Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Spam Operating Systems Software Windows

Preventing the NT Messenger From Use as a Spam Portal? 66

Posted by Cliff from the increasing-the-signal-to-noise-ratio dept.
zbowling (Zac Bowling) asks: "I currently use Comcast cable internet, and I consistently get hit with spam popups. These are not the ones you get from a webpages or media, these are dialog box popups from people scanning all possible IPs for the open messenger port on most NT or Win2k machines. The NT Messenger service (also the same as Novells Network Alert system) is reserved for admins, so they can send messages to the domain or a single workstation for any reason. This service has been taken advantage of by spammers looking for a cheap way to spam someone. One message I got was a spam to get me to buy a firewall product from them to prevent this from happening. I'm sure you can shut of that service or block that port except from people in your subnet. Does anyone know of any resources on the topic?"
This discussion has been archived. No new comments can be posted.

Preventing the NT Messenger From Use as a Spam Portal? More

Preventing the NT Messenger From Use as a Spam Portal?

Comments Filter:
  • As far as I know, there is nothing out there, but if your on broadband,just turn off the messenger service, you don't need it. Every Admin job I've ever had the messenger service was used by employees to play pratical jokes on staff that did not know about it. Infact, at one job, Clopatra and Ceaser were talking using the messenger service to a WinNT Exchange server called Hermes.

    • As far as I know, there is nothing out there,

      Yes, there is. There's (un)common sense. Disable the Messenger service. If you need it, chances are you're on a computer that shouldn't have broadband directly connected to it anyways (ie; a computer on a domain). If this is the case, install a personal firewall and hope your network admin never finds out.

      Which brings me to my second point; hardware and, to my chagrin, even software firewalls. They block such ports, unless you allow them through. Drop $70CD

      • you know what the first thing i did when i got my windows XP box? shut down all the services i didnt need and only turned on ones i needed when i needed them. I think this came from securing all those linux boxes running hundreds of stupid services. (WHY THE FUCK IS CUPS RUNNING BEFORE I'VE ADDED A PRINTER) Anyway getting to the point I've never had one of these messenger spams. Turn off the fuckin service

    • Actually it is called Linksys (Score:4, Informative)

      by Glonoinha ( 587375 ) on Sunday April 27, 2003 @01:56PM (#5819975) Journal
      Original poster : go to BestBuy or whereever and buy a Linksys 4 port router/firewall : Linksys Model# BEFSR41. They are dirt cheap now that the wireless stuff is out, cost maybe $50. Gives you two things :

      1. Your ip address is now a black hole. Nothing comes in. Cable modem is a shared medium meaning it is entirely possible that your neighbors could be snooping your hard drive. Not likely, but possible (I have done it in the past ... it is fun:) The router stops all inbound traffic at the door, or pretty much most of it. Those pesky Messenger spam go away. Also protects you from the damn Nimda (?) type worms that attack exposed web servers.

      2. You can plug more than one computer into the 4 10/100 ports the unit has, now you have more than one computer surfing at cable speed. Also have your internal network between computers. If you had friends and they came over they could plug their machines in and have instant access to the web also. Acts as a DHCP server so you don't need to configure one.

      If you have a cablemodem, you really, really need a hardware firewall/router, and the Linky is a very easy to use unit. Just be sure to change the password, everybody on the planet knows how to hack their way in if it is left to the default.
      • Your ip address is now a black hole. Nothing comes in. Cable modem is a shared medium meaning it is entirely possible that your neighbors could be snooping your hard drive. Not likely, but possible (I have done it in the past ... it is fun:)

        Wow, a real cyberterr'ist. Why do you hate America so much?

        I've got DSL and I'm hiding behind one of those little 4 port Linksys routers. They're essential even if you only have one computer- you'd have to be crazy to connect a machine directly to a broadband modem us
        • i usually have a windows box around that i can throw on the outside of my firewall when there are difficulties connecting. that way i can 1) see if the problem is the firewall (it never is), and 2) truthfully tell the "tech support" person that i've rebooted, yes, i'm running windows, no the connection still isn't up. then they tell me they'll start a ticket, and i get my connection back eventually.

  • Write your congressman. (Score:5, Interesting)

    by Lord Bitman ( 95493 ) on Sunday April 27, 2003 @04:01AM (#5818180)
    It is an insult that typing in a URL can be considered "hacking", while sending bogus data to an unknowingly open machine in order to get it to do things which it was never intended to do is not.

