c. Security Options

This section of the local security settings contains a great deal of very important security settings. However, this section shows some settings very differently between Windows 2000 and Windows XP so I will attempt to point out the differences. The settings here become even more important if you are using Windows file sharing (SMB) or are a member of a domain.

The first policy here we should discuss is accounts: rename administrator account. This policy allows you to change the name of the primary account on the computer that normally has the login name of "Administrator". When crackers or worms attempt to access a computer they begin by trying several well known account types, the first of which is administrator. If they know the account to be administrator then half the puzzle is solve and they just need to figure out the password. Therefore for security reasons I would recommend renaming this account. You can either do it here or from the user account manager (start menu, run, lusrmgr.msc, okay on either Windows 2000 or Windows XP Professional). When an account that has a profile (normally these are stored in C:\Documents and Settings and contain all the users settings, my documents, etc.) is renamed it retains the same profile path but the username to login changes. This can be remedied by deleting the profile directory for that user when logged in as another user. Remember that if you delete the user's profile directory that all files and registry values for that user will be lost. The way to back it up is through User Profiles's Copy To ability, but I would only recommend this if you know what you're doing. From a remote perspective though it is a good idea just to disable this account and use a different account you've created as an administrator as the internal ID of the primary account is always the same.

The second policy here we should discuss is accounts: rename guest account. This policy works the same way as the last policy, but renames the guest account rather than the administrator account. By default on Windows the guest account is disabled. The guest account has several different abilities. If given permission to access over a network and is enabled (by default it is denied access over the network and the account itself is disabled) then it will give anonymous access to the computer over a network if no password is given to it and blank passwords are allowed for remote access. If given a password then it acts like an account with a password for remote access. This is useful for Windows 9x (95, 98, Me) remote access as they generally authenticate as guest unless given a strict username to login with. If used as a local account and is granted local login privileges it acts like a normal user (same as if a user is added only to the guests group). When a guest user logs out locally their account profile will not be saved and this is very useful for computer lab setups. Also, both locally and remotely the guest permissions are the same as a normal user. Normally this account is fine to just leave disabled and not worry about it.

The third policy under security options that I will cover is network access: allow anonymous SID/Name translation. When enabled this would allow an anonymous user (a user that hasn't yet authenticated with a correct username and password combination) to find the name of a user from a SID or a SID from a name. A SID is a security identifier that represents the internal method of referring to a user. This allows you to make references to a user, then rename the user and leave the original pointers to the user intact, because they referred to the internal SID rather than the external descriptor name. Allowing the translation of SIDs to names and vice versa could potentially compromise a bit of security, so this should be disabled on non-servers. For a list of the SIDs that exist in all versions of Windows please see this Microsoft page.

The fourth policy and fifth policies we will discuss under this section are do not allow anonymous enumeration of SAM accounts and do not allow anonymous enumeration of SAM accounts and shares. From the names of the policies you should have figured out that they are both the same except that the second of the two restricts accounts as well as shares. What both of these restrict is anonymous connections to the Windows IPC$ share. On a safe network it is quite useful to be able to connect to a remote computer and tell what file shares exist on that computer. It also could be useful to detect what user accounts exist on a remote computer. The listing of these resources is called enumeration and on an insecure network this could be a security risk. If an anonymous (non authenticated) user is able to list off the users that exist on a computer then they just need to crack the password for that user to gain access to the resources that the user is able to access, if that user is allowed remote access at all. Likewise, if a cracker is able to list the shares they may gain a reason to try and break into those shares. These policies do not apply for authenticated users so under normal circumstances you will want to enable both of these policies. In the very least you will want the first enabled as there are few reasons to have user account (SAM) enumeration on.

