@AC - Take a read, & if you do not like how I write? DON'T READ IT: Simple... apk
First of all, see my subject-line above.
Secondly: I would also like to know where you said I was "laughing" about this & where I said to block ALL PORTS... can you show us this much? Because if you cannot?? That's accusing me of something I did not state, period.
"so those network servers are vulnerable to this, and your mitigation advice is useless." - By Anonymous Coward Posted Monday 14th September 2009 16:40 GMT
That's for servers, not workstations - & face it: MOST folks use workstations, not servers. It's Microsoft's advice, I have merely suggested it as "layered security" for others, per the SECURITY GUIDE I put up above, which is GEARED TO STAND-ALONE SYSTEMS ONLINE (for lack of a better expression? The home user with a single machine in other words).
Now - I stated that much above, as far as servers (per my suggestion folks refer to the IANA ports list, because it can tell them which ports are needed & for what type of server, in my very first post) - care to deny this??
See - I interpret your attempts @ nitpicking as poor here, & I do suspect trolling on your part, so in my next post(s) I was more SPECIFIC later, per your points, like next below:
E.G.-> Yes - The use of PORT FILTERING MIGHT be a caveat for those running servers!
(Webservers port 80/8080/443, ftp servers ports 21-22 typically (can be others), mail servers on ports 25/110, etc. et al )
I say that, because as you said- in those cases, you'd be harming them possibly & that is, as you say, because they have to solicit connections on said ports & on THEIR server systems (or workstations acting as servers) as I said above. I figured MOST of you would infer that, via my mentioning the IANA ports list... I guess not though, eh?
Same again also, for those who use fileshares (for internal home networks, OR, those in corporate environs) which are driven on the LanMan/NetBIOS networking in Windows (via Client for Microsoft Networks + Windows File & Printer sharing & Server service etc., which use ports 139 & 445 iirc)
QUESTION - Do you know what the IANA ports list is for???
HOWEVER- Otherwise, if you are a "stand-alone" single machine user (connected to the internet especially)? This can, & does, actually work.
APK
P.S.=> That's again, pretty much what I said above, with yet even MORE specifics. As to this statement from you:
"Incidentally, microsoft didn't misunderstand the vulnerability, they suggested that as a mitigation because they basically don't have one, and when that happens they suggest stupid things so that people who don't pay attention think there's a workaround. There isn't." - By Anonymous Coward Posted Monday 14th September 2009 16:40 GMT
YOU DON'T PAY ATTENTION, & YOU SKIM - again, do you know what the IANA PORTS LIST IS FOR????
For servers? Possibly not, depending on what the server is up to, it may not work..., unless you look to IPSecurity Policies!
(That's where you can specifically LIMIT what comes in & out of your system, with finer 'granularity' than you can using PORT FILTERING offers, but it is harder to work with, but my guide above in my 1st post covers that too)...
I.E..-> You can limit what systems (IP Addresses) can "talk" to your machine if you wish, via IP Security Policies...
(AND, if this "malware" does any "talk back" to the "mothership" (a command & control server)? You can stall that via IPSecurity Policies too)
OR
Even add those "command & control servers" a malware may use, to a HOSTS file to block them (using 0, 0.0.0.0, or 127.0.0.1 in front of their hostnames, assuming they use those, & they usually do - because using a hardcoded IP is foolish for a botmaster really, because they get 'taken down" fast usually by the ISP or hosting provider for them... they instead tend to rely on domain names/hostnames because they can be quickly re-registered @ another ISP or hosting provider & use the SAME hostname/domainname) OR, even to your routing tables to block them out.. apk
