Threats To Remote User Network Connections

An exciting array of modern broadband technologies, including cable modem, Digital Subscriber Line (DSL), VSAT satellite, and wireless is bringing faster, affordable Internet access opportunities to small, remote offices and home users. Furthermore, the traditional and economical analog modem connection continues in widespread use for individual Internet connections. Unfortunately, all of these remote connection services make the frequently connected remote user an extremely inviting target for hoards of direct and Trojan Horse-based hacker attacks.

In recent years, reports from the FBI's National Infrastructure Protection Center have revealed that major distributed denial-of-service (DDoS) breaches were successful by attackers garnering a multitude of poorly protected user systems to serve as unwilling accomplices (frequently referred to as Zombies) and became "launching pads" for attacks on unsuspecting victim Web sites. The most common way that a victim system becomes a Zombie is when a backdoor Trojan Horse agent is planted on the user's system. General-purpose Trojans include SubSeven, NetBus, and Back Orifice, while Trin00 is a popular, more DDoS-specific Trojan. In addition, widespread downloaded freeware and shareware such as PKZIP and Real Player may contain adbots that periodically send information about the user's system back to the software developer/supplier across the Internet.


Vulnerabilities

Among the most common vulnerabilities that open the door for these attacks is the indiscriminant sharing of the user's entire hard drive to the entire network community, technically referred to as Server Message Block (SMB) or just plain Windows network file shares. Unless extra attention is paid to adjusting access permissions, Windows NT 4.0 Workstation and Windows 2000 Professional will by default raise the vulnerability level by offering selected shares with Full Control privileges--meaning that all modes of access are allowed to everyone. Linux users can get into similar trouble by being overly permissive in sharing resources through SAMBA and Network File System (NFS) applications.

Other Achilles Heels include the recently identified unpatched plug-and-play services on many versions of Microsoft Windows platforms and a wide of array of TCP/IP application servers (Web or FTP servers, telnet, Trivial File Transfer Protocol, Simple Network Management Protocol) that may create vulnerabilities through faulty configuration and/or software bugs. If a remote user is connected to two different Internet sessions simultaneously, those applications open the door for a would-be intruder to slip from the Internet right into the user's enterprise network. Additionally, cable modem users are even more vulnerable to packet sniffing attacks than other users of remote user Internet connections.