NWA-PCUG Newsletter Article, July 2003
Security Testing Online - Fraud or Not?
by Greg West
Sarnia Computer User's Group (SCUG), Sarnia, Ontario, Canada
gjwest@sympatico.ca
(click to email author)


Recently, while researching material I came across an article which discussed "Spring Cleanup" and computer maintenance. The first suggestion was to run your computer through an online test to see whether your system is secure or insecure. The current warnings of updating patches, Spam attacks, and overall computer safety, prompted me to say, "why not" as I clicked into "NanoProbe Technology Internet Security Testing for Windows Users" that uses a program called: Shields UP!! (http://grc.com). Suspecting a scam of some sort I figured I would attempt to trick this program. I would run the test twice, once with my firewall turned off and another test with it operating.

My curiosity peaked immediately after my first click when I received a message that I "was about to view pages over a secure connection", a more than familiar message indeed. So I continued on, yet still mostly skeptical that there was some sort of come-on to reach out and take my money. No sooner than I clicked the "ok" button, did I receive this strange message:

" Greetings Gregory! Without your knowledge or explicit permission, the Windows networking technology which connects your computer to the Internet may be offering some or all of your computer's data to the entire world at this very moment! (For example . . . that's how I know your name!)"

Next I was given a choice of testing my "Shields" or "Ports"…I clicked on "Shields" became even more skeptical when I received this message:

"Preliminary Internet connection established! Your computer has accepted an anonymous connection from another machine it knows nothing about! (That's not good.) This ShieldsUP! web server has been permitted to connect to your computer's highly insecure NetBIOS File and Printer Sharing port (139). Subsequent tests conducted on this page, and elsewhere on this website, will probe more deeply to determine the extent of this system's vulnerability. But regardless of what more is determined, the presence and availability of some form of Internet Server HAS BEEN CONFIRMED within this machine . . . and it is accepting anonymous connections!"

The message continued to give the full details of its findings, or non-findings:

"The rest of this website explains the implications and dangers of your present configuration and provides complete and thorough instruction for increasing the security of this system. At the moment, any passing high speed Internet scanner will quickly spot this computer as a target for attack. The phrase you must remember is: "My port 139 is wide OPEN!" Unable to connect with NetBIOS to your computer. The attempt to connect to your computer with NetBIOS protocol over the Internet (NetBIOS over TCP/IP) FAILED. But, as you can see below, significant personal information is still leaking out of your system and is readily available to curious intruders. Since you do not appear to be sharing files or printers over the TCP/IP protocol, this system is relatively secure. It is exposing its NetBIOS names (see below) over the Internet, but it is refusing to allow connections, so it is unlikely that anyone could gain casual entry into your system due to its connection to the Internet. Several of your private names are being served up to the Internet by the Windows networking system. (see below) While it's unlikely that this information can be exploited, you should know what anyone can learn about you and your system."

But the kicker was that my User Name, my Computer's Name, and my Workgroup was identified on screen…I knew I had to go to the next level and test my Ports. Here are the results of the Port testing:

It declared that my Port 80 (http) was open and that "having port 80 "open" as it is here causes intruders to wonder how much information you might be willing to give away."

The test program also found my Port 139 (Net BIOS) was open and I received this warning:

"As you probably know by now, the NetBIOS File Sharing port is the single largest security hole for networked Windows machines. The payoff from finding open Windows shares is so big that many scanners have been written just to find open ports like this one. Closing it should be a priority for you!"

Well, I must admit I was becoming a tad worried, but still I was skeptical towards the reality of these results. Next I wanted to run these test using my Zone Alarm Firewall operating. Here are the results of testing both my shields and ports:

On the Shield's test I got the same first "GREETINGS" message, only this time it did not contain my name. The results were amazingly secure. The Shield's UP test could not find my Port 139, nor was it able to connect with my NetBIOS to my computer. Here are the results of the Shield's test:

"Your Internet port 139 does not appear to exist! One or more ports on this system are operating in FULL STEALTH MODE! Standard Internet behavior requires port connection attempts to be answered with a success or refusal response. Therefore, only an attempt to connect to a nonexistent computer results in no response of either kind. But YOUR computer has DELIBERATELY CHOSEN NOT TO RESPOND (that's very cool!) which represents advanced computer and port stealthing capabilities. A machine configured in this fashion is well hardened to Internet NetBIOS attack and intrusion. Unable to connect with NetBIOS to your computer. All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet."

My firewall came through with shining colours and with full security. Next was the Port test with the firewall operating. This test reported my Port 80 was open (http), however this is my connection to the net and my firewall blocks the incoming attacks as they are produced…giving me the choice whether to accept or reject, but nothing comes through without my acceptance. So this warning is ok. The next warning I received was again concerning Port 139, this time I got the same message that it could not get through to this port and furthermore, "There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!"

Not a fraud, only success! My confidence in firewalls stands firm, sound and free of worry.

There is no restriction against any non-profit group using this article as long as it is kept in context, with proper credit given to the author. This article is brought to you by the Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member.

Click here to return to top



==================================================================