NTL to block port 135
 

According to 'ntl' (Ashley Grossman) here, NTL are going to block port 135.

And about time too.

Re: NTL to block port 135
 

Why will it take them until the 24th October to complete that?

Yes such action should have been considered a long time ago, by many ISPs not just ntl when the blaster type virus became so rampant. Lets see whether this gives us a speed increas by getting rid of all that useless traffic.

But for those users who do have a legitimate use of port 135, will they have any ability to get ntl not to cut it off for them only?

Re: NTL to block port 135
 

Hmm ...

So...

Customer: errr, hi, I can't access my Exchange server and I think your blocking of port 135 is to blame.
tech: Yes sir, I can confirm that that is the case.
Customer: So, um, what can you do about it?
tech: I can confirm that's the case but that's about it....

Or are any techs about that can say they have been advised otherwise? Because Ashg's FAQs sound extremely unco-operative.

Re: NTL to block port 135
 

Towny, after reading about Ash G tonight I cant believe he wrote that FAQ at all I'd be surprised if he could write his own name!

Re: NTL to block port 135
 

Looks like you will have to use remote desktop client and/or outlook web access.

Have you tired UltraVNC yet ?

I know there are rafts joining the mailing list, I wondered what all the fuss was about with all these new subscribers now I realise its because of ISPs closing down 135.

Re: NTL to block port 135
 

As spoken like true a professional


I like my explanation better seen as nearly everyone including NTL have copied my original advice as I wrote is years ago

Re: NTL to block port 135
 

hmm port 135 has been blocked by plusnet since the outbreak of blaster (within like hours they e-mailed us saying it had been done)
The only thing that uses 135 is rpc which has been patched twice now and still hasnt been fixed.

If we wanted to have the port back open we could ask them and they can do it on a per customer basis as they have firewalls there end.

nice to see nthell are nice and speedy on this one :rollseyes:

K

Re: NTL to block port 135
 

I think that news item was only posted so AshG could assert his new "dominance" of .com.

Re: NTL to block port 135
 

Don't count on it. I know how it's being done and it isn't firewalls and it won't be switchable per person, unfortunately. Find another port if you really have to, but take it that 135 will be blocked *permanently*. With insecure software so widespread something has to be done to protect the majority from exploits.

Re: NTL to block port 135
 

For the uninitiated like me, what's the significance of blocking port 135?

Which programs use that port?

And if it is being used as a way of blocking viruses surely the virus makers wil merely re-direct their programs to find open ports which you are using that are unblocked.

Surely, if users have properly configured firewalls, anti- virus software and exercise common sense and caution the viruses will be kicked into touch.

Re: NTL to block port 135
 

M$ Exchange uses it, but Exchange is normally only found running within corporate networks so the blocking should have a minimal impact. Exchange is the example given in ntl's FAQs ... don't know what other apps might use it but the impression being given is 'not many at all'.

For sure they will, for such is the way of virus writers ... and such is the way of M$, that it prolly won't take long to find the next exploit. :rolleyes:

You hit the nail on the head. This is why viruses spread so easily. One of the biggest reasons why certain viruses and hacks work so well is that people don't apply patches for known problems or update their anti-virus software.

Re: NTL to block port 135
 

coming soon ....

http://news.bbc.co.uk/1/hi/technology/3196494.stm

Re: NTL to block port 135
 

So all those home wokers connecting to their works Exhange server for their email are buggered.

Re: NTL to block port 135
 

Yep, thats about it.

Re: NTL to block port 135
 

Here's a much better solution:

How about microsoft don't have the port open by default???

Re: NTL to block port 135
 

sounds like it. ntl strikes again.

Re: NTL to block port 135
 

Can the Exchange servers be configured to use another port ?

Re: NTL to block port 135
 

I presume the effect on exchange would not apply if you connect over a vpn tunnel??

Re: NTL to block port 135
 

Check out the 4 hotfixes in windows update yesterday :rolleyes:

Re: NTL to block port 135
 

AS long as the VPN is set up to use TCP/IP and remember that
VPN isnt "allowed" on residential NTL Services.

Read their AUP.


