A Hardware and Software Firewall Combination (I got Hacked!)

Hi People,

I was hacked last week for the first time (that I know of) despite my
"secure" system.

I was using Windows firewall.
I had disabled many unneeded XP services.
I had a Belkin router, a F5D7230-4 model.

I was in a chatroom where some people were talking about hacking in a
friendly way and I asked if anyone would like to try hacking me. I
asked in a friendly way and asked that if anyone had success that they
let me know how they did it so I could secure my system better.

Well someone did it and left me a note in a txt document to prove it
but they didn't say HOW they did it. And no one would admit to doing it
when I asked. They did not do any damage to my data that i am aware of.

So.

I reformatted and reinstalled Windows XP Pro, four times actually.

I installed Zone Alarm Pro although I'm not sure that I have it
optimally configured.

I installed Avast antivirus although I'm not sure that I have it
optimally configured either.

I Installed The Cleaner by Moosoft which comes with "TC Active" a
trojan scanner which also has monitors live processes for Trojans/Worms
and other malicious programs and kills thems before they do damage and
"TCMonitor" which keeps track of Registry keys, Files and Folders and
alerts to any changes.

I Installed Tauscan, another trojan cleaner that comes with TC
Monitor..

Basically I don't really know what I am doing. I'll say it again to
ward off flames etc. I don't really know what I am doing.

So I bought a "better" wireless router - a Linksys Wireless-G (WRV54G)
with VPN! - but after installing it I failed some online port scans at
GRC.com and in addition the tech support guy trying to help me a didn't
really know what he was saying. After an afternoon of trying to
configure it to work with my software firewall I gave up and reverted
to the Belkin and Zone Alarm Pro etc.

So my question is this:
What is a good hardward firewall in the under $200.00 range and a good
software firewall to go with it? How might I best configure this combo?
Any comments would be greatly appreciated.

Thanks,
Matt

PS: Please reply in this group so that others may benefit as well.

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Sebastian Gottschalk wrote:
> Let me guess: It was a website chat and you've being using MSIE. Or it was
> Java-based and you had an outdatet version of J2SE installed? Or it was IRC
> and you were using mIRC? Or and kind of Instant Messaging and you've been
> using ICQ/Lite, AIM or Windows/MSN Messenger?
>
> Or you're running various software downloaded from P2P networks?
>
> No firewall could protect against such stupidities.

GREAT Guessing Seb!

Umm, It was Yahoo Messenger Chat using YahElite, I was and am using
Firefox, I have the latest Java update (1.5.06). My software is all
legit, I dont use peer to peer networks and I did not go to any hostile
websites.

THANK YOU for all your helpful assumptions, you helped me greatly.

Re: A Hardware and Software Firewall Combination (I got Hacked!)

matt3000@mxao.com wrote:
> Sebastian Gottschalk wrote:
>> Let me guess: It was a website chat and you've being using MSIE. Or it was
>> Java-based and you had an outdatet version of J2SE installed? Or it was IRC
>> and you were using mIRC? Or and kind of Instant Messaging and you've been
>> using ICQ/Lite, AIM or Windows/MSN Messenger?
>>
>> Or you're running various software downloaded from P2P networks?
>>
>> No firewall could protect against such stupidities.
>
> GREAT Guessing Seb!
>
> Umm, It was Yahoo Messenger Chat using YahElite, I was and am using
> Firefox, I have the latest Java update (1.5.06). My software is all
> legit, I dont use peer to peer networks and I did not go to any hostile
> websites.
>
> THANK YOU for all your helpful assumptions, you helped me greatly.
>
>
>
> ---
> avast! Antivirus: Inbound message clean.
> Virus Database (VPS): 0643-2, 24/10/2006
> Tested on: 24/10/2006 16:37:12
> avast! - copyright (c) 1988-2006 ALWIL Software.
> http://www.avast.com
>
>
>
I have said this to many people over the years.
No matter how good your system is protected there is and always will be
some one out there who can get in.
There is no such thing on this Earth as a 100% totally protected computer.
Never ask any one to hack into your PC, it just may be some one who can
do it and really F*** things up for you. example personal data loss
account name records and the such like.
And if any one says it cant be done then go tell that to the American
secret servises and how they got hacked.
That just one name for starters.
Its not the first time that the American defence got hacked.
So it wont be to much effort for some one to get into a home PC or even
a work`s PC.



