|
Personal Firewalls (work in progress)
How Do Firewalls Work? How Do Computers Communicate? What are ports?
Just like our homes have street addresses, our computers have IP addresses.
These are the numbers computers use to identify themselves. To make it easier
for people to remember computer addresses, the addresses are often converted to
a more friendly format called a DNS name. For example, the JMU web server, whose
address is 134.126.10.59, has a DNS name of
www.jmu.edu.
When computers communicate, they do so using packets of information similar
to postal envelopes. Each packet envelope has a destination address, a return address, and
contents that vary with the purpose of the communication. It is the job of the
network to properly route these envelopes to the desired destination. When one
computer talks to another computer, many envelopes are exchanged during the
process.
Many different programs may use the
network at the same time. An email program, a web program, and an instant messenger program may
all be in use at once. To make sure messages don't get mixed
up between different programs, each program listens and talks through a
different door on the computer. Every computer has 65,535 TCP doors and 65,535 UDP doors. The meaning of TCP and UDP isn't important right now nor is the
difference between the two. The important thing to remember is that there are
thousands of doors through which computer programs may communicate. These doors
are referred to as "ports".
When you go to a web server, your traffic goes out one of the doors on your
computer to one of the doors on the web server. Which door you leave through
doesn't matter. In most cases, it is a door with a number greater than 1023.
However, what door you visit on the web server is important as the web server
program will only be accepting visitors on one of the thousands of doors on its
own computer.
To make talking to services like web servers easy, people have agreed over
time to use a common set of doors for servers. Thus, doors 443 and 80 are the
doors where almost all web servers listen for visitors. One door is for SSL
protected sessions and one for unprotected sessions. Mail servers accept
visitors at door number 25. Each type of server program has an
assigned door where
it should accept visitors. This makes it easy for clients like you, I, and our
browsers to find
the right door to talk to the service in which we are interested.
When we use a web browser to go to http://www.jmu.edu, the web browser knows to go to door number 80 on the computer known as
www.jmu.edu which a name server tells our
browser is at address 134.126.10.59.
Although people have agreed to use specific ports for specific purposes,
there is nothing to prevent people from doing otherwise.
Firewalls work by refusing access to doors. Even if a server program
on our computer opens a door and listens for visitors, the firewall keeps visitors out. Unless, of
course, we open a hole in our firewall and tell it to allow visitors through to
the open door. This blocking
provides protection against visitors who may visit doors on our computer that we
don't know are open, that are defective, or that are opened by malicious
software like viruses.
Firewalls can be separate devices that sit on the network and do nothing but act as
traffic cops or they can reside on our computers in the form of personal
firewall programs.
Most personal firewall programs that run on a desktop not only block external
visitors but also watch for programs
on our computer that try to open our doors. When a program attempts to open a
door, the firewall lets us choose
whether or not to permit it. Choosing which programs to allow to open doors on
our computer can be tricky and a wrong decision renders the firewall useless.
Checking to see what doors are open on our computer is a little
complicated. The netstat utility will tell us what doors are open. However,
deciphering its output is a little tricky. To make it as easy as possible, first
reboot the computer and make sure not to start up any programs. Then, open an
MSDOS, CMD, or terminal window and type "netstat -an".
Any doors labeled "LISTENING" are programs with open doors waiting for visitors to your
computer. To close
the doors, you must stop the programs that open them. Many of these programs
start automatically when the computer is first started. How they can be stopped (and the door closed) depends upon the particular program.
Finding out what program is opening a door is the first step. This can be a
tricky process and, among the
Windows family, only Windows XP
makes it halfway sane. With Windows XP, typing "netstat -ano" provides us with
the information needed to know what programs are opening the doors. The output
of that command provides the "process ID" (PID) of the programs. By using that
PID, we can then go to the task manager, cross-reference the PID, and find the
name of the program opening the door. The task manager can be started by
right-clicking the task bar. Figuring out what the programs are and do is a
major job in itself. For example,
here is a list of services that may be found on a Windows 2000 computer and
here is a
site that describes what is involved in controlling them.
Other versions of Windows don't offer a way to find the program responsible
for opening a door. Instead, a third party tool must be used. One such tool for
Windows NT and 2000 is
Fport from
Foundstone.
If you run linux, the command to find out what programs are opening doors is "netstat
-anp". The lsof command will do the same for other unix computers.
