Windows Host Security: Network Security Hacks

Or you can list only files that are opened by a particular process -- in this case Internet Explorer:

C:\> handle –p iexplore
Handle v2.10
Copyright (C) 1997-2003 Mark Russinovich
Sysinternals - www.sysinternals.com
-----------------------------------------------------------
IEXPLORE.EXE pid: 688 PLUNDER\andrew
98: Section \BaseNamedObjects\MTXCOMM_MEMORY_MAPPED_FILE
9c: Section \BaseNamedObjects\MtxWndList
12c: Section \BaseNamedObjects\__R_0000000000d4_SMem_ _
18c: File C:\Documents and Settings\andrew\Local Settings\
Temporary Internet Files\Content.IE5\index.dat
198: Section \BaseNamedObjects\C:_Documents and Settings_andrew_
Local Settings_Temporary Internet Files_Content.IE5_index.dat_3194880
1a0: File C:\Documents and Settings\andrew\Cookies\index.dat
1a8: File C:\Documents and Settings\andrew\Local Settings\
History\History.IE5\index.dat
1ac: Section \BaseNamedObjects\C:_Documents and Settings_andrew_
Local Settings_History_History.IE5_index.dat_245760
1b8: Section \BaseNamedObjects\C:_Documents and Settings_andrew_
Cookies_index.dat_81920
228: Section \BaseNamedObjects\UrlZonesSM_andrew
2a4: Section \BaseNamedObjects\SENS Information Cache
540: File C:\Documents and Settings\andrew\Application Data\
Microsoft\SystemCertificates\My
574: File C:\Documents and Settings\All Users\Desktop
5b4: Section \BaseNamedObjects\mmGlobalPnpInfo
5cc: File C:\WINNT\system32\mshtml.tlb
614: Section \BaseNamedObjects\WDMAUD_Callbacks
640: File C:\WINNT\system32\Macromed\Flash\Flash.ocx
648: File C:\WINNT\system32\STDOLE2.TLB
6a4: File \Dfs
6b4: File C:\Documents and Settings\andrew\Desktop
6c8: File C:\Documents and Settings\andrew\Local Settings\
Temporary Internet Files\Content.IE5\Q5USFST0\softwareDownloadIndex[1].htm
70c: Section \BaseNamedObjects\MSIMGSIZECacheMap
758: File C:\WINNT\system32\iepeers.dll
75c: File C:\Documents and Settings\andrew\Desktop
770: Section \BaseNamedObjects\RotHintTable

If you want to find the Internet Explorer process that owns a resource with a partial name of handle, you could type:

C:\> handle –p iexplore handle
Handle v2.10
Copyright (C) 1997-2003 Mark Russinovich
Sysinternals - www.sysinternals.com
IEXPLORE.EXE pid: 1396 C:\Documents and Settings\andrew\Local
Settings\Temporary Internet Files\Content.IE5\H1EZGFSH\handle[1].htm

Additionally, if you wanted to list all types of resources, you could use the -a option. Handle is quite a powerful tool, and any of its command-line options can be mixed together to quickly narrow your search and find just what you want.

If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today! Visit the O'Reilly Network http://www.oreillynet.com for more online content.

Hack 23: List Running Services and Open Ports

Hack 23: List Running Services and Open Ports

Check for remotely accessible services the Windows way.

Unix makes it quick and easy to see which ports on a system are open, but how can you do that on Windows? Well, with FPort from Foundstone(http://www.foundstone.com/resources/index_resources.htm) it’s as quick and easy as running good old netstat.

FPort has very few command-line options, and those deal mostly with specifying how you’d like the output sorted. For instance, if you want the output sorted by application name, you can use /a; if you want it sorted by process ID, you can use /i. While it may not be as full of features as netstat, it definitely gets the job done.

