Stopping NetBIOS Spam? 97
MoonFacedAssassin asks: "I woke up this morning to find that my computer had a Windows messaging pop-up window with an advertisement about getting diplomas and degrees. I was quite shocked to find that my Bellsouth DSL IP address had been spammed. Has this happened to anyone else? Other than closing off the port which this can come through, are there any other ways to block this spam? And, how responsible is Bellsouth (or any ISP for that matter) in handling issues like this?"
um. (Score:4, Insightful)
Seems to me that restricting the port would be the sane method of preventing outside persons from exploiting your system. The same as any other service on any other port.
You said it yourself... (Score:5, Insightful)
As for the second part, you cannot count on an ISP's usage terms to protect you from malicious acts. For good or for bad, they sell access services, not security services.
Re:Overlooking the obvious (Score:5, Insightful)
Re:um. (Score:4, Insightful)
Two dumb birds for the price of one.... (Score:3, Insightful)
How hard would it be to send a message back to the boxes that have some code red or similar virus. Basically you ask my web server for c:/scripts/something, you get a Windows message back informing you in no uncertain terms that your box is infected and the OS needs to be reinstalled.
This isn't an attack, but if enough people did it (just one message per infection attempt) people would soon be forced to do something because of the barrage of messages. And the people who let their boxes REMAIN infected with a virus that's been out in the wild for over a year are hardly the type of people to have locked down port 139.
Re:Crappy ISP! (Score:3, Insightful)
But seriously, this NetBIOS messenger problem is quite real, and is (almost) entirely the fault of the end-user. Putting a Windows machine on the Internet without some form of firewall (software or hardware) is an invitation to get violated in some way or another. All I have to say is, these people are already once lucky - their file and print shares are exposed to the world, so with a bit of password trickery (or exposing one of the many NETBIOS vulnerabilities that exist at various patch levels of each of the Windows OS variants) one can easily access the data and/or send malicious print jobs (hint: MS Paint, black background, 100 copies. Else, SPAM)
There are also cases of people who actually run/administer a firewall that's obviously mis-configured to the point of being futile, so don't expect the mere presence of such a thing to protect you. One individual on the Security Focus Incidents mailing list is reporting this very same 'problem' on his network running Microsoft ISA firewall.
If you're unable (for whatever reason) to install a software firewall, obtain and configure an Internet router. There are dozens (hundreds) on the market, and the vast majority of them (that we've dealt with/sold) come with port forwarding to the internal machines disabled per default. For single-computer owners, SMC makes a one-port Internet router that could simply be installed inline with the users' cable/DSL 'modem' for security and peace of mind. Moreover, it saves the user from having to install annoying PPPoE client software on their machines.
Like the poster before alluded (rather amusingly) to; if you leave your door ajar, don't be surprised when you come home to find people roosting in your house, or that some of your things are missing. Sure, the person may have broken the law, but putting out the welcome mat is just asking for trouble.
Re:Overlooking the obvious (Score:3, Insightful)
A good start would be a decent software firewall. Tiny Software used to offer theirs for free for personal use, but seem to have taken it down from their website =(. If you scour the net, you might be able to find it for download from one of those shareware sites.
A reinstall also would be prudent. When I'm doing a fresh install I try to keep the machine behind a device doing NAT until I have proper firewall software installed and my box patched.