    • Re:Write your congressman. (Score:5, Insightful)

      by PerryMason ( 535019 ) on Sunday April 27, 2003 @05:42AM (#5818360)
      The knee-jerk reaction is to consider this Messenger service spamming as a hack, but you have to stop and consider the wider implications of calling it 'hacking'.

      If we are to make this sort of thing illegal, its a very small step to consider any connection to an open port that isn't what the recipient (ie server operator) expected to receive as hacking. This is likely to lead to even less of a focus on delivering a secure software product, rather relying on the threat of legal action to secure systems, much like the DMCA. Its using the sledgehammer of the law to crack a small nut that technology is already more than capable to dealing with.

      If you really feel the need to write to somebody, write to Microsoft and tell them that the default state of a system following an install is insecure and that you will stop purchasing their products if they can't provide something secure enough to put on the internet.

      • New Windows (Score:2, Informative)

        by mrscott ( 548097 )
        At the risk of being flamed for a pro-Microsoft comment, take a look at Windows Server 2003. Out of the box, it is pretty tightly locked down. No services are installed by default -- an admin has to proactively enable things like IIS, DNS, etc. Permissions are no longer defaulted to "Everyone Full Control" as they were in the past. While I'm sure that there will still be holes found, at least the ones provided by a default installation have been addressed.
        • Yes, and when all the stupid security flaws in Windows 2003 come to light, Microsoft will be ready with Windows 2005, ad infinitum.

          If Microsoft cared about anything other than selling you the next version, they would make it much easier for admins and end-users (especially end-users) to properly lock down their machines. The problem is that most of Microsoft's so-called useful functionality and "innovation" is what causes these security problems in the first place. Oh that and the Computer Science 101-le
      • I already don't buy MS products. Sure, things should be secure to begin with, but are we really going to say "If it has a blatant security flaw, it doesnt count as hacking."?

  • Spammed by anti-spam product adverts. Defeat? (Score:5, Funny)

    by tgrotvedt ( 542393 ) on Sunday April 27, 2003 @04:02AM (#5818186) Journal
    Maybe you could, uh, buy that firewall product the spammer advertised....

    that's kind of... weird though.
  • Interesting, Comcast is the top baby Bell where I come from. What state are you in? I've never heard of such problems with their service before. I wouldn't consider is Comcast's problem if I were you.

    Instead, look for a local spammer; as this would be the most likely culprit of such a crime.

  • turn the service off (Score:3, Informative)

    by FrenZon ( 65408 ) * on Sunday April 27, 2003 @04:34AM (#5818251) Homepage
    If you don't need it, go to your services menu, and set the messenger service to 'off'.
    • exactly, it's such a basic question/answer that i must wonder how the f it managed to get into ask slashdot. actually, i think that this is dupe of some sort too.. if you really can't be bothered to the menu where you can turn off services(he even knows that he should just turn off the service), how are you bothered enough to post an ask slashdot question..

      not only that but theres gazillion websites that cover such annoyances, including annoyances.org.
    • Or in more detail (this guy obvisously needs it like this):
      In the lower left hand of your screen, you should see a button labled "Start" click it with your left mouse button, unless you are left handed, try the right mouse button. Now, point to settings, then click "Control Panel". Then double click the administrator tools icon. goto "services". Now, there will be a service listed as "Messenger Service" Right click this (if you are left handed, left click), and click properties. Then choose the automa

  • Resource (Score:5, Informative)

    by skinfitz ( 564041 ) on Sunday April 27, 2003 @04:37AM (#5818259) Journal
    Does anyone know of any resources on the topic?

    Yes, it's called Google. [google.com]
    • What a useless reply!
      Everyone knows Google.

      The other day I asked a mailing list I'm on to summarize Extreme Programming in a sentence or two.

      All the replies I got were pretty much the same "Try searching Google"

      Reallly? I can find stuff on Google?

      Jeezus!

      The whole reason for asking is that you CAN'T FIND INFO ON IT!

      Please, if someone asks a question that you could give a useful answer to, DO SO.