Also Windows 2K servers on which Exchange server sits needs RPC (Port 135) to function properly so although it can be protected it can t be actually "Closed".

http://www.microsoft.com/technet/sec...n/MS00-066.asp

"Would it be possible to prevent the attack by disabling the RPC service?

It is not practical to disable the RPC service on a Windows 2000 server. RPC is an integral part of the Operating System and many services will not function with RPC disabled."

Re: NTL to block port 135
 

Shouldn't think so, because your running the software there and not on your machine ;)

Re: NTL to block port 135
 

Well, don't you know it ... I'm a prophet as well ... ;)

Re: NTL to block port 135
 

yes Outlook Web Access (OWA ) on port 80


http://servername/exchange/mailboxname.


but its dodgy.....

(Port 80 connections into your server via a home user)

I would recommend any look at Exchange on W2K seriously consider these

http://www.securityfocus.com/infocus/1572

http://www.securityfocus.com/infocus/1578

Re: NTL to block port 135
 

?

Re: NTL to block port 135
 

*cough* post #12 *cough* :D

Re: NTL to block port 135
 

Sorry Gaz :o

Tiptoes, I've edited my post so it makes sense now :blush:


I'll get my coat! :dmonk:

Re: NTL to block port 135
 

np - it's these laminate floors, they make everything echo;):)

It'll be interesting to have a look at my router log when I get home to see how much difference this port blocking has made.

Re: NTL to block port 135
 

Bugga all so far!

Re: NTL to block port 135
 

THE AUP does allow VPN, they just do not support it!

Re: NTL to block port 135
 

I can't access my pipex dialup mailbox no more...

But it turns out that pipex's mailservers are borked, so it's not due to NTL blocking 135. I didn't think it would be, but it gave me a bad moment.

Re: NTL to block port 135
 

Exchange is a very small part of what 135 is used for - the significance for ntl (and other ISPs, and all internet users) is that it:

1) is left open by default on MS Windows installs
2) connects to parts of Windows that are prone to very serious bugs that can lead to machines being taken over.

This has led to it being used as a method of infecting Windows machines with viruses which cause degradation to service on the internet, which naturally ntl isn't too happy with (as it puts up the call rate and makes the customers very unhappy, and, contrary to public opinion, we like happy customers). So blocking it off *should*:

1) reduce the number of new infections, as your nice shiny new Windows install won't instantly get infected
2) reduce the number of hits on people's firewalls
3) give us some breathing space to get round to disinfecting everyone who's infected.

Re: NTL to block port 135
 

So when I suggested it and was shot down with people saying that it was a really stupid idea, I was in fact right.

If this is so why on earth was it not implemented earlier???

Re: NTL to block port 135
 

ummmmm take your pick of possible reasons, corporate stupidity, tightfistedness, shear incompetance are some that may just possibly make my top 10 list, especially as the vulnerability was known about and a patch available way back in june.

Re: NTL to block port 135
 

It is not a great idea because it will cut of some of microsoft's services (uncommonm though they maybe).

Mircosoft should never have left the port open in the first pace, they should have included the option of opening it only when necessary.

Although now I admit the best thing to do is probably Ntl block it.

Re: NTL to block port 135
 

Yay ,,, no more of those windows pop up messeages.


PS thanks Gaz for looking that up I just didnt have the time yesterday.....

I was going off what an earlier post said....

Has anyone here used or tried Outlook Web Access on Exchange Server to collect their mail?

Re: NTL to block port 135
 

yes, it works really well - no different really to using Outlook

Re: NTL to block port 135
 

I have to take issue with this. One of the main reasons it wasn't implemented earlier is that ntl wanted to continue to offer an unblocked service where all ports were available, however sadly it seems that however much one would like to offer this, the reality is that the service would be better for the majority if this port were blocked, as no matter how much education you do there are people out there who don't know how to (or can't) patch their machines before putting them on the network. Stopping them being infected is the main reason for this, with several thousand installs a week it should cut the infection rate a lot and we can get the CSRs back to dealing with day to day issues, not the consequences of Microsoft's built-in insecurity.

Re: NTL to block port 135
 

With all the practice they have had on writing operating systems you would think that Microsoft would actually get one right without the need for numerous patches.

