- What Is a Hacker?
- Who Are the Hackers?
- What Damage Can Hackers Do?
- Targets of a Hack Attack
- Hacker Motivation: I Think Therefore I Hack
- Tools of the Trade: Pass Me a Trojan Horse, Would You?
- Firewall: Shut Out the Hackers
- Software Firewalls: Programs That Stop Hackers
- How to Detect a Hacker Attack
- How to Fix a Hacker Attack
- Batten down the Hatches—10-Minute Tactics
- Wall off the World—Install a Better Firewall in an Afternoon
- The Absolute Minimum
This chapter is from the book
This chapter is from the book
This chapter is from the book
Software Firewalls: Programs That Stop Hackers
A good software firewall for home users should have the following attributes:
- It’s easy to configure.
- It’s frugal with system resources so it doesn’t bog down the computer.
- It doesn’t bug you much.
But not all firewalls are created equal. Let’s look at a few.
Windows Firewall: Built-in Defense
The easiest software firewall you can use is the built-in Windows Firewall. It is a feature of windows XP Service Pack 2 (SP2), a great big security fix that was issued in the summer of 2004.
When you install SP2, it turns on the Windows Firewall. It’s not a very complex piece of software and it’s often criticized for its simplicity. I think it’s a decent security tool because
- It’s easy to turn on. In fact if you have installed SP2, it is on (provided that you haven’t manually turned it off since installing SP2).
- You never hear from it. It silently does its job without needing much user intervention.
- It doesn’t slow the system by any perceivable measure.
Now, the Windows Firewall (see Figure 3.2) is not without its critics. It only polices traffic one-way. Inbound traffic is inspected by the software, but data traffic coming from the computer and flowing out to the Internet is not examined. That can be a problem because if there is a virus, spyware, or other malware on your computer trying to communicate with the outside world, Windows Firewall does not catch it on the way out.
)
Figure 3.2 The Windows Firewall is included with Service Pack 2 and is easily accessible in the Security Center in the Windows XP Control Panel.
Third-Party Software Firewalls
For the best firewall protection possible, install a third-party software firewall. These programs defend a computer in both directions. They inspect data coming into a computer from the outside world and they look at data leaving the computer to ensure it’s valid traffic and not coming from spyware, a Trojan horse, or a worm.
These programs also use a question and answer process to learn your habits. They are particularly bothersome when they are first installed because every time a program attempts to move data across the firewall, an alert is generated by the firewall that requires the computer user to respond.
Here are some of the features that third-party firewalls offer over the built-in Windows Firewall:
- Two-way communication filtering—For outbound communication, it is particularly annoying when a third-party firewall is first installed. But after a few days of clicking Yes or No on a firewall’s dialog boxes (see Figure 3.3), most of the key communication requests have been dealt with and the firewall won’t interrupt quite as much.
Figure 3.3 ZoneAlarm detects that an antivirus program is trying to access the Internet and alerts the user to allow or deny the request.
Good firewalls offer the user recommendations as to how to respond to an alert when it recognizes the program the communication is coming from. Esoteric processes that need to access the Internet, however, can be hard to deal with because they can be somewhat cryptic for the uninitiated.
Communication from outside the firewall is less problematic because, unless the user initiates communication with the outside world, the inbound communication is ignored. The firewall can be triggered to alert the user to severe attacks, but you’d be surprised how often your IP address is probed by someone or something on the outside.
Stealth mode—This mode makes the firewall and the computer behind it invisible. Most good firewalls have this feature available and often it’s turned on by default.
Stealth mode works like this: You walk by my house in the middle of the darkest night and you yell, "Is anyone there?" If I turn on the porch light, come out, and say, "Yes, I am here," you know there’s a house on the block and you can engage me in a conversation. If you’re a bad person, you can find a way into my house by either tricking me or finding an open window or door when I am not looking.
If you yell, "Is anyone there?" as you walk by and I stay in my house and don’t respond, you don’t know I am there, so you keep going. This is the equivalent of a firewall in stealth mode.