Some network programs don't have assigned doors. Instead, they register with
a doorman. The doorman opens a door and listens for visitors on a commonly
known, assigned door just like other network programs do. When a visitor
arrives, they ask the doorman where the services of one of the registered
programs can be found, and the doorman directs the visitor to another door. The
Windows and Unix Remote Procedure Call (RPC) services use this architecture and
the doorman is called a port mapper. Some other programs also break the rule of
one door - one program. The most common programs exhibiting this behavior are
FTP and some game and peer-to-peer file/music sharing programs. Firewalling RPC, FTP, peer sharing,
and similar applications can become complicated or impossible because the ports
may be shared by multiple services or change from one instant to another.
Tools to determine port and program usage for RPC services include:
An open door doesn't necessarily mean that someone can break into your
computer. But if the door is opened needlessly, risk can be reduced by closing
it or denying access to it. When a program opens a door on a computer, it is the
responsibility of the program that opened the door to control access and limit
the ability of visitors to do harm. Unfortunately, this doesn't always happen.
How Do People Break Into My Computer?
First, lets define a computer break-in. A computer break-in is when someone
unauthorized to do so:
- Breaks through door locks to access data on your computer
- Causes a program to be run on your computer. Since the program controls
the computer, they have effectively taken control of the computer.
There are other types of incidents that are similar but different in ways
that are important to understand:
- Someone may convince you to run their program on your computer. They may
do this by sending you a malicious email attachment, offering you an instant
message download, or simply by making a malicious program available on the
Internet. They'll usually try to make the program attractive by naming it
something desirable or by using an email message with a tricky subject line or
false "From" line. If you run the malicious program, you break into your
computer for them by giving control of your computer to their program. That
program probably has the ability to disable your personal firewall. These
types of problems can be avoided by
refusing to
run unknown software.
- Someone may search for open doors on your computer and, if found, try
to take advantage of them in a variety of ways. This is sometimes called "port
scanning". If no doors are open or the programs that open them handle the
malicious visitor properly, a break-in can't occur. The moral questions
associated with the door checking are contentious and some programs do this as
a normal part of their operation.
- Let us say you configure a Windows computer to share a folder on the
network without a password. Someone may fill the folder with viruses, modify
files that you're trying to share with others, or delete files other people
put in the folder to share with you. In this case, the program that opened the
door is performing exactly the way you told it to....let anyone in without a
password and do anything they want. It is difficult to call someone that takes
advantage of this "unauthorized" but they are certainly abusing your computer
and intent. A personal firewall will not help with this problem. These types of incidents can be avoided by
nullifying
unneeded risk.
- Some folks abuse doors that we want left open or that the vendor left open
for us. Sometimes this type of abuse can be prevented by simply closing doors,
especially those left open unnecessarily by vendors, but more often extra cost
and complexity is required in the software that opens the doors and/or the
network leading up to the doors. Examples include:
Click here for a more thorough description of how people break into our
computers.
Most common break-ins can be prevented by setting up our computer in a more
security manner described by StartSafe, and
subsequently operating our computers in a safe
manner as described by
RUNSAFE.
How Does a Firewall Prevent Break-ins?
Personal firewalls protect against external attacks by limiting
access to doors.
When a program opens a door on a computer, it is the responsibility of the
program that opened the door to control access and limit the ability of visitors to do harm.
There are several reasons this may not happen. Among them:
- The program may have a defect allowing visitors to do unintended things.
Unfortunately, this is a common problem and is responsible for many computer
break-ins. To help avoid this scenario we must
update our
programs regularly.
- The program may be fooled into thinking the visitor is someone we
authorized to use the door. For example, the visitor may have discovered the
authorized person's password or spoof a computer address we've allowed to use
the door.
- The program may be misconfigured by the operator or be shipped in a
vulnerable configuration.
- The program may simply be too trusting in its design. It may have been
designed with a trusted network in mind while it, in fact, resides on the
Internet along with 300 million other people.
In any of these cases, if a firewall does not permit access to the door, the
problem is prevented. Doors that are typically open on a desktop Windows computer
out of the box include:
- Windows File Sharing
- Windows Messenger (and other RPC services)
- Windows Plug-n-Play services
Of course, if we configure the firewall to allow access to a door, like to
provide access to a shared folder, run a music sharing program, or run a web server, then we
must be careful about the maintenance and configuration of the program that
opens the door on our computer by following
RUNSAFE guidelines.
Personal firewalls help reduce the effects of already
compromised or infected computers by
limiting access to outbound doors.
