Security White Papers, Writeups, Etc.


Windows IRC File Sharing Robots

There is a nice writeup by TonikGin on how IRC XDCC Robots are getting installed on Windows boxes and used for file sharing. [Note this is a local copy since his site has been hacked.]

Recently on campus we have been seeing less of the IRC sharing and more of the hackers simply setting up the Serv-u FTP server for both uploads and downloads.

CERT Advisory on Windows Share Attacks

On March 11, 2003 CERT put out advisory CA-2003-08 about increased attacks on Windows Shares.

Microsoft Security & Privacy Basics

Microsoft has put together several articles aimed at home users discussing security and privacy basics.

Microsoft Securing Windows 2000 Server Documentation

Information from Microsoft on securing Windows 2000 Server.

Windows Password Authentication/Encryption

Windows has several Password Authentication/Encryption methods. Which methods are used are controlled by the value of the LMCompatibilityLevel registry key. You should set this value as high as possible, I recommend a minimum of 3 with a prefered setting of 5. See the articles below for information on changing this setting.

Restricting Anonymous Registry Access in Windows

Campus is currently experincing a large number of attacks on Windows computers which take advantage of anonymous registry access using 'Null Sessions'. The most frequent attack is listing the user accounts, especially those with administrator level access, and running fairly basic password crackers on those accounts. This is the type of attack described in the IRC XDCC acticle above. In general this feature is not needed on most computers and Microsoft has documented how to disable it.

For Windows NT http://support.microsoft.com/default.aspx?scid=kb;en-us;143474.
For Windows 2000 http://support.microsoft.com/default.aspx?scid=kb;en-us;246261.

Windows Universal Plug and Play (UPNP)

The UPNP service will allow your computer to easily detect and utilize plug-and-play networked devices. When this service was first made available in Windows in 2001 there was a vulnerabilty for which a patch has been available, and you should verify has been installed on your computer.

In addition since this service is not used by most people on campus it is recommended you also disable the service using the information in the Microsoft patch notice.


Send questions or comments to security@help.ncsu.edu

Last updated 29 July 2003 by jsw