To get a listing of all ports that are open on your system, simply type fport. If you want the list to be sorted by port number, use the /pswitch:

C:\> fport /p
FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
http://www.foundstone.com
Pid Process Port Proto Path
432 svchost -> 135 TCP C:\WINNT\system32\svchost.exe
8 System -> 139 TCP
8 System -> 445 TCP
672 MSTask -> 1025 TCP C:\WINNT\system32\MSTask.exe
8 System -> 1028 TCP
8 System -> 1031 TCP
1116 navapw32 -> 1035 TCP C:\PROGRA~1\NORTON~1\navapw32.exe
788 svchost -> 1551 TCP C:\WINNT\system32\svchost.exe
788 svchost -> 1553 TCP C:\WINNT\system32\svchost.exe
788 svchost -> 1558 TCP C:\WINNT\system32\svchost.exe
1328 svchost -> 1565 TCP C:\WINNT\System32\svchost.exe
8 System -> 1860 TCP
1580 putty -> 3134 TCP C:\WINNT\putty.exe
772 WinVNC -> 5800 TCP C:\Program Files\TightVNC\WinVNC.exe
772 WinVNC -> 5900 TCP C:\Program Files\TightVNC\WinVNC.exe
432 svchost -> 135 UDP C:\WINNT\system32\svchost.exe
8 System -> 137 UDP
8 System -> 138 UDP
8 System -> 445 UDP
256 lsass -> 500 UDP C:\WINNT\system32\lsass.exe
244 services -> 1027 UDP C:\WINNT\system32\services.exe
688 IEXPLORE -> 2204 UDP C:\Program Files\Internet Explorer\
IEXPLORE.EXE
1396 IEXPLORE -> 3104 UDP C:\Program Files\Internet Explorer\
IEXPLORE.EXE
256 lsass -> 4500 UDP C:\WINNT\system32\lsass.exe

Notice that there are some processes listed—such as navapw32, putty, and IEXPLORE—that don’t appear to be services. These show up in the output because FPort lists all open ports, not just opened ports that are listening.

While FPort is not as powerful as some of the commands available under other operating systems, it is still a valuable, quick, and easy-to-use tool that is a great addition to Windows.

If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today! Visit the O'Reilly Network http://www.oreillynet.com for more online content.

Hack 24: Enable Auditing

Hack 24: Enable Auditing

Log suspicious activity to help spot intrusions. 

Windows 2000 includes some very powerful auditing features, but unfortu nately they are all disabled by default. Windows 2003 has corrected this by enabling some features by default, but it is still wise to check that you are tracking precisely what you want to audit. Using these capabilities, you can monitor failed logins, account management events, file access, privilege use, and more. You can also log security policy changes as well as system events.

To enable auditing in any one of these areas, locate and double-click the Administrative Tools icon in the Control Panel. Now find and double-click the Local Security Policy icon. Expand the Local Policies tree node, and you should see something similar to Figure 2-1. 

Now you can go through each of the audit policies and check whether to log successes or failures for each type. You can do this by double-clicking the policy you wish to modify, located in the right pane of the window. After double-clicking, you should see a dialog similar to Figure 2-2.

Leaving auditing off is akin to not logging anything at all, so you should enable auditing for all policies. Once you’ve enabled auditing for a particu lar policy, you should begin to see entries in the event logs for when a partic ular audit event occurs. For example, once you have enabled logon event auditing, you should begin to see entries for logon successes and failures in the system’s security event log.

If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today! Visit the O'Reilly Network http://www.oreillynet.com for more online content.

Hacks 25 and 26: Secure Your Event Logs, and Change Your Maximum Log Files Sizes

Hack 25: Secure Your Event Logs

Keep your system’s logs from being tampered with.

Windows has some very powerful logging features. Unfortunately, by default the event logs are not protected against unauthorized access or mod ification. You may not realize that even though you have to view the logs through the Event Viewer, the event logs are simply regular files just like any other. To secure them, all we have to do is locate them and apply the proper ACLs.

Unless their location has been changed through the registry, you should be able to find the logs in the %SystemRoot%system32configdirectory.

The three files that correspond to the Application Log, Security Log, and System Log are AppEvent.Evt, SecEvent.Evt, and SysEvent.Evt, respectively.

Now, apply ACLs to limit access to only Administrator accounts. You can do this by bringing up the Properties dialog for the files and clicking the Security tab. After you’ve done this, remove any users or groups other than Administrators and SYSTEM from the top pane.

Hack 26: Change Your Maximum Log File Sizes

Change your log properties so that they see the whole picture.

