Windows XP Remote Desktop - Intrusion!

[HDRick]

Yikes. Another text file on my password-protected administrator desktop. No backdoors installed

mabe I'm not getting whats going on here are you talking about a text message coming up on your desktop.If so just go into services and disable Messenger and it will stop.

 

[cleverhandle]

Hmm... yeah, now that I think of it, that would be a bad idea anyway, assuming that the machine will be running the usual gamut of Windows file sharing services. You don't really want to be a public SMB server, passwords or not. Just have to get a firewall/router and learn to use them...

And, no HDRick, you're not getting what's going on. They're not talking about Messenger. Remote Desktop is very different.

 

[SocrPlyr]

or you could just truely disable the guest account...
it is really really simple, all you have to do is go into the administrative tools and do it from there... not the flamingly inadequate Users in the control panel...
(found this out at school when i wanted to password protect my windows shares...)

Josh

 

[Ichinisan]

I'll say this:
Something IS wrong. The Guest accound is not accessible remotely on my other WinXP Pro computers. This is the way RDC is supposed to behave. For some strange reason, the Guest account IS accessible remotely from this computer.

1. I want to leave the normal Guest account enabled
2. I want to fix the problem, so that it behaves as it does on my other computers

Another thing:
Firewall promoters believe some ridiculous heuristics. Every time your computer is pinged, a software firewall claims that it "prevented a possible attack." Viruses are always scanning for known vulnerablilities, but they won't likely be able to penetrate your system if you keep it up-to-date.

If you keep your system updated, you are really quite secure. All the major viruses in recent history have ravaged servers running IIS MANY YEARS AFTER the vulnerability had been fixed. Administrators (of all people!) NEED to keep their software up to date. Normal users should have a firewall because they tend to install shady spyware from all those damn pop-up install prompts.

Users who know better have NOTHING to worry about:
I thought I had finally been hacked by someone using a new and unknown vulnerability, it turned out to be a friend logged in locally (and playing a joke). I have still NEVER BEEN SUCCESSFULLY HACKED to date.

 

[prosaic]

Originally posted by: SocrPlyr
or you could just truely disable the guest account...
it is really really simple, all you have to do is go into the administrative tools and do it from there... not the flamingly inadequate Users in the control panel...
(found this out at school when i wanted to password protect my windows shares...)

Josh

I'm not sure just what you mean when you refer to truly disablign the Guest account from within Administrative Tools. If you are talking about the security policy for preventing remote login, I agree that this is the way to go if you wish to disable Simple File Sharing in WinXP Pro and use the system on a domain, though I'm a little leary of the warnings Microsoft has issued about going farther than that to kill off the account. Microsoft states specifically that disabling the account, in that sense, is not a good idea.

The regular applet in the Control Panel is designed to be used in conjunction with the networking wizard when establishing home LANs. If it is used that way, then the user will be given pretty stern warnings if he is leaving an unprotected interface open to the Web. Eh, it isn't perfect, but it's pretty darned hard to build an OS this capable and not trip up regular end users. I guess Microsoft expected folks to just go by the numbers, regardless of whether or not that was a reasonable expectation. In this case, maybe the people who were most likely to get into trouble were the more knowledgeable ones who were proceeding on the basis of things they had learned while using previous versions of Windows?

- prosaic

 

[prosaic]

If you keep your system updated, you are really quite secure. All the major viruses in recent history have ravaged servers running IIS MANY YEARS AFTER the vulnerability had been fixed. Administrators (of all people!) NEED to keep their software up to date. Normal users should have a firewall because they tend to install shady spyware from all those damn pop-up install prompts.

Users who know better have NOTHING to worry about:
I thought I had finally been hacked by someone using a new and unknown vulnerability, it turned out to be a friend logged in locally (and playing a joke). I have still NEVER BEEN SUCCESSFULLY HACKED to date.

While that first assertion is mostly true, it's not 100% on the mark since it ignores exploits other than major viruses. It's small comfort to you that you were hit by an unusual exploit if you're sitting in the ruins of a network you thought was secure. And "normal" users, IME, have as much trouble with popups from software firewalls as they do with pop-up install prompts. If they wind up saying okay to everything that ZoneAlarm or Kerio asks them, then...

And, as far as the statement that you have never been successfully hacked -- if you're hacked successfully, you may not know it. Depends on the intent and capability of the intruder.

Firewalls are not just for newbies and wimps.

- prosaic

 

[SocrPlyr]

Originally posted by: prosaic

Originally posted by: SocrPlyr
or you could just truely disable the guest account...
it is really really simple, all you have to do is go into the administrative tools and do it from there... not the flamingly inadequate Users in the control panel...
(found this out at school when i wanted to password protect my windows shares...)

Josh

I'm not sure just what you mean when you refer to truly disablign the Guest account from within Administrative Tools. If you are talking about the security policy for preventing remote login, I agree that this is the way to go if you wish to disable Simple File Sharing in WinXP Pro and use the system on a domain, though I'm a little leary of the warnings Microsoft has issued about going farther than that to kill off the account. Microsoft states specifically that disabling the account, in that sense, is not a good idea.

The regular applet in the Control Panel is designed to be used in conjunction with the networking wizard when establishing home LANs. If it is used that way, then the user will be given pretty stern warnings if he is leaving an unprotected interface open to the Web. Eh, it isn't perfect, but it's pretty darned hard to build an OS this capable and not trip up regular end users. I guess Microsoft expected folks to just go by the numbers, regardless of whether or not that was a reasonable expectation. In this case, maybe the people who were most likely to get into trouble were the more knowledgeable ones who were proceeding on the basis of things they had learned while using previous versions of Windows?