Personal firewalls can also help reduce the effects of a pre-existing
computer break-in or untrusted programs. However, it is important to understand that once a break-in
occurs or untrusted programs are run the computer is already compromised and the person or malicious program controlling the computer can disable the
personal firewall. Many viruses do this. It is better to prevent the initial
break-in in the first place by following StartSafe
and RUNSAFE guidelines
then to depend upon the integrity of a personal firewall running on a
compromised computer.
Some malicious programs make use of the network to perform their dirty work.
They may open network doors to let other people into our computers as do
remote control trojans. They may send out private information. They may try
to spread themselves to other computers through email, instant messages, file
shares, and other means.
In these cases, personal firewalls help prevent the malicious behavior by not
allowing unauthorized programs to open doors on our computer. Depending upon the
particular firewall program and configuration, it will usually pop up a warning
message telling us that such and such a program is attempting to open a door and
ask us if we want to permit it. Making a decision is sometimes difficult and if
we allow the wrong program to talk to the network out of a hasty or uninformed
decision, the protection provided by the firewall is lost.
The idea behind a firewall is to prevent malicious communications. However,
they are very limited in their ability to determine what is malicious and what
is friendly. It is up to the operator of the firewall to understand the
implications of any configuration decisions.
What Do I Do When My Firewall Tells Me A Program is
Trying to Communicate on the Network?
(under development)
On some firewalls, when a program needs to talk to another computer on the
network, whether its a web site, email server, or instant message buddy, it
opens a door on your computer. The first time a program does this after a
firewall is installed, the firewall will ask you if you want to allow it. It
will generally give you three options:
- Denying the program access to the network
- Allowing it just this one time. You will be asked again the next time it
wants to use the network.
- Allowing it forever more. You will not be asked again the next time it
wants to use the network.
In general, these warnings should not come up unless you ran a program for
the first time since installing the firewall, or after a new program is
installed. If neither of these situations apply, it would be advisable to block
the program and call support. If you did just install a new program, how much do
you trust the author and its distribution mechanism with everything on your
computer?
This is another one of those cases where we're between a rock and a hard
place. The underlying technical decisions can be complex and confusing. If we
try to make the software intelligent enough to make the decisions for us, we
risk the same type of mistakes and issues we're trying to cure with the firewall
that are caused by other overly presumptuous and
permissive software.
What Does it Mean When My Firewall Reports an Attack?
What Should I Do?
Generally it means the firewall detected some unexpected network traffic to
your computer. Sometimes that traffic is malicious and sometimes it isn't.
Whether it is malicious or not, it is rarely harmful because your firewall
blocks it. If it is malicious, it is rarely under direct human control. That is,
the malicious behavior is usually due to an automated program...e.g. a
virus or worm infecting the source computer.
So, what should be done with the reports?
While you are connected to the Internet, your computer is going to get a
steady stream of unsolicited traffic. You're on a shared network with over
300,000,000 other people and a good many virus infected computers.
JMU's own organizational firewalls show hundreds, thousands, and sometimes tens of
thousands of attacks per day. Our virus logs show dozens or hundreds of
outside
infected computers per hour. We don't even attempt to send notification
reports on that much activity. We depend upon our firewalls to keep the unwanted
traffic out and concentrate on doing our work. A firewall today is like a screen
door keeping out flies. We may hear them buzzing outside but don't pay much
attention to them unless they're in the house. (Of course, if we notice a ten
pound fly on the screen door, or that our lawn is completely covered, we may
have a more proactive response.)
That said, JMU certainly has an interest in knowing when a computer on our
network, which consists of thousands of student computers in their homes as well
as computers owned by JMU, is involved in harmful activity.
In order for us to determine if your firewall report is accurate, and not
just a normal part of being on the Internet, we will need the logs from your
firewall. The firewall report by itself doesn't provide enough information to
track down what is happening. And we certainly aren't going to disconnect
somebody's computer because somebody we never met said "my computer said your
computer attacked my computer" without sufficient evidence. That would really
make the Internet chaotic.
We will need the firewall
logs generated by your firewall before we can determine the reason for the
activity or take any action. We cannot analyze a report that
does not contain a firewall log. Different firewall programs store these
logs in different places. You willl have to consult your firewall's
documentation to find out how to get to the logs and attach them to the e-mail
you send us.
Before sending the report to us, read through the following. You may find
that the report of an "attack" is misleading you.
The most common attack report we receive is a "port scan" or ICMP
ping. Your firewall may report one of these "attacks" if:
- Your computer has now, or has ever had, file/music sharing programs
installed on it.