The fifth important policy here is network access: sharing and security model for local accounts. This policy has two options, the first for classic and the second as guest. Classic is the way Windows NT was designed to run with each created account able to remotely connect to the work with their username and password. The second method was introduced in Windows XP to simplify the complicated security model that Windows 9x (95, 98, Me) users were not comfortable with (also called simple file sharing). This makes it so when users connect they remotely register as the Guest account, which makes it much easier for 9x to interface with. In any event this is up to you which mode you wish to use. The classic mode is much more secure, but the guest method could be considered easier as you don't need to fiddle with user permissions on file shares. If you don't wish to use Windows file sharing then I would recommend setting it to classic and then removing all user rights to access the computer over a network.

The fifth policy we will discuss is network security: do not store LAN Manager hash value on next password change. This policy connects well with the issues brought up in section 2 for passwords. Internally Windows NT4, 2000 and XP store their passwords what is called NTLM (NT Lan Manager) that is a security model that Microsoft created for its corporate users. Microsoft never expected the average user to need network access, especially nothing to scale with the Internet. Because of this Windows 9x stored its passwords in an inferior format that was very insecure and easily cracked. Since Windows 9x did not use username and passwords for local usage, and only for network access, it didn't need to store the network passwords since shares on 9x used static passwords. So, network passwords were stored in .PWL files that were cached on logging in.

For network access Windows 9x also used an inferior authentication scheme called LM (notice the lack of NT on its name) that lacked case sensitivity, had a maximum length of 14 characters, and used an inferior algorithm. Microsoft considered this sufficient for the limited networking that Windows 9x would receive, or at least should. However, Microsoft believed that Windows 9x needed the ability to access Windows NT shares and so they used the LM password hashes to authenticate with. Like the old saying goes, something is only as strong as its weakest component and this is no different. Also the LM hash a problem where it divides the password into 7 character segments, which presents a large security risk (for reasons discussed earlier in the passwords section). But, if you do not need compatibility with Windows 9x then there is no reason to store this less secure password hash.

This fixes a large problem with Windows password cracking and makes it take a great deal longer to crack passwords greater than 7 characters, and benefits passwords of all lengths due to case sensitivity. By enabling this policy and changing all passwords on the active system for each user (this will remove all cached LM hashes) you will have taken a large step in securing your machine. However, if you aren't worried about people cracking your Windows password (like if you have none) and if you don't use networking (and have disabled remote connections) then this policy will make no difference to you. Also be aware that setting a user's password larger than 14 characters will cause Windows not to store a LM hash.

The sixth policy that I will cover under security options is network security: LAN Manager authentication level. This policy has several options including send LM & NTLM responses, send LM & NTLM responses - use NTLMv2 session security if negotiated, send NTLM response only, send NTLMv2 response only, send NTLMv2 response only\refuse LM, send NTLMv2 response only\refuse LM & NTLM. As discussed previously LM and NTLM are password hashes, and this policy allows you to select which policy you would like to use in the handshake (handshake being the authentication mechanism) between the server and the client. LM is the weakest of the password hashes and NTLM and for the password only contains upper case letters, numbers, punctuation marks and 32 other symbols, and breaks passwords into 7 segment chunks for a maximum length of 14 characters. NTLM fixes the problem of length and segmentation and NTLMv2 increases the encryption to 128bit. Therefore, you should use only NTLMv2 whenever possible. However, only NT4, 2000 and XP support NTLMv2 (or NTLM for that matter). So, use the scheme that fits you the best. I would recommend setting this policy to use send LM & NTLM responses - use NTLMv2 session security if negotiated unless you have reasons otherwise. This would use LM or NTLM only as fallbacks if NTLMv2 isn't available on the other computer.

Return to top.

