Anti-Hacker Advice - discuss, anyone?

Nathan Natas

One of the computer gurus I follow has recently suggested that HOME users of WinXP might be well advised to TURN OFF DCOM as a way of protecting their systems from some of the evolving malware.

I'd like to get the opinions of you other clever folks out there - do you feel this is worth doing? What might be the downside?

If the consensus is that this could be a good thing, I'll post instructions about HOW to turn off DCOM in your WinXP computer.

Note: turning off winXP is probably NOT something you want to do with your networked computer at work, but for non-networked home computers, it might be OK....

Let the discussion begin!

Bendrr

What's DCOM?

Most of this stuff is way over my head but I like to learn what I can.

Mike.

Simon

Yes, it's unlikely to be used much (ie. not part of a distributed application).

Disable it and see if anything is affected (you can always turn it back on)

I have things turned off on the server even though they are blocked on the firewall - belt and braces approach, strength in depth.

LittleToe

XP has it's own built-in Firewall software.
No substitute for the real thing, but an extra layer of defense, if you have one.

Nathan Natas

To answer Bendrr's question -

From: http://iroi.seu.edu.cn/books/ee_dic/whatis/dcom.htm

- - -begin quote - - -

DCOM (Distributed Component Object Model) is a set of Microsoft concepts and program interfaces in which client program objects can request services from server program objects on other computers in a network. DCOM is based on the Component Object Model (COM), which provides a set of interfaces allowing clients and servers to communicate within the same computer (that is running Windows 95 or a later version).

For example, you can create a page for a Web site that contains a script or program that can be processed (before being sent to a requesting user) not on the Web site server but on another, more specialized server in the network. Using DCOM interfaces, the Web server site program (now acting as a client object) can forward a Remote Procedure Call (RPC) to the specialized server object, which provides the necessary processing and returns the result to the Web server site. It passes the result on to the Web page viewer.

DCOM can also work on a network within an enterprise or on other networks besides the public Internet. It uses TCP/IP and HTTP. DCOM comes as part of NT 4.0 and is a free upgrade for Windows 95. DCOM is or soon will be available on all major UNIX platforms and on IBM's large server products. DCOM replaces OLE Remote Automation.
- - - end of quote - - -

It is true that WinXP has a built in firewall, but I think that having the firewall enabled does not necessarilly stop DCOM from operating. I take the "Night Of The Living Dead" approach - the more windows and doors I have boarded up and nailed shut, the safer I will be from the brain-eating zombies "out there." That's why I also keep a loaded 12 gauge shotgun next to my desk too. One can never be TOO cautious, can one? Any of those zombies comes thru my computer, BLAMMO, Baby!

Valis

The problem is that software can be emulated, for instance what would happen if packets were accepted that had the same signature as say, virus definition, OS updates or firewall updates? Then perhaps it installs itself into a different directory and you are hosed...just a scenario I was thinking about. Cool topic SS...

Sincerely,

District Overbeer

Nathan Natas

Here's a little more information from Gibson research Corporation - GRC.com - a GREAT resource!

Another THREE New DCOM/RPC Windows Vulnerabilities Revealed

September 10th, 2003 – Microsoft releases news of three additional recently discovered vulnerabilities in the Windows DCOM / RPC system. (Go to GRC.com if you're curious for more Microsoft information.) Two of the three vulnerabilities allow anonymous hackers to run their own program code in your computer to remotely take it over. Even though almost any other security measures will prevent that from happening (a personal router, firewall, etc.), the MSBlast worm showed us what happens, even so.

As it was designed to, our DCOMbobulator preempted these latest vulnerabilities even before Windows was again patched for them.

The DCOMbobulator simply turns off the unneeded and unnecessary DCOM system. No one who previously used our DCOMbobulator to disable DCOM was ever at risk from these latest vulnerabilities. (Nor will they be if any more are found tomorrow . . . or next year.)

If you haven't used the DCOMbobulator already, do it now. It's free and simple.

September 11th, 2003 – Version 2.0 of our DCOMbobulator is now available for download. If DCOM is enabled on the system (for patch verification) it recognizes the presence of Microsoft's latest round of DCOM patches and properly reports that a fully patched system is no longer vulnerable to the most recently discovered DCOM vulnerabilities.

Introducing the DCOMbobulator

117,369 downloads (3,906 per day) The DCOMbobulator allows any Windows user to easily verify the effectiveness of Microsoft's recent critical DCOM patch. Confirmed reports have demonstrated that the patch is not always effective in eliminating DCOM's remote exploit vulnerability.

But more importantly, since DCOM is a virtually unused and unneeded facility, the DCOMbobulator allows any Windows user to easily disable DCOM for significantly greater security.

FOLLOW THIS LINK to learn about this latest freeware! ( the link is disabled in this message - go to grc.com to catch it live)

Shoot The Messenger 205,732 downloads.
Even before the latest DCOM/RPC vulnerability (see above), many Windows users were being annoyed by "pop-up spam" notices appearing on their desktops. This intrusion is also facilitated by an exploitation of port 135. Our free "Shoot The Messenger" utility furthers the security of Windows by quickly and easily shutting down the "Windows Messenger" server that should never have been running by default in the first place.

Yerusalyim

Computer hijackers...argghhh

Valis

Dammit!!!! I did it again Nathan!...Sorry about that....I must be lesdyxic or something...*LOL*

Sincerely,

District Overbeer of the "Stupid Head" class

drwtsn32

Personally I wouldn't do this. This is no substitute for running a firewall and keeping your system patched. XP comes with a built-in firewall and it works very well, actually.

See Little Witch's thread on this for more discussion:

http://www.jehovahs-witness.com/6/58538/1.ashx

Anti-Hacker Advice - discuss, anyone?

Share this