--
http://www.commodore16.bravehost.com/

http://uk.geocities.com/swift240/index.html

Athlon 2000+XP, Win XP, AmiKit V1.2.2


---
avast! Antivirus: Outbound message clean.
Virus Database (VPS): 0643-2, 24/10/2006
Tested on: 24/10/2006 16:43:39
avast! - copyright (c) 1988-2006 ALWIL Software.
http://www.avast.com

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

matt3000@mxao.com wrote:

> Sebastian Gottschalk wrote:
>
>>Let me guess: It was a website chat and you've being using MSIE. Or it was
>>Java-based and you had an outdatet version of J2SE installed? Or it was IRC
>>and you were using mIRC? Or and kind of Instant Messaging and you've been
>>using ICQ/Lite, AIM or Windows/MSN Messenger?
>>
>>Or you're running various software downloaded from P2P networks?
>>
>>No firewall could protect against such stupidities.
>
> GREAT Guessing Seb!
>
> Umm, It was Yahoo Messenger Chat using YahElite, I was and am using
> Firefox, I have the latest Java update (1.5.06). My software is all
> legit, I dont use peer to peer networks and I did not go to any hostile
> websites.
>
> THANK YOU for all your helpful assumptions, you helped me greatly.

On the brighter side, you are not alone.

The IM worms armada
(http://www.viruslist.com/en/weblog?weblogid=203678309)

Ron :)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Gottschalk..

First of all please read my ORIGINAL post more carefully.

I stated:
"Basically I don't really know what I am doing. I'll say it again to
ward off flames etc. I don't really know what I am doing."

I also stated that I reformatted 4 times. Do you think I have log files
etc?

Once again, I stated that "Basically I don't really know what I am
doing. I'll say it again to
ward off flames etc. I don't really know what I am doing."

I see that you know a thing or two about firewalls but do you know how
to READ? Being critical of someone that knows less than you, and
openly admits it is not such a good thing.

I ask if you read my post because I DID NOT ASK anything about how I
got hacked, i KNEW the logs etc were gone. As far as your magic 8 ball,
try responding to what I actually ASKED and you wont need it. Audit
log? Huh? Do "Audit logs" survive 4 reformats, should i UNDELETE with
file recovery software? Im being sarcastic because these are not things
I am asking for help with.

All I am asking is this - What is a good hardward firewall in the under
$200.00 range and a good software firewall to go with it? How might I
best configure this combo?

Let me restate my question:

What is a good hardward firewall in the under $200.00 range and a good
software firewall to go with it? How might I best configure this combo?


Gottschalk - Your original reply was insulting and subsequent posts
were not much better. You know more than me about firewalls. If you
would like to be helpful please answer the question or please keep your
peace.

What is a good hardward firewall in the under $200.00 range and a good
software firewall to go with it? How might I best configure this combo?


Thanks,
Matt

PS: The people I asked to hack me are good people. They did no damage
and they are just messing with me by not telling me how they did it.
They said they will tell me on Nov 1st after I figure some things out
for myself. I knew they were not bad people and the PC that the hacked
into didn't have anything not worth losing anyway. I was intentionally
testing my security and now I am attempting to better my security
hardware and Software firewalls first.

PPS: The info on latest versions was helpful even though I didn't
request it.

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Ron Lopshire wrote:

> On the brighter side, you are not alone.
>
> The IM worms armada
> (http://www.viruslist.com/en/weblog?weblogid=203678309)
>
> Ron :)

Yea, I always use Firefox and I did not go to any malicious websites. I
tend to underplay what I know but I did state that I use Firefox and
that I didn't go to and malicious websites in an earlier post in this
thread. It WAS freaky to learn of infectious jpgs though, I first heard
of that a few weeks ago. It seems that one must be otherwise infected
and unpatched in order for it to work but given that I use Firefox (and
now im looking for version 2.0) I wasn't unduly concerned and didn't
look into it too much further.

Matt

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Leythos,

I NEVER go to strange links that are IM'd to me and in general I am
VERY careful about any sites I go to. I know about various active-x
exploits, godwill, godmessage are a few older ones that would upload a
trojan known as Undetected or any other tiny trojan that the "ahcker"
plugged into the code. These days it seems tha the active-x exploit
more commonly used is a keylogger for snagging passes etc but Im not up
on such things so much these days (Obviously, LOL)

BTW, What is a good hardward firewall in the under $200.00 range and a
good
software firewall to go with it? How might I best configure this
combo?????