 

5. Running as a Limited Administrator

On a Windows machine there are a number of default permission groups built into the operating system. The regular type of account on a Windows NT (NT4, 2000, XP) based machine falls under the group title of user. This type of account has limited access to the computer and cannot install programs, uninstall programs, change system policies, start or stop system services, add new users, etc. but is able to run programs that aren't disallowed. Another group exists called guest and this is a special form of a user. A guest is a user that is unable to make any permanent changes to a system. Any changes that user with group access makes is discarded after the guest user logs off. The controlling group of these is called the administrator. This group is allowed to do most anything on the computer. The first user created on a Windows NT based machine is a permanent administrator, and this user cannot be deleted (although it can be renamed or disabled from the default name of Administrator). When installing Windows XP all users created from the initial setup will also be given administrator privileges. A group between user and administrator exists and is called a power user. This group is a hybrid admin-user and has the ability to install programs but does not have the ability to override any administrators or create administrator users. If you are using Windows XP Home edition then your account groups are slightly different and only offer a variation on administrator and on user.

Most users that run Windows run it as an administrator, which means that Windows doesn't limit what they can do from a local security standpoint. This is both good and bad. Good because you're free to use your computer without limitation, and bad because any program you run equally has the same freewill as you do. This means that when you run a program, it could potentially wipe all the files on your hard-drive or add files to the system startup behind your back. Everyone running as administrator is one of the reasons that spyware, adware and viruses run so rampant, because one wrong execution and you're completely infected and your computer is actively trying to infect others. Yet, if you were running as a user when you accidentally ran that email attachment that you thought came from a friend, but really came from an Internet worm, the program wouldn't be able to overwrite system files, start itself automatically on the next reboot, or to wipe your hard-drive clean. The problem here is that few people wish to run as a user because it limits them so much.

However, there is a cure. On *nix (this includes all Unix operating systems and Linux distributions) you almost never run as root (this is the *nix version of administrator). There is a great deal of reasons why this is so, and I won't go into detail about *nix security. But, if everyone only has user accounts then how do they install things? Well, the first answer is they don't unless they're the maintainer of the computer, and even then root normally doesn't log in (especially since most *nix logins are done remotely). A command called SU, which means super user or switch user ... depending on the usage) allows you to take on the identity of any other user on the system. So, you could log into your account and then use this command to take on the identity of the root account, giving you the ability to then do whatever you wish. This makes it so you install only what you want to install. You might be thinking that sounds like a pain, but the security benefits reaped from this is great. The first is that things do not get installed without your permission. The second is the less apparent though. Not using root means less computers are vulnerable to attack because of user error, which means less computers are compromised, which means worms and trojans for *nix are very few and far between.

Or you might be wishing such an ability existed in Windows. If so, you're in luck... it does. Microsoft's version of SU is entitled Run As. This ability exists due to a system service called secondary logon, and when this service is enabled you are able to right click on programs and select "run as" then login with the user's credentials you desire (most likely an administrator). This allows you to use a user account and then execute programs as administrator only when you require that ability. Programs can also be executed with alternate credentials from the command line through the runas command, but that's a feature only a handful of people will appreciate. The advantages here are obvious, but of course drawbacks exist. The first is that not everything can be runased. The runas feature only appears when you right click executable files so if you needed to edit a text file that was read only to your account privileges you would have to open notepad with different credentials and then open the file instead of double clicking the text file. The next problem is that not all shortcuts register as linking to an executable. In my eyes this is a huge mistake, so any icon such as my computer or the desktop internet explorer icon don't have the runas ability. And, the last problem is more of an inconvenience than a problem. You can't change credentials for an active program session. Other than that the runas ability is great. You could, for example, walk away from your computer and not worry about your kids screwing things up even if your account is still logged in because they would still require the administrator password. But, this feature isn't for anyone and the majority of the fault lies with Microsoft not working out the features and bugs from the runas system. Listen Microsoft, make it work on everything, give it a keyboard shortcut (hold down CTRL or something and then double click it to get the prompt automatically), and if something you execute doesn't have permissions for you to run it, then popup the runas automatically if the service is running.