One has to question whether such a product is of merchantable quality and asking if customers, retailers and wholesalers should be sending the products back to Microsoft with instructions to get them fixed.

It's ironic that the latest viruses have actually done more damage to Windows 2000 and Windows XP and that older products such as the Windowe 98SE which I have are more resistent. Is this an example of retrograde progression where as we move forward the products actually get worse?

Re: NTL to block port 135
 

If they actually got it right, we wouldnt need to upgrade, have firewalls, antivirus products etc and whole sections of industry would go into rapid decline. It seems sometimes that our society is actually based on being first to ship a shoddy product to the masses and then build whole support industries around it. A cynic's view I know, does seem to correlate with observation.

Re: NTL to block port 135
 

imo the pressure to produce the product to a deadline causes the mistakes. I bet there is some guy in a back room shouting "it is not ready" - and being ignored because the launch date has been "agreed" - classic triumph of marketing over common sense, I think:)

Re: NTL to block port 135
 

I think that you are right. I just wish they would complete the product correctly and give it good field trials and testing before launching it on the public. We are buying their products in the millions now and they are flawed. We'd probably buy a lot more if they worked properly.

Re: NTL to block port 135
 

They don't help themselves much though, I remember the Windows 2003 Server launch where the MS top brass trumpeted that it was written from the ground up with security in mind - can you say hostage to fortune? Needless to say, the first security hole followed shortly. Egg on the face all round.

2003 Server is a big improvement, though, in that practically anything interesting is turned off by default, which is a step forward. However, you won't see this on your own desktop for a bit, so XP SP2 is the next big upgrade, lets see what's in that from a security perspective.

Win2k/XP are being targetted now as they're getting more and more common (XP's been out nearly two years, so most modern PCs will be running it). Certainly anyone buying a new P4 PC (you need a P4 to make the internet work right, of course*) to connect to their new BB connection will have XP on it, and probably get infected straight off.

ntluser - the sad thing is that we'll fill the pockets of these guys whether or not they get it right, that's what they bank on. Going Open Source will really worry them though.

* this is irony

Re: NTL to block port 135
 

Well it seems to be working - no attacks on port 135 logged since 3 am this morning - up till then it was one every couple of minutes or so. :)

Re: NTL to block port 135
 

Am I right in thinking that even with appropriate firewalls and anti-virus software, users with Windows 2000 & XP will still get infected?

It's just that I'm hoping to get a new PC early next year and before I connect I'd be installing my present firewall set-up. I'd be a bit narked if having set up my defences ( which work brilliantly on my current dated Windows 98 PC) the virus walks right through them because of a security vulnerability in the proposed operating system (XP professional).

It will be interesting to see what the effect of going open source is but given the number of vulnerabilities one does wonder just how good the code is.

But you are right we have paid and will no doubt continue to pay for below par programs. Shame that you can't pay in a currency which diminishes in value every time a patch is issued. ;)

They'd probably end up paying us money!!

Re: NTL to block port 135
 

Well I have McAffee SecurityCenter - and no problems so far - and running Windoze XP Home too!

(Fingers crossed it stays that way......;) )

Re: NTL to block port 135
 

MS OSes are like those net shopping bags your gran used get her veg in fromt the Fruit and Veg Shop.

The bags arent any different they are just bigger bags where the holes are porportional to the weight of twine used.

Re: NTL to block port 135
 

Using the same analogy i.e. that the products are full of holes it's a pity that we cannot return the favour and pay for them with metal washers!! ;)

Re: NTL to block port 135
 

Seems to be working here too - but watch out port 445, you're next!