Matt



> In the last three years of working with a Sorority, the only method
> that's compromised their machines has been from AOL IM, Yahoo IM, and
> MSN IM. Also, of all the machines that were compromised, all were
> running updated and active AVG.
>
> Each user reported that they got a link/file from someone in IM that
> they knew, and they opened/ran the link/file and that's when it went
> bad.
>
> --
>
> spam999free@rrohio.com
> remove 999 in order to email me

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

matt3000@mxao.com wrote:
> So my question is this:
> What is a good hardward firewall in the under $200.00 range and a good
> software firewall to go with it? How might I best configure this combo?

Your price range is rather low if you want a really good hardware
firewall. See if you can find a used Cisco PIX 501 on eBay.

Once you have a good hw firewall, take your time to understand it and
configure it properly. Don't bother with a software firewall--put all
of your effort into the hw fw. Which do you think is more secure? Two 5
foot high walls one behind the other, or one 10 foot high wall?

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

On Tue, 24 Oct 2006 19:06:45 +0200, Sebastian Gottschalk
wrote:

>> I have the latest Java update (1.5.06).
>
>The latest version of Sun Java J2SE is 1.5.09. However, I'm not aware
>serious and easily exploitable vulnerabilities since 1.5.05.

I have Version 1.5.0 (build 1.5.0_08-b03), and when I run Update, I'm told
I have the latest version. Where's 5.1.09?


Tom

--
remove .spoo to reply by email

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Sebastian Gottschalk wrote:

> Tom Hall wrote:
>
>>>>I have the latest Java update (1.5.06).
>>>
>>>The latest version of Sun Java J2SE is 1.5.09. However, I'm not aware
>>>serious and easily exploitable vulnerabilities since 1.5.05.
>>
>>I have Version 1.5.0 (build 1.5.0_08-b03), and when I run Update, I'm told
>>I have the latest version. Where's 1.5.09?
>
> as always:
>
> But thanks for the hint. Release 09 was a bit strange, because via Google
> you could find a direct download, but nothing was stated on the website and
> neither visible at Sun Download Center. Then, when a release note appeared,
> nothing was told about the JDK download, and one really had to wait for it.
> And now it seems even the update database is way behind.

Gentlemen,

It doesn't matter whether you have the latest version of Java/JRE or
not. What matters is that you have removed the previous versions known
to be vulnerable. The Java installers will not do that for you. You
have to do it manually.

IIUC, at some point this scenario is/was supposed to change. Whether
it has or not, I do not know. I don't use Java. But this is how I
understand the situation from posts by those supposedly in the know.

Ron :)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Sebastian Gottschalk wrote:
> Ron Lopshire wrote:
>
>>It doesn't matter whether you have the latest version of Java/JRE or
>>not. What matters is that you have removed the previous versions known
>>to be vulnerable. The Java installers will not do that for you. You
>>have to do it manually.
>
> Firefox uses only the most recent version of Java by default, so it doesn't
> care about any old versions installed.

It is my understanding, Sebastian, that that is not the point.
Vulnerable versions of Java/JDK/JRE _must_ be removed in order to
mitigate the vulnerability, irrespective of which versions are
actually used. As I said, I am relying on the advice of Java
aficionados. I don't use it.

>>IIUC, at some point this scenario is/was supposed to change. Whether
>>it has or not, I do not know.
>
> Rather not. It's good to be able to have multiple versions of Java (f.e.
> 1.5, 1.4.2 and 1.6 Beta) running in parallel.

I don't understand that at all. Perhaps an official release and a Beta
version for testing purposes, but other than that, why? It reminds me
of Adobe Acrobat. Almost none of the documents produced with early
versions (<5) were compatible with other versions. And so, the
installation of multiple versions was required in order to read a
document from some idiot who fell for the Adobe pdf hype. That is
another thing that I got rid of --- all Adobe crapware.

>>I don't use Java.
>
> Java is a quite common runtime for many applications. Even OpenOffice uses
> it, and this one is rather unavoidable on a typical workstation.

None that I use. Nothing against Java, per se, but I currently don't
need it. That is why I uninstalled it. Got tired of updating it every
couple of months due to the incompetence of the Sun developers. If I
had a need for Java, I would re-install it and keep it updated. I got
rid of the .NET Framework for the same reasons.

I haven't tried OOo since I have Office 2003 installed. It is my
understanding that the VBA and VBIDE support in OOo absolutely sucks,
and VBA for Excel and Access are the only things that I need anyway.