- You are on a dial-up line or a new Internet Service Provider and you receive an IP address
previously used by a computer that had file/music sharing programs on it
These reports result
from file/music sharing programs running on other computers looking for their long lost buddy (your
computer's address) that they once communicated with. Its automatic. Its the way
the programs work. There is nothing you or anyone else can do about it. The most
common port connection attempts of this type target 6346 or nearby ports.
If the firewall reports a port scan (particularly to ports around 6346) or
an ICMP ping, ignore it. They are blocked by your firewall anyway. They're
basically harmless and you are going to be constantly subjected to them. If its
bothersome, carefully tell the firewall you don't want to be told about that
particular kind of attack anymore. Consult your firewall documentation.
If the firewall reports connections to any of the following ports, its
probably because the sending computer is infected. If it is a computer on the JMU
network (134.126.x.y), our
own detection mechanisms are likely also detecting it and the offending computer
either is, or will soon be, in quarantine. The firewall may also report that it detected the
various underlying exploits or virus infections (LSASS, RPC, DCOM, MYDOOM, Blaster,
AGOBot, SDBot, etc.) which makes things somewhat confusing.
- 135
- 139
- 445
- 1025
- 3127
- 5000
If the firewall reports other activity from a computer on the JMU network (a computer
with an address of 134.126.x.y), e-mail the information to
abuse@jmu.edu. We will need the firewall
logs generated by your firewall before we can determine the reason for the
activity or take any action. We cannot analyze a report that
does not contain a firewall log. Different
firewall programs store these logs in different places. You will have to consult your
firewall's documentation to find out how to get to the logs and
attach them to the e-mail you send us. Do not use the web to report the activity
because you won't be able to attach the log.
Do not expect an immediate
response. If the activity is associated with harmful behavior on the JMU
network, we will take steps to make it cease.
If your firewall is reporting activity from computers outside the JMU network
and you are on the JMU campus network, send us a report and we will try to determine
whether the report is something to worry about. Again, we'll need the firewall
logs generated by your firewall before we can accurately assess the situation.
If your firewall is reporting activity from computers outside the JMU network
and you are off-campus, you can send us a report but there isn't much we can do.
If you'd like to lodge a complaint with the network operators of the network the
"attacking" computer resides in, here are the instructions:
Type the "attacking" computer's IP address (from your firewall report) into
one of the Internet Number registry web pages below. This will typically tell
you the Internet Service Provider and often the originating organization and
contact e-mail addresses. For example, if you typed in 134.126.10.59, you'd see
that address is registered to JMU. Start with the ARIN registry. It will tell you if the IP address is
registered somewhere else and where you need to go.
Many organizations maintain a mailbox for complaints named "abuse". So, for
example, if you find the IP address belongs to America Online (AOL), you can
send the information to abuse@aol.com. The
"abuse contact" is often included with the registry information. An
email message drafted to the ISP (typically to
abuse@isp) may prompt them to disable the account or to contact the owner of the
sending computer. In most cases, if you get a response at all, it will be a
computer generated response acknowledging receipt of your e-mail.
Make
sure you include your firewall logs or they will not be able help you. By the
way, you can use the same procedure to complain about SPAM or other unwanted
e-mail. For e-mail, the sending computer's IP address is in the
e-mail headers which you'll need to include in your
complaint.
There are organizations that attempt to correlate activity from multiple
desktop firewalls and notify the owners of the network where the offending
computer is located for you. Note that they are volunteer organizations and are not
associated with law enforcement or any other official body. Two popular ones are
DShield and
MyNetWatchman. Before participating
in these types of services, make sure you understand their privacy policies.
Also consider that you are asked to trust your computer to the programs they ask
you to run for
the automated reporting capability. Use of these services is not recommended by JMU owned computers at this time.
Should I Install a Third Party Firewall or just use
the Windows XP firewall?
The primary advantage of third party firewalls is that they attempt to
control outbound connections from your computer. There are scenarios where they
can be fooled and even when they can't be fooled, they depend upon the
operator's judgment whether or not to allow a program to make a connection. The
choices can be confusing even for computer professionals. In addition, like
other resident security software such as anti-virus and auto-update software,
they are often disabled by malware if the operator makes a mistake. Finally, the
products often cause confusion and undue alarm due to their reporting practices.
