HP Norton Personal Firewall 2003 manual Initial access, Privilege escalation

Understanding Internet risks

Risks from hackers

127

Initial access

The easiest way for a hacker to access a Windows computer is to use Microsoft networking. On many computers, Microsoft networking is enabled so that anyone on the network can connect to it.

Microsoft NetBIOS networking uses three of the well-known ports. These ports are used to establish connections among computers on a Microsoft network. In fact, they normally advertise the name of your computer over the local network. This is what you want on your own network, but it is not what you want on the Internet. Norton Personal Firewall is preset to block these ports and prevent someone on the Internet from connecting to your computer using Microsoft networking. If your computer is connected to a local network as well as to the Internet, you must change some settings to allow communication with the other computers on your network. Norton Personal Firewall still protects you from Internet risks while allowing you to use your local network.

Privilege escalation

Once a hacker has connected to your computer, the next step is to gain as much control as possible. The steps involved and the results obtained vary depending on the version of Windows that is running on the target computer.

On computers running Windows 95/98/Me, once hackers have gained access to the computers, there is no need for escalation. They have full control of the computers. Luckily, these versions of Windows don’t have many remote control features, so they are relatively easy to protect.

On computers running Windows 2000/XP, hackers attempt to gain administrative rights to the computers. The key to getting administrative rights is usually a password. The hacker can download your password file and decode it.

Another tactic is to place a Trojan horse on your computer. If a hacker can place a program such as Back Orifice, Subseven, or NetBus on your computer and run it, it is possible to take control of the computer.

Other Trojan horses might record all of your keystrokes to capture passwords and other sensitive data. Norton Personal Firewall and Norton AntiVirus provide two levels of protection against Trojan horses. Norton AntiVirus protects you from inadvertently running these programs. Norton Personal Firewall blocks the ports that remote access Trojan horses use to communicate over the Internet.