I have spent over 10 years developing my Excel apps, and by the time I
ported them into another app and/or platform, I would be dead anyway.
I rue the day that I ever decided to use Excel, but that is neither
here nor there. I am stuck with it.

Ron :)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Sebastian Gottschalk wrote:

> Ron Lopshire wrote:
>
>>Sebastian Gottschalk wrote:
>>
>>>Ron Lopshire wrote:
>>>
>>>>It doesn't matter whether you have the latest version of Java/JRE or
>>>>not. What matters is that you have removed the previous versions known
>>>>to be vulnerable. The Java installers will not do that for you. You
>>>>have to do it manually.
>>>
>>>Firefox uses only the most recent version of Java by default, so it doesn't
>>>care about any old versions installed.
>>
>>It is my understanding, Sebastian, that that is not the point.
>>Vulnerable versions of Java/JDK/JRE _must_ be removed in order to
>>mitigate the vulnerability, irrespective of which versions are
>>actually used. As I said, I am relying on the advice of Java
>>aficionados. I don't use it.
>
> Could it be that you're twisting the JVM being used in general and the
> embedding as for browsers? Of course, a single user on the machine can
> launch an old JVM, run an application of his choice, this one gets broken
> in and then the attacker can break out of the sandbox due to the
> vulnerabilities. That doesn't mean that any webbrowser will allow you to
> start any different JVM then the one he already selected - which is the
> most recent one.

As I said, I don't know. I would be interested in whether this is a
POC, or someone has actually been exploited by keeping an older,
vulnerable version around.

>>>>IIUC, at some point this scenario is/was supposed to change. Whether
>>>>it has or not, I do not know.
>>>
>>>Rather not. It's good to be able to have multiple versions of Java (f.e.
>>>1.5, 1.4.2 and 1.6 Beta) running in parallel.
>>
>>I don't understand that at all. Perhaps an official release and a Beta
>>version for testing purposes, but other than that, why?
>
> There are still some software packages that have problems with Java 1.5,
> and this is due to some problems with backward compatibility. (F.e.
> semantics of the 'volatile' keyword).
>
> After all, as long as 1.4 gets supported, it's not bad.

I see. Once Sun stops supporting 1.4, it's out of here. [g]

>>I haven't tried OOo since I have Office 2003 installed.
>
> Ok, then we should stop talking about security. Or serious software.

I told you that I rue the day. ;)

Excel 5-7 were great apps. And then the idiots added ActiveX, HTML
help, VBIDE and whole bunch of other crap that I haven't even found
yet. Why I need access to my internet connection from a spreadsheet
only the marketing clowns in Redmond know. I try to keep it (the
Office Suite) locked down, but you never know. BTW, I wouldn't even
consider using Outlook. And IE only to update the OS and Office Suite.

>>I have spent over 10 years developing my Excel apps, and by the time I
>>ported them into another app and/or platform, I would be dead anyway.
>>I rue the day that I ever decided to use Excel, but that is neither
>>here nor there. I am stuck with it.
>
> Well, but that's not it. As long as the MS pseudo-Office suite doesn't
> support OpenDocument, you need an additional word processor who does
> support it. On Windows, OpenOffice ist the only usable free alternative
> (not gonna talk about AbiWord, it sucks).

IMNSHO, Notepad Editor is a better word processing app than any
version of MS Word that has ever been or ever will be released. I use
MS Word only when absolutely necessary, and that usually involves
kicking and screaming.

BTW, I never understood what all of the MS-bashing was about until I
bought a WinXP box and installed Office 2003 Professional. Now I know.

Ron :)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Ron Lopshire wrote:
> IMNSHO, Notepad Editor is a better word processing app than any
> version of MS Word that has ever been or ever will be released. I use
> MS Word only when absolutely necessary, and that usually involves
> kicking and screaming.

Just curious: which Notepad Editor are you talking about? TIA.
--
Tore

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Post removed (X-No-Archive: yes)

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Sebastian Gottschalk wrote:
> Tore Lund wrote:
>
>> Ron Lopshire wrote:
>>> IMNSHO, Notepad Editor is a better word processing app than any
>>> version of MS Word that has ever been or ever will be released. I use
>>> MS Word only when absolutely necessary, and that usually involves
>>> kicking and screaming.
>> Just curious: which Notepad Editor are you talking about?
>
> I assume the one which ships with Windows. The single-threaded one, that
> can't receive a drag-and-drop while outputting to the printer queue. The
> one, that stores "this app can break", but when loaded again, just outputs
> either Chinese chars or garbage (if no matching font is installed).
>
> But at least it doesn't forget the text's formatting at runtime, doesn't
> need hours to search some few 10000 lines (still takes pretty long), and
> offers a non-volatile storage format by default (.doc is merely a
> serialized memory dump - no joke!). So it's really less broken than MS
> Office.