- prosaic

if you go into computer management after "disabling" the guest account from the Users area in the control panel, you will find that all that did was remove guest from being able to log onto the computer locally (removed its name from the list), however to keep the user from being able to get at windows shares including printers, you have to go into computer management and you will see that the account wasn't disabled, just delisted from the logon screen (assuming you are using the Welcome Screen, which i don't suggest)

Josh

 

[prosaic]

Uh, that's a point I made very carefully earlier in the thread.

- prosaic

 

[birthofsorrow]

scary

 

[xSauronx]

im scary... *boo*

this is interesting to me, having recently gotten cable internet and being a windows user

of course, i do have a router, but im gonna go poke around in the administrative tools and see what i can mess up

 

[Ichinisan]

It's really ther Local Users and Groups Microsoft Management Console snap-in. Administrative Tools is just a pre-configured set of snap-ins.

Start>Run>MMC
File>Add/Remove Snap-Ins
Add>Local Users and Groups (Look through this list to see what else is left out )
Add>Finish>Close>OK

 

[mboy]

CZroe suggesting NO FIREWALL= EXTREMELY BAD ADVICE!!!

I do not advocate a ZA or any of the software based ones, but a real dedicated firewall box.

If u expose PC's to the net for anything like remote desktop, ftp etc and u arent firewalled and at least creating ACL's, you are asking for trouble.

 

[mboy]

Originally posted by: CZroe
I knew he'd get one of these. Firewalls are not for everyone! Firewalls protect PCs by interfering with alot more than just hackers. Pretty much any Internet application can run into trouble. Connection issues with P2P networks, Remote Desktop (Which is what he 's using), games, you name it. It's alot more trouble than it's worth for a PC that's going to be used for SOMETHING ELSE than troubleshooting network issues and connection problems. Just think about how many times you've just had to give up on something just because you didn't want to screw around with the router or find & open up ports and port ranges.

DMZ is supposed to fix that, but in a multiple PC gaming household like ours, it adds even more problems. What about when all of us want to play ZSNES over ZBATTLE.net but the command line front-end matchmaking application is not smart enough to use anything but the IP address connected to the ZBATTLE server? Because all PCs are connected from behind the same router, the front-end application passes the same IP address to the command line and ZSNES unsuccessfully tries to connect to itself. To make matters worse, some ISPs FORCE their customers behind NAT and firewalls. As a result, I can't play my friend from the other side of town without manually changing (forcing) the horrible-performing UDP option, something THOUSANDS of ZSNES players never figured out and even then doesn't help in some cases.

If the PC is intended to be visible and accessible to the Internet as a server, then what good does it do to "hide" behind a firewall? If the necessary ports are open, it will be "found" anyway, especially if it's running something like a webserver. Blocking/closing the unused ports may prevent certain exploits (Like my brother's case above) but if the PC is fully updated and doesn't contain anything you don't mind loosing (He restores an image every week) it's not worth the trouble as it will certainly cause more headaches. Besides, how else might we have discovered the exploit to know it needs fixin' Any intrusion changes, backdoors, DoS zombie applications etc will be wiped over with the HDD image.

He's not worried about what a hacker may do to him, but worried that it apparantly hasn't been detected/fixed by Microsoft.


Oops, you asked what the setup was like

Cable ISP with unlimited (?!) IP address assignments (Assigns randomly to differnt subnets. Bleh)
Linksys Wireless-G Router w/ DHCP disabled (Just using it as an access point / hub)
Cable modem and PCs all connected to auto-crossover local port (Instead of Cable-to-WAN port. This lets my ISP assign IPs)
Wireless-G card for the laptop, 3com & Intel NICs for the desktops + 802.11b PCI cards (we move them around alot)
No software firewalls except on the fileserver, all other unprotected gaming PCs
All password protected renamed Administrator accounts with no network shares.
Restricted Guest account recently enabled with no password on hacked PC to keep guests from requesting the password

Dude, you are absolutely out of your mind! A REAL firewall will let u creat an ACl to allow a specific IP intio your network so you can access the "server". I connecto to my home PC from work using remote desktop in XP pro, but I go thru my VPN tunnel. I deny all access to my network (especially 3389) unless it comes from one of my private ip's at work OR if I go to my parents house, or away, I will bind a public IP from where I am to an ACL and only let traffice from that IP thru.
Just becasue u dont understand how a firewall works or cant configure one properly, doesnt give u the right to bash the technology or turn others away from using one. Just beause u want to act like a fool, doesnt mean others should as well!

 

[skyking]

tell us what you really think.................




Just KIDDING!

I am with you on this one, to think that Microsoft would be able to protect such a feature filled and verastile out-of-the-box OS from all the bad things available on the net is simply naive.
some of the BSD's can be armored to that point, but I call those boxes Firewalls................

 

[CZroe]

I would want to use the RDC feature from anywhere I happen to be. Why would I want to restrict clients to a single IP address? The username/password is supposed to be the method of restricting outsiders.

I found out that "Guest" was somehow added to a user group for Remote Desktop users. This defies the "rule" given to me when I enabled RDC. I don't know how it got added to the group. Removing it has secured my system.

 

[Ichinisan]

Once again: Even though many security holes make it into every OS, Microsoft is quick to release a patch AS SOON AS AN EXPLOIT IS DISCOVERED. If an exploit became so widely-known that it was likely to be attempted against a regular Joe like me, then it would surely be long-since fixed. I recomend a FW for everyone else, but not for me.