Code:

---

Thu, 23 Oct 2003 04:53:44 GMT+0100 Unrecognized access from 200.68.76.177:1025 to UDP port 137
Thu, 23 Oct 2003 04:58:48 GMT+0100 Unrecognized access from 81.97.107.26:1092 to TCP port 445
Thu, 23 Oct 2003 04:58:51 GMT+0100 Unrecognized access from 81.97.107.26:1092 to TCP port 445
Thu, 23 Oct 2003 05:07:25 GMT+0100 Unrecognized access from 200.60.238.60:1032 to UDP port 137
Thu, 23 Oct 2003 05:07:31 GMT+0100 Unrecognized access from 81.97.156.106:4540 to TCP port 445
Thu, 23 Oct 2003 05:07:34 GMT+0100 Unrecognized access from 81.97.156.106:4540 to TCP port 445
Thu, 23 Oct 2003 05:15:59 GMT+0100 Unrecognized access from 81.97.107.26:1264 to TCP port 445
Thu, 23 Oct 2003 05:16:02 GMT+0100 Unrecognized access from 81.97.107.26:1264 to TCP port 445
Thu, 23 Oct 2003 06:31:19 GMT+0100 Unrecognized access from 193.220.44.181:4088 to TCP port 445
Thu, 23 Oct 2003 06:31:22 GMT+0100 Unrecognized access from 193.220.44.181:4088 to TCP port 445
Thu, 23 Oct 2003 06:44:44 GMT+0100 Unrecognized access from 210.65.54.89:1026 to UDP port 137
Thu, 23 Oct 2003 06:50:57 GMT+0100 Unrecognized access from 80.202.112.9:52590 to UDP port 137
Thu, 23 Oct 2003 06:59:37 GMT+0100 Unrecognized access from 218.165.53.131:61750 to UDP port 137
Thu, 23 Oct 2003 07:02:47 GMT+0100 Unrecognized access from 61.228.49.60:1027 to UDP port 137
Thu, 23 Oct 2003 07:21:42 GMT+0100 Unrecognized access from 81.97.182.63:2165 to TCP port 445
Thu, 23 Oct 2003 07:21:45 GMT+0100 Unrecognized access from 81.97.182.63:2165 to TCP port 445
Thu, 23 Oct 2003 07:26:19 GMT+0100 Unrecognized access from 213.77.140.212:1032 to UDP port 137
Thu, 23 Oct 2003 07:45:03 GMT+0100 Unrecognized access from 218.21.136.129:1028 to UDP port 137
Thu, 23 Oct 2003 07:54:03 GMT+0100 Unrecognized access from 81.97.85.15:1183 to TCP port 445
Thu, 23 Oct 2003 07:54:06 GMT+0100 Unrecognized access from 81.97.85.15:1183 to TCP port 445
Thu, 23 Oct 2003 08:04:18 GMT+0100 Unrecognized access from 81.97.182.63:2986 to TCP port 445
Thu, 23 Oct 2003 08:04:21 GMT+0100 Unrecognized access from 81.97.182.63:2986 to TCP port 445

---

Re: NTL to block port 135
 

Nope. Port 445 is used for https and so it can't be blocked.

Re: NTL to block port 135
 

137 netbios scan

Re: NTL to block port 135
 

HTTPS is 443, not 445.

Also, how many people run HTTPS on their PCs?

Re: NTL to block port 135
 

The Ip addy of one of those listed belongs to
-------------------------------------------------
inetnum: 81.97.0.0 - 81.97.191.255
netname: NTL
descr: NTL Standalone CM - Baguley
country: GB
admin-c: NNMC1-RIPE
tech-c: NNMC1-RIPE
status: ASSIGNED PA
mnt-by: AS5089-MNT
changed: hostmaster@ntli.net 20020731
source: RIPE

route: 81.96.0.0/12
descr: NTL-UK-IP-BLOCK
origin: AS5089
mnt-by: AS5089-MNT
changed: hostmaster@ntli.net 20020614
source: RIPE

role: NTLI Network Management Centre
address: NTL Internet
address: Crawley Court
address: Winchester
address: Hampshire
address: SO21 2QA
trouble: ----------------------------------------------


Can someone confirm this is one of NTLs OWN Servers>?

It appears to be running with the following ports open

25
110
113
139
445
1025 ****

***Basically the Win2K server on the NTL network could be infected with any number of trojans using this port, "always open" to spread itself via the SMB over TCP.

There is only one reason the server would need to use 445 was if it was trying to conect to other PC systems.

Win2K does use 1025 for the Distributed Transaction Coordinator service which is enabled by default on a Windows
2000 server But it opens TCP port 3372, and a single TCP port higher than 1023 (ie likely to be 1025 ).

