Internet Security

The internet is a very dangerous place. It's frequently assumed by home users that they will not be noticed on the internet, and nobody will be interested in hacking them. I have been told by one of my customers, when I recommended security software to them, that "I don't have anything on my computer that I'm worried about." This is, quite frankly, beside the point. Any compromised computer can be used as a stepping stone to attack another system, or it can be used as storage for illegal data. You may not have anything valuable in your house, but that doesn't mean you'd leave the door unlocked, so it could be set up as a base of operations for a terrorist group, does it? There has been more than one occasion where someone found they had child pornography, or something similarly illegal on their system, which was being linked from a commercial website. Not only did they have illegal material on their computer without their knowledge or permission, their computer was also being used to serve this illegal material to subscribers to a website, without any compensation. Click here for details of a recent find of this type.

This webserver keeps a log of any attempts to gain command-line access through common Windows NT and Microsoft IIS security vulnerabilities. Basically, what that means is, it keeps track of anyone trying to run a program on my computer from their computer through a security hole in the server software. This is the current record of attempts, and how many times they've been tried since I started collecting this data in an easily usable form, on Feb 5, 2003.

It's surprising how many of these attempts come from a few select IP addresses. An IP address is like a street address. It uniquely identifies your computer for the time you're connected to the internet. It seems only a handful of computers are actively trying to hack anything they can find on the internet, whether by way of a virus or worm, or a malicious user. If an IP address you are responsible for appears in this list, you might want to look into the security of the computer in question.

For the home user, with little or no knowledge of TCP/IP networking, there are a couple of things to keep in mind:

• This is only a list of the attempts made on one of 65,536 ports into this computer. Your computer could potentially be attacked 65,536 times more often than these records from this server indicate. All but 8 of those ports on this system are completely blocked with a hardware firewall.
• What each of these requests is trying to do is to actually gain remote administrative capabilities, or, more plainly, give the remote attacker complete control over my computer. If I were running a Windows/Microsoft IIS server, without all security patches in place, some of these requests would actually work. As it is, they're only trying to get a listing of files on drive C:, which, by itself, is relatively harmless. However, if they succeeded in getting one, that means they can run other commands on this computer just the same, which could include things like formatting the hard drive, erasing files, downloading viruses or other malicious code, or whatever else they cared to do.
• Just because you're not running a webserver on your computer, doesn't mean you're safe. Every Windows computer since Windows 95 has some type of network service running on it, and the most insecure of these, NetBIOS port 139, CANNOT BE TURNED OFF!! This is a major source of information leakage, and can frequently give an attacker all the information they need to successfully break into your computer.

You can view this list by:
http request
IP address
Entire list