So while they offer some additional protection, their effectiveness can vary
widely. A person interested in improving their desktop's security would much
more effectively decrease risk by operating the computer using a regular user
account (i.e. not administrator or power user) for day to day activities.
At this time, there are no plans to distribute 3rd party firewall software
for JMU computers.
How Do I Enable Windows XP Internet Connection Firewall?
A personal firewall is included with both Windows XP Professional and Windows
XP Home. It will block inbound attacks but will not control network access to
programs running on your computer. It is a valuable security tool and should be
enabled on most Windows XP computers. To enable it:
Click Start
Click Control Panel.
Click Network and Internet Connections
Click the Network Connections Control Panel Icon
Right-click Local Area Connection and select Properties
Click the Advanced Tab. If you don't have an Advanced Tab,
right-click Local Area Connection again and click Remove from Bridge.
Then go back to Properties and Advanced Tab.
Check the box labeled "Protect my computer and network by limiting or
preventing access to this computer from the Internet".
Click OK
Other ways to enable it and more information is available at the following
Microsoft site:
Some programs will require you to change the configuration of ICF to work
properly. Some of these are described at the following Microsoft web site:
A more complete overview of ICF is at:
XP Service Pack 2 Windows Firewall information soon...
How Do I Configure My Firewall to Allow Programs with Special Needs to Work?
(under development)
Preliminary Summary:
Most firewalls allow you to configure them based on a mixture of:
- what network doors are open on your computer
- what programs are allowed to open network doors
- what other computer addresses on the network can access the network doors
and programs
The support web sites for firewall manufacturers often provide
recommendations for popular programs.
It is always best to allow the least access necessary.
Enterprise Firewalls and Intrusion Detection Systems
Standalone firewall products developed for the enterprise often incorporate many
functions other than simple door blocking. Among these functions are:
- Authenticating the identity of visitors through varying means before allowing them through the
firewall
- Encrypting communications sessions in Virtual Private Networks (VPN) and
limiting access to these virtual private networks through
varying means of authentication of identity.
- Filtering out content such as email attachments, email viruses, and
dynamic web content
- Performance enhancements such as web caching
- Hiding internal computer addresses with a feature called Network Address
Translation (NAT)
Besides this extra functionality, enterprise firewalls often have more
sophisticated network access control methods than do desktop or standalone home
firewalls:
- They may open their doors only for return traffic from internally
initiated communications. For some applications, this involves multiple ports
and protocols and the ability of firewalls to handle different applications
vary. The overall effect is to prevent externally initiated connections and outsiders from scanning for and accessing open doors.
Except, of course, for the doors expressly permitted by the firewall
configuration rules.
- They may look inside the packets of certain types of communications to see if
there are any obvious signs of maliciousness or policy prohibited behavior.
Firewalls vary widely in this ability and generally do not have the level of
capabilities that products labeled Intrusion Detection Systems do.
- They may re-create the entire client and server environment inside
themselves and shuffle traffic piece by piece decoding and evaluating each
operation as it happens. This lets them have complete control of the behavior
of supported applications. The number of supported applications,
implementation detail, and protective actions, if any, vary greatly from
product to product.
Firewalls are not a panacea. They only enforce an organization's (or
individual's) security policy. Computers or services behind a firewall that are
allowed visitors are vulnerable and must be maintained accordingly. Many
complexities arise due to the constant compromise between usability,
functionality, and security.
The SANS organization, in cooperation with the FBI and many noted security
experts, recently published a list of the
Twenty Most Critical Internet Security Vulnerabilities. When contemplating a
firewall, it may be useful to determine how many of these vulnerabilities a
proposed firewall can address within the framework of your organization's access
and service provisioning policies.
Intrusion Detection Systems
Software and devices called "Intrusion Detection Systems" generally look at
more details in the communications traffic than firewalls do in an effort to differentiate between good
traffic and malicious traffic. However, the mechanisms they use to inspect the
traffic often result in a lot of warnings about innocent traffic. Additionally,
the definition of "good" and "malicious", and the
appropriate reaction to an event often depends on the environment in
which one works. Therefore, they have rarely been configured to block traffic
for fear of disrupting innocent communications.
Some desktop IDS programs will block traffic they define as malicious. Most
other IDS systems do not do this. They simply alert someone that something
suspicious has occurred and a follow-up investigation is necessary to determine
the actual outcome. New inline systems coming to market, sometimes labeled "Intrusion
Prevention Systems", actually stop the malicious traffic by using carefully
tuned, context intelligent rule sets.
|
