options button and select "Allow shitsite.com" without a second thought.

Granted, you might be savvy enough to think "Why does simply showing me some info require Javascript?" but depending on how badly you want that info, even you might be prepared to at least "Temporarily allow..." just one time to see what it is. Furthermore, this attack involves form submission. It's far from unusual for forms pages to require Javascript for dynamic option updating and on-enter form validation, and even a tech-savvy user thinking he's signing up for some useful service would be taken in.

NoScript is only as good as the person using it, and with its use becoming more prevalent, the blackhats will become ever more creative in finding ways of meat-hacking people into selecting that much-desired "Allow shitsite.com" option.

Newflash!

People sometimes use phrases which are not strictly semantically correct and yet remain common parlance. Ric Romero has more at 11.

Something's not right

Only allowing ANY connections to 80 and 443? If so then you almost certainly would not be able to browse the internet. You need to allow UDP (any sometimes TCP) port 53 also for DNS. As this would not seem to be the case then this suggests you've not locked your router down as much as you think you have.

If you've got some clever rule that only allows 80 and 443 for HTTP protocol (ie your router is performing packet inspection) then unless IRC etc is also running on HTTP then the packet inspection rule will not block it. I've never used it, but I'm pretty sure Facebook chat and similar DOES work over HTTP port 80 (it's just a web page and a bit of javascript running on the browser).

ICMP is a protocol and not a service, and most ICMP stuff can be blocked without causing problems (you might need to allow 'time' - I think some SMTP servers can have issues if this is blocked, but I may have got this wrong - I don't have the necessary info at hand). Generally, you need to set your TCP, UDP and ICMP firewall rules seperately.

Oh

"Can't see any benefit in blocking outgoing ports whatsoever myself"

You don't see any need to prevent internal network data from leaking out onto the internet? An interesting point of view.

Leaving aside the very obvious security considerations for now, it is this thinking that has resulted in the small but significant amount of noise on the internet at large, consisting of stuff like Windows broadcast requests searching for other machines (which it will never find), and other stray broadcast message. All of these messages should never leak out; they should be contained on the local network. And before you say "it doesn't matter", well, yes it does! It wastes bandwidth and causes load on other internet-based kit that has to deal with this stuff.

And contrary to what you say, many expoits rely on ports other than 80 being open.

Not so.

"Only allowing ANY connections to 80 and 443? If so then you almost certainly would not be able to browse the internet. You need to allow UDP (any sometimes TCP) port 53 also for DNS."

For most home NAT-based routers, you do NOT need to allow UDP/TCP 53 for DNS to pass through, because they contain their own DNS server, which will make the external requests.

Easy to check: run ipconfig /all or whatever command your OS uses to enumerate DNS servers. If the only DNS server listed is the ip address of your router, then it is running a server, and UDP/TCP 53 does not need to be opened.

Sir

"People need reminding"

They certainly do.

I was working in the City a few years back and a server chap boasted how he had an uber-secure linux system at home that was uncrackable. So myself and the Security bod decided to take up his little challenge.

We were helped by the fact he decided to leave his laptop unlocked that lunch-time it has to be said.

When he got back from lunch we told him we'd put a little hello file from both of us in his root directory, whereupon he immediately vpn'd to his home device to check. The key-logger we had installed was busy sending us info which my commpratriot was using to perform the deed whilst I chatted to the numpty.

Needless to say he was a bit miffed when he found a little text file in his root directory (he didn't even check the timestamp (which was about 3 seconds before-hand)).

We didn't let him know how we'd done it for three glorious days, and he didn't have much hair to start with. When we finally put him out of his misery he claimed we had cheated !

Ah, heady days :D

How's that cheating?

I'd call it a nice bit of social engineering. Nicely played on Linux gimp ego and vanity to get his info. No point whining about cheating; security's there because people cheat, after all!

Unfortunatly Not...

The exploit works on my Draytek 2950.