NTL to block port 135

[Tiptoes]

Originally Posted by ntluser

With all the practice they have had on writing operating systems you would think that Microsoft would actually get one right without the need for numerous patches.

One has to question whether such a product is of merchantable quality and asking if customers, retailers and wholesalers should be sending the products back to Microsoft with instructions to get them fixed.

It's ironic that the latest viruses have actually done more damage to Windows 2000 and Windows XP and that older products such as the Windowe 98SE which I have are more resistent. Is this an example of retrograde progression where as we move forward the products actually get worse?

MS OSes are like those net shopping bags your gran used get her veg in fromt the Fruit and Veg Shop.

The bags arent any different they are just bigger bags where the holes are porportional to the weight of twine used.

[ntluser]

Originally Posted by Tiptoes

MS OSes are like those net shopping bags your gran used get her veg in fromt the Fruit and Veg Shop.

The bags arent any different they are just bigger bags where the holes are porportional to the weight of twine used.

Using the same analogy i.e. that the products are full of holes it's a pity that we cannot return the favour and pay for them with metal washers!!

[altis]

Seems to be working here too - but watch out port 445, you're next!

Thu, 23 Oct 2003 04:53:44 GMT+0100 Unrecognized access from 200.68.76.177:1025 to UDP port 137
Thu, 23 Oct 2003 04:58:48 GMT+0100 Unrecognized access from 81.97.107.26:1092 to TCP port 445
Thu, 23 Oct 2003 04:58:51 GMT+0100 Unrecognized access from 81.97.107.26:1092 to TCP port 445
Thu, 23 Oct 2003 05:07:25 GMT+0100 Unrecognized access from 200.60.238.60:1032 to UDP port 137
Thu, 23 Oct 2003 05:07:31 GMT+0100 Unrecognized access from 81.97.156.106:4540 to TCP port 445
Thu, 23 Oct 2003 05:07:34 GMT+0100 Unrecognized access from 81.97.156.106:4540 to TCP port 445
Thu, 23 Oct 2003 05:15:59 GMT+0100 Unrecognized access from 81.97.107.26:1264 to TCP port 445
Thu, 23 Oct 2003 05:16:02 GMT+0100 Unrecognized access from 81.97.107.26:1264 to TCP port 445
Thu, 23 Oct 2003 06:31:19 GMT+0100 Unrecognized access from 193.220.44.181:4088 to TCP port 445
Thu, 23 Oct 2003 06:31:22 GMT+0100 Unrecognized access from 193.220.44.181:4088 to TCP port 445
Thu, 23 Oct 2003 06:44:44 GMT+0100 Unrecognized access from 210.65.54.89:1026 to UDP port 137
Thu, 23 Oct 2003 06:50:57 GMT+0100 Unrecognized access from 80.202.112.9:52590 to UDP port 137
Thu, 23 Oct 2003 06:59:37 GMT+0100 Unrecognized access from 218.165.53.131:61750 to UDP port 137
Thu, 23 Oct 2003 07:02:47 GMT+0100 Unrecognized access from 61.228.49.60:1027 to UDP port 137
Thu, 23 Oct 2003 07:21:42 GMT+0100 Unrecognized access from 81.97.182.63:2165 to TCP port 445
Thu, 23 Oct 2003 07:21:45 GMT+0100 Unrecognized access from 81.97.182.63:2165 to TCP port 445
Thu, 23 Oct 2003 07:26:19 GMT+0100 Unrecognized access from 213.77.140.212:1032 to UDP port 137
Thu, 23 Oct 2003 07:45:03 GMT+0100 Unrecognized access from 218.21.136.129:1028 to UDP port 137
Thu, 23 Oct 2003 07:54:03 GMT+0100 Unrecognized access from 81.97.85.15:1183 to TCP port 445
Thu, 23 Oct 2003 07:54:06 GMT+0100 Unrecognized access from 81.97.85.15:1183 to TCP port 445
Thu, 23 Oct 2003 08:04:18 GMT+0100 Unrecognized access from 81.97.182.63:2986 to TCP port 445
Thu, 23 Oct 2003 08:04:21 GMT+0100 Unrecognized access from 81.97.182.63:2986 to TCP port 445

[duncant403]

Originally Posted by altis

Seems to be working here too - but watch out port 445, you're next!

Nope. Port 445 is used for https and so it can't be blocked.