- Threat management—Besides playing traffic cop, a software firewall can also offer other threat management features. It can inspect inbound data and compare it to threat signatures to help block virus and spyware infections. It can also be configured to stop you from sharing personal information with fraudulent websites, helping to defend you against phishing.
)
Recommended Firewall Freebies
A couple of very good free firewall programs you might consider installing include
- ZoneAlarm from http://www.zonelabs.com
- SyGate from http://www.sygate.com
Hardware Firewalls
Hardware firewalls are devices that physically sit between your computer and the wire that goes out to the Internet. Although businesses usually use a device that is physically separated from their other network gear, at home you’ll find a firewall built into home network routers.
Some of the many advantages to hardware firewalls are
- They are fire and forget. Install them and you are protected. No tweaking needed.
- They are included in the price of a device that shares your Internet between computers (meaning you can share your Internet connection with other computers in your home). No fees or extra costs.
- They have no impact on the system performance of your computer.
Easy Defense with a NAT Firewall
Home network routers have a firewall feature built in that uses a technology called network address translation (NAT).
It’s not a firewall technology itself, but it offers a firewall-like feature that provides natural protection from Internet nasties, such as hackers and worms.
TIP
If you install a third-party firewall on Windows XP, the XP Security Center should detect it and turn off the Windows Firewall (see Figure 3.4) because running two is redundant, could cause conflicts, and can slow down the computer unnecessarily. If for some reason you find that both Windows Firewall and a third-party firewall are running at the same time, simply open the Control Panel, choose Security Center, click on the Windows Firewall button, and turn off the firewall.
)
Figure 3.4 The Windows XP Security Center monitors the presence of a software firewall (in this case ZoneAlarm) and, on detection, turns off the Windows Firewalls to avoid redundancy.
NAT was invented because of a shortage of IP addresses available to the ever-growing Internet population. Sounds complicated but it’s not really. An IP address is like a phone number for each device connected to the Internet. Every device on the Internet has an IP number. An IP address is a set of four three digit numbers that can’t be any lower than 0.0.0.0 or higher than 255.255.255.255.
If you can surf the Internet on your computer right now, it has an IP address. Because there’s a shortage of IP addresses, not everyone can have her own. So NAT devices were invented to help (see Figure 3.5).
)
Figure 3.5 This Netgear router uses network address translation (NAT) that hides the identity of computers connected to it.
NAT routers work like this: Every large company has a switchboard. Everyone dials one central public phone number to talk to the company operator. When they reach the operator, they ask for an extension and they are put through.
NAT works like that. The router has an IP address that everyone on the Internet can call (it’s like the switchboard). Behind the router is a home network. Each computer on the network has a private IP address (like a phone extension).
When data from the Internet arrives for one of those computers, it is sent to the NAT router and the NAT router looks up the computer on its network (in a handy little directory it keeps) and checks to see which one made the request.
The router hands the data off to that computer. This is built-in security because no one on the Internet can send data to a computer behind a router directly. They always have to go through the router first.
Stateful Inspection: The Meticulous Traffic Cop
There’s one more level of security built into a NAT router that offers great and easy security. Let’s say your child’s computer, your computer, and your spouse’s laptop are all behind a router. Suddenly, in comes communication from a server on the Internet that hosts bumfluff.com.
The router looks at a list it keeps of all computers attached to it to see who initiated a request with bumfluff.com. When it discovers that none of the computers did, it realizes that bumfluff.com is a bad website that is actually a front for hackersncrackers.com. So it discards the request, and all is right with the world again.
You see, in order to communicate with a computer behind a NAT router, that computer has to first communicate with you (see Figure 3.6).
)
Figure 3.6 In stateful packet inspection, a router only allows information through to a computer if the computer requested it.
So if I use my computer to contact bumfluff.com to see the latest news about mallomars (which are tasty marshmallow and chocolate cookies), the router notes that I am making contact. When bumfluff.com comes back to the router with information about mallomars, the router says, "Oh yeah, Andy’s computer has been communicating with bumfluff.com, so I’ll let it through."
This is called stateful inspection or sometimes stateful packet inspection. All NAT routers engage in stateful inspection.