I scanned all ports up to 6000 (Using another ISP) and 3372 isnt open so it may not be that particular service.

So based on the scan I did my conclusion is it is likely to be infected.

Re: NTL to block port 135
 

Just checked the RDNS and it seems to be an NTL customer in Runcorn.

Re: NTL to block port 135
 

That range is rather large for our own servers (which tend to be Solaris/Linux in the main).

It's actually a superset of ranges used for the standalone cable modem service in the North West, so having a customer from Runcorn on it is quite possible. Here's hoping he drops into the Walled Garden soon.

Re: NTL to block port 135
 

The other 81... ip is from stretford

I checked The IP range and realised they were Linux servers from some weblogs I picked up on.

Re: NTL to block port 135
 

Well, the 135 scans have died down, now I have a rash of 137 and several 445 hits. It makes a nice change that the large number of 137's are from all over the world, not just Ntl IP's.

Re: NTL to block port 135
 

The only concern I've got is not NTL blocking a specific port, but once they start with one port, they could start blocking others. I'd rather NTL retained their "no blocking" policy (though I'd also like it if they stopped using transparent web proxies... or at least fix them).

As for port 135, well okay, there are ways around it and if it's only used for Exchange then just use VPN. Any corporate with any sense wouldn't open it to the outside world without tunnelling using VPN or SSH anyway.

VPN is "allowed" on NTL... or at least it's not disallowed. It's just not supported. All the AUP says is that NTL reserve the right to stop you using it if it causes network problems. I'm not aware that VPN could cause them problems (no where near as many as all these worms and P2P software).

Blocking port 135 is a short term solution as the hackers move on to other ports.

I don't think NTL should do anything and just leave it up to the users to get firewalls and Microsoft to patch things up and educate their users. If NTL really want to do something, maybe they should buy firewalls for their customers (Barclays did that for a while).

Unix is not invulnerable either. There's a flaw (one of many) in many linux router kernels open to ICMP attacks. Being routers they're often forgotten about.

The real solution to all this is to prosecute the hackers.

Re: NTL to block port 135
 

Ah, it must just be my firewall that uses 445 for https. However, if NTL started blocking other ports, it wouldn't just stop connections into your machine - it would also block connections out of your machine.

Re: NTL to block port 135
 

Sorry to resurect an old thread but...

Is port blocking still implemented?

On which ports?

Where is the block (incomming, outgoing, whatever)?

Re: NTL to block port 135
 

Yes it is. The ports being blocked (inbound only) are:

• 137 (UDP)
• 138 (UDP)
• 139 (TCP)
• 445 (UDP & TCP)
• 593 (TCP)
• 1433 (TCP)
• 1434 (UDP)
• 27374 (TCP)

Data on these ports is blocked by the Cable Modem. HTH!

Re: NTL to block port 135
 

In the case of TCP it is only incoming SYN requests that are being blocked so you can establish outgoing connections ok (which should allow you to use exchange ok) - oh, and Jimbo has actually missed port 135 (TCP) from the above list ;)

Re: NTL to block port 135
 

Oops, so I did!

Re: NTL to block port 135
 

81 is North west.
mine is 81.97... etc

Stockport in manchester

Re: NTL to block port 135
 

:confused:

Re: NTL to block port 135
 

NTL have a block of addresses starting with 81 (.96 to .111 IIRC) but it definitely isn't limited to the North-West - we just happened to add a load of new addressing in that area while working through that range.

81.97 is, however, entirely in the NW, from Burnley to Stoke, Birkenhead to Ashton.

Re: NTL to block port 135
 

Wouldnt that destroy SMB?

Re: NTL to block port 135
 

I don't see why. If you are know how to use SMB you know how to open the port.

Same thing with their messenger service.

Re: NTL to block port 135
 

Port 135 is not SMB, it is the RPC service which is an integral part of the OS. :cool:

It would be a bit like saying you could stop people hacking into a web server by not opening port 80 on it :D

Re: NTL to block port 135
 

Have you ever tried reconfiguring SMB in Windows to use another port? It doesnt work like that. My point is, you cant just go blocking off ports within the operating system, other applications can make use of them too.