Symantec Norton Personal Firewall 2003, User Manual

Page: 127 / 151

Understanding Internet risks
Risks from hackers
127
Initial access
The easiest way for a hacker to access a Windows computer is to use
Microsoft networking. On many computers, Microsoft networking is
enabled so that anyone on the network can connect to it.
Microsoft NetBIOS networking uses three of the well-known ports. These
ports are used to establish
connections among computers on a Microsoft
network. In fact, they normally advertise the name of your computer over
the local network. This is what you want on your own network, but it is not
what you want on the Internet. Norton Personal Firewall is preset to block
these ports and prevent someone on the Internet from connecting to your
computer using Microsoft networking. If your computer is connected to a
local network as well as to the Internet, you must change some settings to
allow communication with the other computers on your network. Norton
Personal Firewall still protects you from Internet risks while allowing you
to use your local network.
Privilege escalation
Once a hacker has connected to your computer, the next step is to gain as
much control as possible. The steps involved and the results obtained vary
depending on the version of Windows that is running on the target
computer.
On computers running Windows 95/98/Me, once hackers have gained
access to the computers, there is no need for escalation. They have full
control of the computers. Luckily, these versions of Windows don’t have
many remote control features, so they are relatively easy to protect.
On computers running Windows 2000/XP, hackers attempt to gain
administrative rights to the computers. The key to getting administrative
rights is usually a
password . The hacker can download your password file
and decode it.
Another tactic is to place a Trojan horse on your computer. If a hacker can
place a program such as Back Orifice, Subseven, or NetBus on your
computer and run it, it is possible to take control of the computer.
Other Trojan horses might record all of your keystrokes to capture
passwords and other sensitive data. Norton Personal Firewall and Norton
AntiVirus provide two levels of protection against Trojan horses. Norton
AntiVirus protects you from inadvertently running these programs. Norton
Personal Firewall blocks the ports that remote access Trojan horses use to
communicate over the Internet.