[Tiptoes]

137 netbios scan

[BBKing]

HTTPS is 443, not 445.

Also, how many people run HTTPS on their PCs?

[Tiptoes]

Originally Posted by BBKing

HTTPS is 443, not 445.

Also, how many people run HTTPS on their PCs?

The Ip addy of one of those listed belongs to
-------------------------------------------------
inetnum: 81.97.0.0 - 81.97.191.255
netname: NTL
descr: NTL Standalone CM - Baguley
country: GB
admin-c: NNMC1-RIPE
tech-c: NNMC1-RIPE
status: ASSIGNED PA
mnt-by: AS5089-MNT
changed: hostmaster@ntli.net 20020731
source: RIPE

route: 81.96.0.0/12
descr: NTL-UK-IP-BLOCK
origin: AS5089
mnt-by: AS5089-MNT
changed: hostmaster@ntli.net 20020614
source: RIPE

role: NTLI Network Management Centre
address: NTL Internet
address: Crawley Court
address: Winchester
address: Hampshire
address: SO21 2QA
trouble: ----------------------------------------------


Can someone confirm this is one of NTLs OWN Servers>?

It appears to be running with the following ports open

25
110
113
139
445
1025 ****

***Basically the Win2K server on the NTL network could be infected with any number of trojans using this port, "always open" to spread itself via the SMB over TCP.

There is only one reason the server would need to use 445 was if it was trying to conect to other PC systems.

Win2K does use 1025 for the Distributed Transaction Coordinator service which is enabled by default on a Windows
2000 server But it opens TCP port 3372, and a single TCP port higher than 1023 (ie likely to be 1025 ).

I scanned all ports up to 6000 (Using another ISP) and 3372 isnt open so it may not be that particular service.

So based on the scan I did my conclusion is it is likely to be infected.

[Tiptoes]

Just checked the RDNS and it seems to be an NTL customer in Runcorn.

[BBKing]

That range is rather large for our own servers (which tend to be Solaris/Linux in the main).

It's actually a superset of ranges used for the standalone cable modem service in the North West, so having a customer from Runcorn on it is quite possible. Here's hoping he drops into the Walled Garden soon.

[Tiptoes]

The other 81... ip is from stretford

I checked The IP range and realised they were Linux servers from some weblogs I picked up on.

[iadom]

Well, the 135 scans have died down, now I have a rash of 137 and several 445 hits. It makes a nice change that the large number of 137's are from all over the world, not just Ntl IP's.

[DeadKenny]

The only concern I've got is not NTL blocking a specific port, but once they start with one port, they could start blocking others. I'd rather NTL retained their "no blocking" policy (though I'd also like it if they stopped using transparent web proxies... or at least fix them).

As for port 135, well okay, there are ways around it and if it's only used for Exchange then just use VPN. Any corporate with any sense wouldn't open it to the outside world without tunnelling using VPN or SSH anyway.

VPN is "allowed" on NTL... or at least it's not disallowed. It's just not supported. All the AUP says is that NTL reserve the right to stop you using it if it causes network problems. I'm not aware that VPN could cause them problems (no where near as many as all these worms and P2P software).

Blocking port 135 is a short term solution as the hackers move on to other ports.

I don't think NTL should do anything and just leave it up to the users to get firewalls and Microsoft to patch things up and educate their users. If NTL really want to do something, maybe they should buy firewalls for their customers (Barclays did that for a while).

Unix is not invulnerable either. There's a flaw (one of many) in many linux router kernels open to ICMP attacks. Being routers they're often forgotten about.

The real solution to all this is to prosecute the hackers.

[duncant403]

Originally Posted by BBKing

HTTPS is 443, not 445.

Also, how many people run HTTPS on their PCs?

Ah, it must just be my firewall that uses 445 for https. However, if NTL started blocking other ports, it wouldn't just stop connections into your machine - it would also block connections out of your machine.

[altis]

Sorry to resurect an old thread but...

Is port blocking still implemented?

On which ports?

Where is the block (incomming, outgoing, whatever)?

[quadplay]

Yes it is. The ports being blocked (inbound only) are:

• 137 (UDP)
• 138 (UDP)
• 139 (TCP)
• 445 (UDP & TCP)
• 593 (TCP)
• 1433 (TCP)
• 1434 (UDP)
• 27374 (TCP)

Data on these ports is blocked by the Cable Modem. HTH!