NTL to block port 135

[BBKing]

For the uninitiated like me, what's the significance of blocking port 135?

Which programs use that port?

Exchange is a very small part of what 135 is used for - the significance for ntl (and other ISPs, and all internet users) is that it:

1) is left open by default on MS Windows installs
2) connects to parts of Windows that are prone to very serious bugs that can lead to machines being taken over.

This has led to it being used as a method of infecting Windows machines with viruses which cause degradation to service on the internet, which naturally ntl isn't too happy with (as it puts up the call rate and makes the customers very unhappy, and, contrary to public opinion, we like happy customers). So blocking it off *should*:

1) reduce the number of new infections, as your nice shiny new Windows install won't instantly get infected
2) reduce the number of hits on people's firewalls
3) give us some breathing space to get round to disinfecting everyone who's infected.

[Shaun]

Originally Posted by BBKing

Exchange is a very small part of what 135 is used for - the significance for ntl (and other ISPs, and all internet users) is that it:

1) is left open by default on MS Windows installs
2) connects to parts of Windows that are prone to very serious bugs that can lead to machines being taken over.

This has led to it being used as a method of infecting Windows machines with viruses which cause degradation to service on the internet, which naturally ntl isn't too happy with (as it puts up the call rate and makes the customers very unhappy, and, contrary to public opinion, we like happy customers). So blocking it off *should*:

1) reduce the number of new infections, as your nice shiny new Windows install won't instantly get infected
2) reduce the number of hits on people's firewalls
3) give us some breathing space to get round to disinfecting everyone who's infected.

So when I suggested it and was shot down with people saying that it was a really stupid idea, I was in fact right.

If this is so why on earth was it not implemented earlier???

[MetaWraith]

ummmmm take your pick of possible reasons, corporate stupidity, tightfistedness, shear incompetance are some that may just possibly make my top 10 list, especially as the vulnerability was known about and a patch available way back in june.

[downquark1]

Originally Posted by dellwear

So when I suggested it and was shot down with people saying that it was a really stupid idea, I was in fact right.

If this is so why on earth was it not implemented earlier???

It is not a great idea because it will cut of some of microsoft's services (uncommonm though they maybe).

Mircosoft should never have left the port open in the first pace, they should have included the option of opening it only when necessary.

Although now I admit the best thing to do is probably Ntl block it.

[Tiptoes]

Originally Posted by downquark1

It is not a great idea because it will cut of some of microsoft's services (uncommonm though they maybe).

Mircosoft should never have left the port open in the first pace, they should have included the option of opening it only when necessary.

Although now I admit the best thing to do is probably Ntl block it.

Yay ,,, no more of those windows pop up messeages.


PS thanks Gaz for looking that up I just didnt have the time yesterday.....

I was going off what an earlier post said....

Has anyone here used or tried Outlook Web Access on Exchange Server to collect their mail?

[garyeuph]

Originally Posted by Tiptoes

Yay ,,, no more of those windows pop up messeages.


PS thanks Gaz for looking that up I just didnt have the time yesterday.....

I was going off what an earlier post said....

Has anyone here used or tried Outlook Web Access on Exchange Server to collect their mail?

yes, it works really well - no different really to using Outlook

[BBKing]

corporate stupidity, tightfistedness, shear incompetance

I have to take issue with this. One of the main reasons it wasn't implemented earlier is that ntl wanted to continue to offer an unblocked service where all ports were available, however sadly it seems that however much one would like to offer this, the reality is that the service would be better for the majority if this port were blocked, as no matter how much education you do there are people out there who don't know how to (or can't) patch their machines before putting them on the network. Stopping them being infected is the main reason for this, with several thousand installs a week it should cut the infection rate a lot and we can get the CSRs back to dealing with day to day issues, not the consequences of Microsoft's built-in insecurity.

[ntluser]

Originally Posted by BBKing

I have to take issue with this. One of the main reasons it wasn't implemented earlier is that ntl wanted to continue to offer an unblocked service where all ports were available, however sadly it seems that however much one would like to offer this, the reality is that the service would be better for the majority if this port were blocked, as no matter how much education you do there are people out there who don't know how to (or can't) patch their machines before putting them on the network. Stopping them being infected is the main reason for this, with several thousand installs a week it should cut the infection rate a lot and we can get the CSRs back to dealing with day to day issues, not the consequences of Microsoft's built-in insecurity.

With all the practice they have had on writing operating systems you would think that Microsoft would actually get one right without the need for numerous patches.