      If you can't give a useful answer, just don't answer!
      • Normally, I'd agree with you. There have been times here on Slashdot that I've asked questions that have seemingly simple answers because I knew it'd be easier to get a 1 or 2 sentence summary on it from a fellow geek rather than read a hundred pages of theory and try to decipher it for myself. However, your parent poster in this case has a valid point. I had problems with messenger spam myself, and the first thing I did was hit up Google in search of an answer. In literally less than 5 minutes, I had my co

  • Check out (Score:3, Informative)

    by arcadum ( 528303 ) on Sunday April 27, 2003 @04:39AM (#5818264)
    This teaches you alot [mynetwatchman.com]

  • Shut off the service (Score:5, Informative)

    by Baloo Ursidae ( 29355 ) <dead@address.com> on Sunday April 27, 2003 @05:13AM (#5818325) Journal
    Go into Control Panel, then Services.
    Scroll down to Messenger and right click, hit Properties.
    Set Startup Type to Disabled.
    If the Service status says Started, click Stop.
    Click OK and close out of Services and Control Panel.

    • Shorter Procedure (Score:3, Funny)

      by Anonymous Coward
      Go to the Start menu
      Select Shut Down
      Put Computer in Box
      Take it back to the store and tell them you want your money back, because you're too stupid to use a computer

    • Re:Shut off the service (Score:3, Informative)

      by genka ( 148122 ) *
      He didn't ask how to stop the service. He wants to know if he can make it accessible only from a local subnet. I think he even knows that there are things like routers and they can use ACLs, but he wants to do limit Messenger access by tweaking configuration of his computers. I doubt it is possible.

  • Stopping NT Messenger Spam (Score:5, Funny)

    by Wrexen ( 151642 ) on Sunday April 27, 2003 @05:41AM (#5818358) Homepage
    Step 1) Go to google [google.com]
    Step 2) Type in "NT messenger spam"
    Step 3) Hit the "I'm feeling lucky" button
    Step 4) Stop NT Messenger Spam [stopmessengerspam.com]
    Step 5) Submit question to "Ask Slashdot" anyway
    Step 6) ????
    Step 7) Profit!

  • Simple (Score:4, Funny)

    by Anonymous Coward on Sunday April 27, 2003 @06:24AM (#5818416)
    Create a whitelist of IPs and generate a set of rules for INPUT tabl... oh... sorry, never mind...

  • How the ..... (Score:3, Informative)

    by Korgan ( 101803 ) on Sunday April 27, 2003 @07:03AM (#5818489) Homepage
    I can't believe this post got this far. A solution can even be found on Yahoo!

    Dude, core rule of running ANY OS is to disable anything you don't use. If you don't know which services/daemons you do or don't need, then install a software based firewall on the OS until you can get help to start securing the OS properly.

    For windows, software like Zone Alarm (http://www.zonelabs.com) is a good start. McAfee, Symantec and a whole heap of other companies offer similar products also.

    For *BSD (Including OSX) IPF is available on nearly all variants. For GNU/Linux, NetFilter/IPTables in the modern kernels and IPCHAINS and IPFWADM in the older kernels.

    For commercial versions of Unix, There are a quite a few options, but most home users aren't going to be running Solaris or HP-UX or AIX or other such OSs.
    • Dude, core rule of running ANY OS is to disable anything you don't use.

      First off - Amen!

      The problem is the bloody default install. If I was asked, you want this... I would have said no now that I know what it was. Looking at the description, "Sends and receives messages transmitted by administrators or the Alerter Service", it is not obvious you can nuke this service. The other problem is few would suspect random spammers could use it to broadcast messages when the description implies administrators.
    • If you're going to run a software firewall, I reccommend the Sygate Personal Firewall Pro. Its one of the better Windows based software firewalls out there.

      No sig.

  • router? (Score:2, Informative)

    by lburdet ( 552112 )
    if you still need to keep the service "Active", i'm assuming you have more than one machine behind the cable connection?
    If you have more than one machine, surely you have some form of routing?
    And if you have a router, then why don't you just block the port on the router, leave it open on the internal nodes, and lest i forget, not submit a googleable question to /. ?

  • "block incoming NetBIOS" (Score:3, Informative)

    by Futurepower(R) ( 558542 ) on Sunday April 27, 2003 @09:34AM (#5818782) Homepage

    Installing ZoneAlarm [zonelabs.com] is not enough. You must go to Security/Local/Customize in ZoneAlarm and select "block incoming NetBIOS".
  • A couple weeks ago my coworker closed down the port for netbios on our firewall. Over the next couple weeks these messenger spams continued to get through. Thinking my coworker must be an idiot, I checked out the firewall myself, and tested it from outside our network. NETBIOS is indeed blocked. Frustrated as hell, I double triple and quadrouple checked to be sure as hell it is blocked. Indeed, it is.

