full-disclosure - Odd Behavior - Windows Messenger Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.43.0307171459371.14978-100000@tundra.winternet.com>
From: dufresne at winternet.com (Ron DuFresne)
Subject: Odd Behavior - Windows Messenger Service

	[SNIP]

>
> I was wondering about this as well.  Even if you don't run a local FTP,
> HTTP, NFS, SMB, SSH, or other service on your local Linux workstation,
> you're guaranteed to be bringing up parts of the system to talk to the
> network during the boot process.  Chances are you're broadcasting for
> DHCP.  If you're a thin-client, you may be asking for tftp or bootp even
> before that.  If you're running a virus scanner, it may be starting in
> the background, downloading updates automatically from a central server
> and scanning files.  If you've got NIS, ADS, or Kerberos or something
> running, you may be hooking into local authentication systems.  These
> things are all true for Windows workstations and Mac workstations, too.
>

All the more reason to configure such protocols properly and securely;

	bind them to the proper NIC:ports, and do not allow them to bind
	to all NIC's

	for those nasty protocols and such that defy configuration
	directly, make sure they are secured by other meand, say a
	firewall or personal desktop firewall at the least, to limit
	exposure to something other then the open internet.

Enforcing paramaters upon the less then nice protocols merely requires a
tool outside the specific portocol itself.  May home users, being on
dialups still, do not have as much 'startup' exposure, and those with
DSL/cable modem access, would do well to firewall those 'NICS', as well as
rotate them to start after such services as the firewall/IDS etc...

But, it seems this will be rehashed for another week since we're stating
nothing that has not been stated by at least 20 others already and some
refuse to injest.

Thanks,

Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.