From a security point of view, logs are one of the most important assets con tained on a server. After all, without logs how will you know if or when someone has gained access to your machine? Therefore, it is imperative that your logs not miss a beat. If you’re trying to track down the source of an inci dent, having missing log entries is not much better than having no logs at all.

One common problem is that the maximum log size is set too low—the default is a measly 512KB. To change this, open the Administrative Tools control panel, and then open the Event Viewer. You should now see some thing similar to Figure 2-3.

After you have done this, select one of the log files from the left pane of the Event Viewer window and right-click it. Now select the Properties menu item. You should now see something similar to Figure 2-4.

Now locate the text input box with the label “Maximum log size”. You can type in the new maximum size directly, or you can use the arrows next to the text box to change the value. Anything above 1MB is good to use here. It all depends on how often you want to review and archive your logs. How ever, keep in mind that having very large log files won’t inherently slow down the machine, but can slow down the Event Viewer when you’re trying to view the logs. While you’re here, you may also want to change the behav ior for when the log file reaches its maximum size. By default, it will start overwriting log entries that are older than seven days with newer log entries. It is recommended that you change this value to something higher—say 31 days. Alternatively, you could elect not to have logs overwritten automati cally at all, in which case you’ll need to clear the log manually.

If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today! Visit the O'Reilly Network http://www.oreillynet.com for more online content.

Hacks 27 and 28: Disable Default Shares, and Encrypt Your Temp Folder

Hack 27: Disable Default Shares

Stop sharing all your files with the world.

By default, Windows enables sharing for each logical disk on your system (C$ for the C drive) in addition to another share called ADMIN$ for the %SystemRoot% directory (e.g., C:WINNT). Although this is accessible only to Administrators, it is wise to disable these shares (if at all possible) since they still present a potential security hole.

To disable these shares, open the Registry by running regedit.exe and then find the HKey_Local_MachineSYSTEMCurrentControlSetServices lanmanserverparameterskey.

If you’re using Windows 2000 workstation, add an AutoShareWks DWORD key with the value of 0 (as shown in Figure 2-5) by clicking Edit -> New -> DWORD Value. For Windows 2000 Server, add an AutoShareServer key with a value of 0. When you’re done editing the Registry, restart Windows for the change to take effect.

After Windows has finished loading, you can verify that the default shares no longer exist by running net share:

C:\>net share
Share name Resource Remark
-----------------------------------------------------------
IPC$ Remote IPC The command completed successfully.

Before doing this, you should be sure that disabling these shares will not negatively affect your environment. Lack of these shares can cause some sys tem management software—such as HFNetChk [Hack #21] or System Manage ment Server—to not work. This is because software like this depends on remote access to the default administrative shares in order to access the con tents of the systems disks.

Hack 28: Encrypt Your Temp Folder

Keep prying eyes out of your temporary files.

Many Windows applications will create intermediary files while they do their work. They typically store these files in a temporary folder within the current user’s settings directory. Most often these files are created world-readable and aren’t always cleaned up when the program exits. How would you like it if your word processor left a copy of the last document you were working on for anyone to come across and read? Not a pretty thought, is it?

One way to guard against this situation is to encrypt your temporary files folder. To do this, open an Explorer window and go to the C:Documents and Settings Local Settings folder. In this folder you should see another folder called Temp. This is the folder that holds the temporary files. Right-click the folder and bring up its Properties dialog. Make sure the Gen eral tab is selected, and click the button labeled Advanced. This will bring up an Advanced Attributes dialog, as seen in Figure 2-6. Here you can choose to encrypt the folder.

Check the “Encrypt contents to secure data” box and click the OK button. When you have done that, click the Apply button in the Properties dialog. Another dialog (as seen in Figure 2-7) will open asking you whether you would like the encryption to apply recursively.

To apply the encryption recursively, choose the “Apply changes to this folder, subfolders and files” option. This will automatically create a public-key pair if you have never encrypted any files before. Otherwise, Windows will use the public key that it generated for you previously. When decrypting, Windows ensures that the private keys are stored in nonpaged kernel memory, so that the decryption key will never be left in the paging file. Unfortunately, the encryption algorithm used, DESX, is barely an improvement on DES and is nowhere near as strong as 3DES. However, it serves the purpose of transpar ently encrypting temporary files very well. If you want to encrypt other files, it is suggested you use a third-party utility such as GnuPG (http://www.gnupg.org), which has Windows binaries available on its web site.