One has to question whether such a product is of merchantable quality and asking if customers, retailers and wholesalers should be sending the products back to Microsoft with instructions to get them fixed.

It's ironic that the latest viruses have actually done more damage to Windows 2000 and Windows XP and that older products such as the Windowe 98SE which I have are more resistent. Is this an example of retrograde progression where as we move forward the products actually get worse?

[MetaWraith]

If they actually got it right, we wouldnt need to upgrade, have firewalls, antivirus products etc and whole sections of industry would go into rapid decline. It seems sometimes that our society is actually based on being first to ship a shoddy product to the masses and then build whole support industries around it. A cynic's view I know, does seem to correlate with observation.

Originally Posted by MetaWraith

If they actually got it right, we wouldnt need to upgrade, have firewalls, antivirus products etc and whole sections of industry would go into rapid decline. It seems sometimes that our society is actually based on being first to ship a shoddy product to the masses and then build whole support industries around it. A cynic's view I know, does seem to correlate with observation.

imo the pressure to produce the product to a deadline causes the mistakes. I bet there is some guy in a back room shouting "it is not ready" - and being ignored because the launch date has been "agreed" - classic triumph of marketing over common sense, I think

[ntluser]

Originally Posted by homealone

imo the pressure to produce the product to a deadline causes the mistakes. I bet there is some guy in a back room shouting "it is not ready" - and being ignored because the launch date has been "agreed" - classic triumph of marketing over common sense, I think

I think that you are right. I just wish they would complete the product correctly and give it good field trials and testing before launching it on the public. We are buying their products in the millions now and they are flawed. We'd probably buy a lot more if they worked properly.

[BBKing]

They don't help themselves much though, I remember the Windows 2003 Server launch where the MS top brass trumpeted that it was written from the ground up with security in mind - can you say hostage to fortune? Needless to say, the first security hole followed shortly. Egg on the face all round.

2003 Server is a big improvement, though, in that practically anything interesting is turned off by default, which is a step forward. However, you won't see this on your own desktop for a bit, so XP SP2 is the next big upgrade, lets see what's in that from a security perspective.

Win2k/XP are being targetted now as they're getting more and more common (XP's been out nearly two years, so most modern PCs will be running it). Certainly anyone buying a new P4 PC (you need a P4 to make the internet work right, of course*) to connect to their new BB connection will have XP on it, and probably get infected straight off.

ntluser - the sad thing is that we'll fill the pockets of these guys whether or not they get it right, that's what they bank on. Going Open Source will really worry them though.

* this is irony

[Chimaera]

Well it seems to be working - no attacks on port 135 logged since 3 am this morning - up till then it was one every couple of minutes or so.

[ntluser]

Originally Posted by BBKing

They don't help themselves much though, I remember the Windows 2003 Server launch where the MS top brass trumpeted that it was written from the ground up with security in mind - can you say hostage to fortune? Needless to say, the first security hole followed shortly. Egg on the face all round.

2003 Server is a big improvement, though, in that practically anything interesting is turned off by default, which is a step forward. However, you won't see this on your own desktop for a bit, so XP SP2 is the next big upgrade, lets see what's in that from a security perspective.

Win2k/XP are being targetted now as they're getting more and more common (XP's been out nearly two years, so most modern PCs will be running it). Certainly anyone buying a new P4 PC (you need a P4 to make the internet work right, of course*) to connect to their new BB connection will have XP on it, and probably get infected straight off.

ntluser - the sad thing is that we'll fill the pockets of these guys whether or not they get it right, that's what they bank on. Going Open Source will really worry them though.

* this is irony

Am I right in thinking that even with appropriate firewalls and anti-virus software, users with Windows 2000 & XP will still get infected?

It's just that I'm hoping to get a new PC early next year and before I connect I'd be installing my present firewall set-up. I'd be a bit narked if having set up my defences ( which work brilliantly on my current dated Windows 98 PC) the virus walks right through them because of a security vulnerability in the proposed operating system (XP professional).

It will be interesting to see what the effect of going open source is but given the number of vulnerabilities one does wonder just how good the code is.

But you are right we have paid and will no doubt continue to pay for below par programs. Shame that you can't pay in a currency which diminishes in value every time a patch is issued.

They'd probably end up paying us money!!

[Chimaera]

Well I have McAffee SecurityCenter - and no problems so far - and running Windoze XP Home too!

(Fingers crossed it stays that way...... )