A concern was brought up by Steve Gibson on his GRC website that relates to this problem. On his page he brought up the fact that Windows XP introduced a new feature to the Windows product line called raw sockets. Normally the operating system introduces a translation layer between programs and the network it is on that filters dirty and overbearing data. But, new to Windows XP was the ability for a program to override the OS' security measures so that it could send whatever data it wanted to onto the network is resides (in this case we're concerned about the Internet). This means if your computer is compromised by a virus, worm or trojan that your computer can then spoof network data headers (like getting a false driver's license) or denial of servicing another computer (like what a funeral precession does to a road). Normally on other operating systems that have raw sockets they limit access to these "features" by allowing only administrator type accounts to use them, but since the majority of Windows users run as administrator the threat of this being taken advantage of is great. I believe raw sockets are an advantage from a technical standpoint, but from a security standpoint I believe Microsoft should not have implemented this feature on a desktop OS, especially not on XP Home edition.

Return to top.

 

6. Malware protection (viruses, spyware, adware)

Please see the malware guide for a complete discussion on this broad and complicated subject.

Return to top.

 

7. Firewalls

One of the hot topics of Internet security involves firewalls. Most magazines you read recommend that you use Blackice Defender, Zone Alarm or some other firewall software package to protect you from hackers. For those who are not in the know for firewalls, they are simply a hardware device or a software program that blocks Internet traffic based on rules, which can normally be configured. These rules specify certain types of traffic, such as from a specific Internet IP range or specific ports, that are allowed or not. Some firewalls have the ability to filter incoming and outgoing traffic, but most of the time home users are only interested in incoming since you feel your computer is threatened by the Internet and not vice versa. By using a firewall you could block incoming traffic to your computer making it hard, if not impossible to gain entrance to your computer.

What a firewall does is block ports on your computer or a certain type of traffic to your computer. Think of these as virtual access points to your operating system. When an Internet enabled service is installed on your computer it will listen on a particular port. If your operating system receives Internet traffic data that specifies its destined port as one that is assigned to a particular program then the operating system passes that data off to that designated application. If data is sent to your computer that no application is monitoring then your computer either replies back to the computer with an error such as nothing listening on this port, or it drops the data. The former is the proper way for your computer to respond and the secondary is what has been termed stealthed since the sending computer gets no response and as such has no way of knowing if you received the data to begin with. Normally what a firewall will do is ignore data on specific ports or it will ignore data following a specific pattern.

In the current Internet standard there are 65536 ports. These are numbered 0 to 65535 (2^16 bits), although 0 is considered an unused port and is rarely addressed from the outside. In fact, if a program asks to open port 0 the operating system usually intreprets this as "I will assign a free port and tell you what I assigned". On a *nix machine the first 1024 ports are designated as reserved for the root user of the machine, so that you can be sure that standard services such as FTP (port 21), HTTP (port 80), etc. were setup by the administrator of the server rather than by a standard user on the system. This isn't true for a Windows machine though and all ports on a Windows machine can be opened by any authenticated user of that system. Using what is called a port scanner you can initiate a connection to every port on a remote computer and you will get a response if you established a connection on that port. Since certain ports are understood to be on certain ports, such as the web on 80, you can detect what open ports are on a system and then from the port number you can guess as to what the port is used for, if it doesn't return you with easily identifiable information when connecting. Please note that you can run a webserver on any port, or a FTP server on any port, but then in the URL for it you would have to identify the port. For example, http://www.vernalex.com runs on port 80, but if it ran on port 81 then you would have to use the URL http://www.vernalex.com:81 instead to identify the nonstandard port it uses.

Now, the problem with firewalls is the cost versus benefit. While using a firewall, either a hardware or software one, can almost guarantee your computer will not be cracked. However, this comes at a large (and annoying) cost. Since a firewall blocks ports this means that the service provided by that port is also blocked. This means if you are running a web server on port 80 and your firewall blocks port 80 then no one will be able to access your HTTP (web) server. This would defeat the purpose of running the server at all. This means that you will have to make sure that in your firewall rules that you block what you want to block, and not what you don't want to. So, why run a firewall at all when you could just disable the open ports? That's a very good question, but the problem remains that Windows opens a great deal of remote ports that you can't disable, and you may not even know what they are. If you are interested in seeing your current connections drop to DOS and use netstat (start menu, run, cmd, okay, netstat -an). This will show you all the connections you have going out and coming in to your computer. Also, firewall programs have the annoying habit of popping up questioning messages every time you receive a port request asking if you would like to allow the behavior.

