"cquirke (MVP Windows shell/user)" <
[email protected]>
wrote
Now that is very worrisome. I'm on XP Home SP-2. How do I find out
about my hidden admins shares (whatever they are)
XP Home is said to be safe where admin shares are concerned, but I
apply registry settings to kill them anyway.
The main admin shares are:
- IPC$, used by RPC. Can be killed only for remainder of runtime
- c$, d$, e$... which expose the entire volume, \ onwards
There are others, e.g. as used for printer driver sharing, but I
haven't chased them up. Here's the .reg:
<paste>
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]
"AutoShareServer"=dword:00000000
"AutoShareWks"=dword:00000000
</paste
Note: Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]
"AutoShareServer"=dword:00000000
"AutoShareWks"=dword:00000000
Note: Some malware enters via these shares, and having entered,
applies this setting to kill the shares. Then, when the av cleans up
the malware, it reverses this setting so that the shares are open
again, thus attackable again.
So if you apply this protection, and have cleaned up active malware,
you should re-check (or re-apply) the setting.
...and how do I make them secure?
If you don't need admin shares, then in addition to "making them
secure", kill them altogether. Non-existance trumps "restricted
access", so I like to do both.
If you do need admin shares, then you have to do what you can to
"secure" them and leave it at that.
Firstly, XP Home is said not to expose admin shares.
Next, admin shares go wherever File and Print Sharing (F&PS) goes.
For all network adapters that do not need F&PS, unbind it from that
adapter's network stack. For example, let's say you have a LAN over
which you do file sharing, dial-up networking to access Internet, and
WiFi and FireWire that you do not use at all. You want this:
LAN card: [X] F&PS
Dial-up networking: [_] F&PS
WiFi adapter: [_] F&PS
FireWire adapter: [_] F&PS
You can also suppress F&PS at the firewall level, though that is not
as easy. SP2 makes it easier to block F&PS through the firewall, but
if you go into the per-adapter detail (needed if you want to block
F&PS on some devices, but allow on others) you don't see anything that
looks remotely like F&PS in the list of what you can do.
That's for XP's built-in firewall. With add-on firewalls, YMMV.
Then you can apply a password band-aid to restrict access further
(though frankly, if someone gets close enough to guess passwords, I'd
say they'd been too close for comfort for a while).
A null password is said to preclude access to admin shares completely,
but
http://cquirke.mvps.org/pwdssuck.htm applies; no password means no
barrier to setting any password. In that sense, passwords are not
"optional" in that one can remove the facility altogether.
The other approach is to set a strong, guess-resistant password, and
take the risk of being locked out if you ever forget it.
The difficulty is where you are forced to use the same network adapter
for both LAN access (including file sharing) and Internet access.
This is common where you share a single Internet access point, such as
a broadband connection, across multiple PCs.
With Win9x, it was really easy; you'd use TCP/IP for Internet traffic,
and some other protocol (i.e. NetBEUI or IPX) for LAN traffic. Then
you could keep F&PS off TCP/IP, slam up the firewall as hard as you
like, and conduct your F&PS via the other protocol.
But XP's networking is, in my experience, too broken to do this; I
could not not get a mix of XP and Win9x to "see each other" if I used
any protocol other than TCP/IP - including the hidden NetBEUI.
So now you're forced to have F&PS exposed to the Internet, which is
really, really stupid. That's why I'd insist on using a NAT router
for the broadband, and not some half-assed "modem" that is bound into
a particular PC, which then shares it via Internet Connection Sharing.
As for wireless networking; it's OK between your Internet device and
the rest of the world (as that's public anyway), but I would not use
it within your LAN. It's too non-impossible to tap into your LAN
directly (bypassing NAT etc.) via WiFi, IMO.
-- Risk Management is the clue that asks:
"Why do I keep open buckets of petrol next to all the
ashtrays in the lounge, when I don't even have a car?"
----------------------- ------ ---- --- -- - - - -