If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today! Visit the O'Reilly Network http://www.oreillynet.com for more online content.

Hacks 29 and 30: Clear the Paging File at Shutdown, and Restrict Applications Available to Users

Hack 29: Clear the Paging File at Shutdown

Prevent information leaks by automatically clearing the swap file before shutting down.

Virtual memory management (VMM) is truly a wonderful thing. It protects programs from one another and lets them think that they have more memory available than is physically in the system. To accomplish this, the VMM uses what is called a paging file.

As you run more and more programs over the course of time, you’ll begin to run out of physical memory. Since things can start to go awry when this happens, the memory manager will look for the least frequently used pieces of memory owned by programs that aren’t actively doing anything at the moment and write the chunks of memory out to the disk (i.e., the virtual memory). This is known as swapping.

However, there is one possibly bad side effect of this feature: if a program containing confidential information in its memory space is running, the memory containing such information may be written out to disk. This is fine when the operating system is running and there are safeguards to prevent the paging file from being read, but what about when the system is off or booted into a different operating system?

This is where this hack comes in handy. What we’re going to do is tell the operating system to overwrite the paging file with zeros when it shuts down. Keep in mind that this will not work if the cord is pulled from the system or the system is shut down improperly, since this overwrite will only be done during a proper shutdown.

To enable this feature of Windows, we must edit the system registry. To do this, open the Registry and find the HKEY_LOCAL_MACHINESYSTEM CurrentControlSetControlSession ManagerMemory Management key. You should now see something that looks like Figure 2-8.

Locate the ClearPageFileAtShutdown entry in the right pane of the window and change its value to 1. Now restart Windows for the change to take effect, and your swap file will be cleared at shutdown. The only side effect of enabling this is that Windows may take longer to shut down. However, this is very much dependent on your hardware (e.g., disk controller chipset, disk drive speed, processor speed, etc.), since that’s what will govern how long it will take to overwrite your paging file with zeros.

Hack 30: Restrict Applications Available to Users

Prevent your users from running potentially dangerous applications.

Keeping users from running certain applications isn’t so important when you’re an administrator using your own workstation. But when you’re deal ing with regular users in an enterprise network environment, you don’t want your users running any nefarious programs. Such programs include those that can break their operating system installation, introduce security holes to their system, or even attack other machines on your network.

There are a couple ways to restrict the applications available to your users. First you can modify the ACLs for a particular program so that users cannot execute it. For example, suppose you have a sniffer installed on a user’s machine for network diagnostic purposes. Access to this program is fine for an administrator, but probably is not appropriate for a normal user. You can prevent normal users from running the program by removing execution per missions for the Users group. To do this, locate the program’s executable file and right-click it. Now click the Properties menu item, and you should see a dialog box like the one shown in Figure 2-9.

Now click on the Security tab and select the Users group from the list at the top of the dialog. You should now see something similar to Figure 2-10.

Now click the Deny checkbox that applies to the Read & Execute permis sion. After clicking the Apply button, anyone that is a member of the Users group will not be able to run the program. Alternatively, you could also mod ify the ACL for the directory that the program resides in and disallow read access. This approach could be useful if you want to keep all of your admin istrative tools under a single folder and restrict access to all of them at once.

If you are running a terminal-server version of Windows, there is another alternative to using ACLs. If you have the Microsoft Windows 2000 resource kit installed, you can use the AppSec program to disallow program access with just a few clicks. To use AppSec, locate its directory and start the pro gram. After the program loads, you will be presented with a list of programs. If the program that you want to disallow from your terminal-service users is on the list, simply click the Disabled radio button. For instance, if you wanted to disable cmd.exe, you would see something similar to Figure 2-11.

If the application you want to restrict is not on the list, you can click the Add button and browse for the application. After you have made your choices, click Exit. Before these changes can fully take effect, all users will have to log off of the terminal server. 

If you've enjoyed what you've seen here, or to get more information, click on the "Buy the book!" graphic. Pick up a copy today! Visit the O'Reilly Network http://www.oreillynet.com for more online content.