In a corporate environment users will not need to run a personal firewall such as Zone Alarm because their network will be (or should be) equipped with a hardware firewall. These are used by businesses to filter the traffic their private network receives or gives to the Internet. This allows them to make sure their employees only can visit certain websites, that they can only use specific services (such as outgoing web access and not KaZaA or AIM), and assures them that viruses cannot penetrate their administrated network. This is good from the perspective of the network administrators, but not always from the employees that have their network access limited. Corporate networks may also make use of the Windows firewall built into Windows XP as it provides local computer security in addition to the intranet being equipped with its own firewall to protect it from the Internet. The Windows firewall is the best firewall for large scale deployment because it can be modified through group policies.

Personally I prefer to using a home router. My favorites are the Linksys routers with the BEFSR41 being the most common of theirs. These allow you to share a home broadband connection (only a few work for dialup) through a technology known as Network Address Translation (NAT). What I find is funny is how Linksys, SMC, Netgear, Microsoft, Cisco and the other router brands offer their products as a firewall, but the fact is that is more of a flaw than a feature. The reason they consider them firewalls is because these home routers take a single Internet (WAN) IP address and split it into many personal (LAN) IP addresses. From the perspective of the Internet your multiple computers only have a single IP, and in fact they see your router as the culmination of all machines on your home network. From the perspective of your home computers you see the Internet normally and can connect to any Internet site as you would if you were directly connected to the broadband modem.

But, the problem here is when an Internet computer attempts to make a connection to your home computer. An example of this would be if you are using AIM and a friend on AIM tries to send you a file. With the AIM standard your computer will open a listening port, normally between 5900 and 6000, and the person sending the file will attempt to connect to that port so they can send you the file. However, when they attempt to initialize a connection to your Internet IP address your router receives the response. Since there are multiple computers on your home network your router does not know which computer the data it received was meant for, so it discards the data and your file transfer times out.

The way around this problem is through router traffic rules. These are called different things by different routers, but they all do the same thing. Basically, you tell the router what ports it should forward to what computer on your home network. This is a hack to say the least because that means only a single computer on your network can respond to that particular port number. To explain this better say you had two computers attempting to run FTP servers on port 21. With this model you could only have your router forward the incoming port 21 request to one of the two computers. The way around this is to use a nonstandard FTP port for one, but that's annoying. Many routers also have a feature called DMZ host. This allows your router to forward all incoming port requests to a particular computer on your network. This defeats the firewallesqe bevavior of your router, but it means you don't have to forward particular ports or port ranges.

So, the bottom line is that yes a firewall can secure your computer. But, it's more important to secure your computer by keeping your Internet listening software up-to-date, by disabling unneeded Internet services, and by limiting network access through security policies. If you are using Windows XP then I would highly recommend the firewall built into the networking options as it's easy and centralized. And if you're using broadband that it may be a good idea to use a home router even if you have a single computer on your home network.

Return to top.

 

8. System Services

In Windows there are several places where programs can be set to startup when your computer boots. One of these places, and also the most important one, is the system services. These can be found in the Services Console (start menu, run, services.msc, okay). The services console should present you with a list of all services, and they can be organized by name, by startup type, by their current running state or by other less relevant things. When you double click an item it should pop up a dialog with other important data pertaining to it. From here you can start and stop the service, as well as change its behavior on Windows startup. The purpose of a system service is to provide shared functionality, such as Internet connectivity that any Internet enabled program can use. The benefit of these services, as opposed to other startup locations, is that they have the ability to run even before you have logged into Windows. In *nix the name for these are Daemons, but they provide the same functionality.