Maybe, but Ron said it was better than MS Word, so I supposed he meant
some other editor.
--
Tore

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Other than those people pointing out what software you shouldn't be
using (and they're making good suggestions, most of them), I think
there are some simple ideas to take away from this:

1) Most of the devices sold to home users as "firewalls" actually do
very little. They may block ports, but don't have the packet
inspection functionality better firewalls do. That may not mean much
to you - but it does make difference

2) You can buy a Cisco PIX 506 or 501 for a bit more than $200 on
e-bay, but unless someone who knows what they're doing configures it,
it's about as useful as a brick. Granted, there are some "wizards"
that help you configure a 506e, but you still need an understanding of
your needs, network protocols, and possible attacks. Buying a fast car
doesn't make you a NASCAR champ.

3) You might want to check a number of magazines/web sites for their
recommendations and reviews. Their reviews might give you a better
grasp of the issues in choosing a firewall, and point you to some of
the manufacturers web sites. Individuals who are security
professionals tend to have strong opinions about various devices, and
may not give you the full picture. Magazines play favorites, too, but
sampling a number of them can even out the bias a bit.

You know, much of this is the same as buying a new car or washing
machine. The problem is that firewalls don't advertise on TV, so you
don't know where to start.


matt3000@mxao.com wrote:
> Gottschalk..
>
> First of all please read my ORIGINAL post more carefully.
>
> I stated:
> "Basically I don't really know what I am doing. I'll say it again to
> ward off flames etc. I don't really know what I am doing."
>
> I also stated that I reformatted 4 times. Do you think I have log files
> etc?
>
> Once again, I stated that "Basically I don't really know what I am
> doing. I'll say it again to
> ward off flames etc. I don't really know what I am doing."
>
> I see that you know a thing or two about firewalls but do you know how
> to READ? Being critical of someone that knows less than you, and
> openly admits it is not such a good thing.
>
> I ask if you read my post because I DID NOT ASK anything about how I
> got hacked, i KNEW the logs etc were gone. As far as your magic 8 ball,
> try responding to what I actually ASKED and you wont need it. Audit
> log? Huh? Do "Audit logs" survive 4 reformats, should i UNDELETE with
> file recovery software? Im being sarcastic because these are not things
> I am asking for help with.
>
> All I am asking is this - What is a good hardward firewall in the under
> $200.00 range and a good software firewall to go with it? How might I
> best configure this combo?
>
> Let me restate my question:
>
> What is a good hardward firewall in the under $200.00 range and a good
> software firewall to go with it? How might I best configure this combo?
>
>
> Gottschalk - Your original reply was insulting and subsequent posts
> were not much better. You know more than me about firewalls. If you
> would like to be helpful please answer the question or please keep your
> peace.
>
> What is a good hardward firewall in the under $200.00 range and a good
> software firewall to go with it? How might I best configure this combo?
>
>
> Thanks,
> Matt
>
> PS: The people I asked to hack me are good people. They did no damage
> and they are just messing with me by not telling me how they did it.
> They said they will tell me on Nov 1st after I figure some things out
> for myself. I knew they were not bad people and the PC that the hacked
> into didn't have anything not worth losing anyway. I was intentionally
> testing my security and now I am attempting to better my security
> hardware and Software firewalls first.
>
> PPS: The info on latest versions was helpful even though I didn't
> request it.

Re: A Hardware and Software Firewall Combination (I got Hacked!)

Tore Lund wrote:

> Ron Lopshire wrote:
>
>>IMNSHO, Notepad Editor is a better word processing app than any
>>version of MS Word that has ever been or ever will be released. I use
>>MS Word only when absolutely necessary, and that usually involves
>>kicking and screaming.
>
> Just curious: which Notepad Editor are you talking about? TIA.

Any of them. [g] I absolutely hate using MS Word, but obviously, I was
being somewhat facetious. I do, however, quite often compose documents
in the Windows Notepad Editor, and then C&P the document into MS Word
for printing purposes only when formatting is required.

On the other hand, this _is_ the best ASCII/HTML editor.

http://notepad-plus.sourceforge.net/uk/site.htm

And I am _not_ being, in any way whatsoever, facetious about that.

Ron :)