RealtyTechBytes.com

21 January 2008

Firewalls ~ You really, really, really need them!

Posted by Jerry Kidd under: Computer Security .

Here is the Cliff Notes version for those of you in a hurry: You need one. Go get one. Stop arguing.

Now for the rest of you, we’ll start with a little trip back through time.

Back in the days when desk top computers were just starting out, they were stand alone computers connected to nothing. The only way that one computer could talk to another computer was through what came to be known as “sneaker net”. Sneaker net got its name because if I wanted to get a file from my computer to yours, I had to copy the file to a floppy and then walk it over to your machine and put the floppy in your machine and then copy the file from my floppy to your hard drive. Hence the term sneaker net. This was great from a security point of view, since my machine was isolated from yours, no harm could come to it…unless it came via floppy disks! Guess what, the juvenile minded idiots that write viruses figured out that they could disrupt my computer by getting me to use a floppy that had a virus on it. Since sneaker net was slow and limited by its very nature, the propagation of these viruses was limited.

The next evolution was modems and what came to be known as BBS or Bulletin Board Systems. In this case you would use your modem to call the modem of the BBS computer and you could read and leave messages for other computer users. The drawback here was that the popular BBS often delivered busy signals instead of the connection that we were looking for. The hackers soon found these systems and pretty soon it became possible to catch a computer virus by downloading infected files from the BBS. Propagation was faster than by sneaker net, but still very slow by today’s standards because not many people were equipped with modems, nor did they even know about the BBS in most cases, or they got busy signals when they called in.

Fast forward to today. Most American households have a computer. The majority of them are connected to the Internet via high speed access through cable or DSL. One of the things that the hackers discovered was that when people got high speed access, they often left their computers on all the time. This was a major discovery, because if a computer is on all the time and it is constantly connected to the Internet, it becomes a sitting duck for hackers to attack. If you recall the old movie about the teenager who discovered that he could get into a Pentagon computer from his bed room, you may recall that he used a computer program to sequentially dial phone numbers until he found a modem that answered. Guess what? That is a real scenario. Today hackers use a software program called a scanner that will “dial” a series of IP addresses until it finds one that is responsive. Then they switch to something called a “port scanner”. Your computer has over 65,000 Ports built into the IP protocol stack. By sequentially trying each one of them, the hacker hopes to find one that is open and responsive. Once a port is found, the hacker then tries to crack the password (if there even is one) by using dictionaries…also run by computer.

Once the hacker has access to your system, he then installs a “back door” program on your computer. The back door, rootkit, or Trojan, sits quietly waiting, listening on its port for the hacker to come calling. The Trojan allows the hacker to run scanners from your computer to attack some one else’s computer. If he is successful, the attack looks like it comes from you. Whoopee. He has the fun, and if the attacked person can successfully trace the attack back to where it came from, you are the one left holding the bag. The Trojan also has the ability to allow the hacker to do anything they want on your computer including stealing information (Quicken, banking, etc.). They could also trash your hard drive if they wished.

How do you stop this sort of thing? By installing a firewall. Firewalls come in several flavors…hardware and software, internal and external. I use both an external, hardware firewall and an internal, software firewall on my home network, and also have it installed on my wife’s network in her office.

I use a LinkSys Switch and router combination. These are under $100.00 if you shop around. In connection with the LinkSys, I use the FREE ZoneAlarm firewall from Zone Labs. I also use antivirus software as well. I update my virus signatures daily and run a virus scan several times a week, in addition to the real time virus scanning that occurs as I go about my daily business.

So, is all this necessary? Yes it is. I have examined the logs from both the LinkSys router and ZoneAlarm and have found about 5 to 10 external attacks each day! This just amazes me. I wonder what’s going on with your computer if you aren’t protected…don’t you?

One final note. The LinkSys will stop the bad guys from even seeing if there is a computer at my IP address. The ZoneAlarm will stop a Trojan from using my computer to reach out and touch someone.

So, if you don’t have a firewall and you are using DSL or Cable or T1 or other high speed access…stand by for trouble. You have been warned.

2 Comments so far...

Leave a Reply