Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

RE: FW: Worms versus Bots

  • From: Daniel Senie
  • Date: Tue May 04 13:08:56 2004

At 12:35 PM 5/4/2004, Smith, Donald wrote:
Daniel I agree a nat/firewall/router with acl's ... will all help
prevent windows compromises.
I believe security in depth is an essential element of any good security

The goal of this document is help new XP users survive long enough to do
their updates.
Many of them cant/wont put up acls/nat/firewalls
Note that I said "have this NAT box in your bag." My suggestion is that this be used during installation.

Is $50 too high an extra expense to suggest people just buy one with the machine, and use it as a tool for doing installations? That's what I was suggesting.

For the money, this is FAR better protection than that provided by the document.

... but if they follow
the steps listed they have a better chance of
successfully downloading and updating their new machine then they will
have with OUT these steps.
It is not meant as a complete XP hardening document. There are lots of
documents that discuss in detail how to harden
windows (xp,nt,2k...). GCIA
pgpFingerPrint:9CE4 227B B9B3 601F B500  D076 43F1 0767 AF00 EDCC
kill -13 111.2

> -----Original Message-----
> From: [] On
> Behalf Of Daniel Senie
> Sent: Tuesday, May 04, 2004 9:39 AM
> To: Sean Donelan
> Cc:
> Subject: RE: FW: Worms versus Bots
> At 10:54 AM 5/4/2004, Sean Donelan wrote:
> >On Tue, 4 May 2004, Smith, Donald wrote:
> > > If you follow these steps outlined by SANS you should be able to
> > > successfully update and NOT get infected. This is short,
> easy, fully
> > > documented (with pictures :)
> > >
> >
> >The risk is smaller, but still exists if you follow these directions
> >for XP pre-SP2.  See the Microsoft release notes for XP SP2
> for details
> >about the fix.
> >
> >If you do not have XP SP2, you need to disconnect your computer from
> >the network prior to every boot cycle until it is fully patched.
> A much simpler mechanism than that described by SANS is to
> have a small,
> cheap NAT box in your bag (e.g. D-Link DI-604 or similar).
> Worth the $50
> cost to have one available. Put the little router between the
> new machine
> to be brought up and whatever network you have access to. Now
> you can bring
> up the new machine and update it without having it get
> instantly infected.
> (Use some common sense... don't set up email until the
> machine is patched,
> or use any other sort of mechanism to pull in potential
> viruses before
> patching is done).
> (To deflect the inevitable "NAT is not a firewall"
> complaints, the box is a
> stateful inspection firewall -- as all NAT boxes actually are).

Discussion Communities

About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home

Merit Network, Inc.