    I do not wish to manually turn off the messenger service on every single win box on our network, so d

    • The Messenger service sends and recieves messages not using the NetBIOS protocol, but RPC. Therefore, you need to block port 135 to stop the messenger.

      As many others have said, you could also just turn the service off. I haven't seen anyone mention Black Viper [blackviper.com] as a resource for explaining what could be shut off and how to do it.

      • I am testing it right now, port 135 is blocked. Nothing goes in or out of our network on port 135. This is freakin weird, I got no idea wtf is going on here. Guess I'm gonna have to do some sniffin to figure this out.

        • Couple of things to check:

          1. Are you talking about 135 TCP or 135 UDP? I don't happen to
          know which one it should be.

          2. Could the stuff be coming from inside the firewall?

  • Slashdot is for posting, not roasting. (Score:5, Insightful)

    by Futurepower(R) ( 558542 ) on Sunday April 27, 2003 @10:22AM (#5818972) Homepage

    Slashdot Readers: If you don't like an Ask Slashdot question, ignore it!

    Don't waste everyone's time posting a comment saying that you knew the answer when you were 8 or 18 years old, and Slashdot is lame for posting such a simple question.

    Slashdot is meant to be a community. Not everyone in a community has the same knowledge. Questions that are simple for you may be difficult for someone else.

    Yes, many questions can be answered by Google, IF you already know the answer and therefore know the correct key words.

    • Don't waste everyone's time posting a comment saying that you knew the answer when you were 8 or 18 years old, and Slashdot is lame for posting such a simple question.

      Yes, but how far will it go? There has to be a line drawn in the sand somewhere so that these people will do atleast some legwork before resorting to Ask Slashdot. We're not here to pander to the incapable; this is a news site, not an infant hand-holding rag.

      If we lower the bar sufficiently with such basic questions, we'll find ourselves

      • Who cares if he knows or doesn't know something? All you have to do is lok at the article and IGNORE IT. We aren't being plagued with anything at all.

        • Who cares if he knows or doesn't know something? All you have to do is lok at the article and IGNORE IT. We aren't being plagued with anything at all.

          Ok, I'll ignore it. Then I'll get tired of scrolling past it and I'll disable the "Ask Slashdot" section. Then a dozen others will do the same. A few hundred more, a few hundred more, and before you know it the only people left reading Ask Slashdot are the people too simple to memorize more than one URI on the web who need their mothers' help when they fin

    • Slashdot is meant to be a community. Not everyone in a community has the same knowledge. Questions that are simple for you may be difficult for someone else.

      But questions that have already been asked [slashdot.org] in Ask Slashdot deserve to be ridiculed to the fullest extent possible in an online community. Part of being a community is not just looking for quick, simple answers that you are too lazy to find for yourself.

      Of course, part of the "Slashdot community" is submitting and griping about double posts, so I gue

  • Just disable the service (Score:3, Informative)

    by Noah Adler ( 627206 ) on Sunday April 27, 2003 @11:00AM (#5819123) Homepage

    How about just typing net stop messenger at a command prompt?

    Problem solved, eh? Should this really have been an Ask Slashdot?

    • Re:Just disable the service (Score:4, Funny)

      by Stalemate ( 105992 ) on Sunday April 27, 2003 @04:53PM (#5820719)
      I know what you mean. Even if he didn't know that exact command, he could have written a program to just pipe random character strings through cmd.exe and hope he turned off the service before he formatted his c: drive.

      You just can't help someone if they aren't willing to help themselves.

  • Windows NET SEND saga (Score:3, Informative)

    by rakerman ( 409507 ) on Monday April 28, 2003 @11:29AM (#5825022) Homepage Journal

    NET SEND on Windows [akerman.ca]

    This was also asked before [slashdot.org] and before that [slashdot.org] and before before that [slashdot.org]. And if you search Slashdot on "messenger" [slashdot.org], many other times besides those three.

Slashdot Top Deals

Living on Earth may be expensive, but it includes an annual free trip around the Sun.

Close