Information/Help

  • Thread starter Thread starter Peter J
  • Start date Start date
P

Peter J

I am getting attempted hacks of my system using MS_RPC_DCOM_BufferOverflow
ever five minutes. Can any one give me information about this and is there
anything I can do to stop the attempts?
 
I am getting attempted hacks of my system using MS_RPC_DCOM_BufferOverflow
ever five minutes. Can any one give me information about this and is there
anything I can do to stop the attempts?
Click to expand...

Which security app warns you of the the attacks in those terms? Have
you disabled DCOM? :

http://grc.com/dcom/

Seems to me if you're protected, you'd simply ignore the probes unless
you've determined they most all originate with a particular IP day
after day and want to try to track down the owner. That can be pretty
difficult though.


Art
http://www.epix.net/~artnpeg
 
I am getting attempted hacks of my system using
MS_RPC_DCOM_BufferOverflow ever five minutes. Can any one give me
information about this and is there anything I can do to stop the
attempts?
Click to expand...

We'll assume you have a FW on the machine that is stopping the attacks,
which is a starting point in protecting the machine. You can also check
the Windows Update site which has info on further securing the machine
from the DCOM attack -- right in the middle of the page.

You are getting unsolicited inbound traffic to the machine and the FW is
stopping it and the attack. But to really stop the unsolicited traffic
from reaching your machine, you should get a cheap NAT router and put it
in front of the machine, which will stop the unsolicited traffic from
reaching the machine and the FW on the machine will not have to react to
it.

You can get a cheap NAT router for as little as $25 big ones.

http://www.homenethelp.com/web/explain/about-NAT.asp

Keep the FW on the machine to back-up the router and prevent the phone
home attempt. That is the layered protection approach.

You may want to look into *hardening* that NT based O/S and the link
talks about all of them.

http://www.uksecurityonline.com/husdg/windows2000.php

Duane :)
 
Back
Top