All Windows NT based operating systems (NT4, 2000, XP) have system services, but Windows 9x based operating systems (95, 98, Me) do not since they don't have the ability to really log into them. On Windows NT systems the system services contains some very important startup items, and for this reason you need to be careful. By disabling a system service you could be removing a critical system function. However, many services provide features that you won't want to use and take up RAM/CPU time, or will leave your computer more vulnerable to cracks. For this reason it is a good idea to shut down these services. For a complete list of services, their functions and what I recommend you do with them see my services tool. For more complete explanation of services I would recommend that you read the services part of my components guide.

Each service has three startup modes. The first is automatic. This means that when your operating system first loads it will run that particular service, or at least try. This means that the functionality of that service is available when your OS is booted. The second is manual. This mode means that the service is not started on boot but starts when required. So, if program requires that service it will start it and then use. Sometimes after the program is done with it the service will be stopped, thus freeing the resources it was using. Sometimes services are always considered needed and by setting them to manual they will be started on startup because some other service or another program wanted it running even though it may not require it. The third is disabled. This means that the service can't be started even if a program requires functionality from it, and it can't be enabled by the operator unless very set to manual or automatic. There is no benefit of disabled over manual if the service isn't requested to start by another process, so normally you should set it to manual unless you know it's not needed or you don't want it.

The first service I will talk about is the messenger service. This is an especially annoying service since a few nasty spammers have taken upon themselves to make a quick buck. The purpose of this service is so network administrators on corporate networks can send you text notifications through a popup message and so the alerter service can send out text notifications. These messages are for things such as, "the file server is going down for a reboot and will be back in a few minutes." So, this service isn't really meant for the home user but in Windows this was enabled even for the home users for some reason. I would like to point out that this service is in no way connected to Windows Messenger, the chat program. And, I would recommend disabling this service unless you know you need it.

The second important service I will present is the remote registry service. Once again this service was designed for corporate networks so that network administrators could remotely control your computer. This service gives direct control to your registry from a remote control if they know your username and password. Your registry is the central repository for all system information; including installed programs, your system services, email settings, etc.. For obvious reasons this is a security hole and should only be enabled if you require it. Therefore, disable it if you're not on a corporate network. And if you want to better understand the registry then please read the registry chapter of my components guide.

The third service that is a potential security risk is the SSDP Discovery Service. The SSDP Discovery Service provides Universal Plug and Play to Windows. UP&P is much like ordinary plug and play, but instead of detecting devices connected to your computer directly it detects devices through the network. A good example of this is the Microsoft family of routers. When you connect your computer to a Microsoft router your computer will detect the router through a series of probes and then the router will be automatically installed on your computer. The danger here is that your computer seeks out devices on a network that represent themselves as something your computer wants to install, but this is a very serious security risk. For this reason I would strongly recommend disabling this service unless you require it.

The fourth service is called Terminal Services and you may want to disable it, unless you want the functionality is provides. The purpose of this service originates with the Windows server line and allows you to connect to Windows operating systems running as terminal servers to host your desktop. This is a similar concept to that of an X Server for *nix or a Citrix server or a mainframe, allowing you to use your computer as a dumb terminal. With Windows XP the functionality of this service was extended beyond the server line, allowing you to remotely control your computer across the Internet using Remote Desktop. When this service is enabled, when Remote Desktop is enabled, and when you have allowed users or groups through the allow logon through terminal services a user will be able to log into your computer as if they were sitting in front of it. This presents a large security risk if you have a weak password, so unless you intend on using this feature I highly recommend disabling this service.

Return to top.

 

9. Windows Management Instrumentation (WMI)

Windows Management Instrumentation (WMI) is one of those things that is extremely useful, but for the most part unknown, and definitely not needed for the majority of users. For network administrators out there that wish to remotely manage a network of WIndows machines WMI would be a supreme time saver. It provides a scripting API that allows you to interface with computers on a network and do everything from list services to run a program remotely. For those of you that have never programmed before, an API is a programming layer that allows the programmer to manipulate the desired device without having to speak to the device directly. This simply means that a layer of protection is added between the programmer and the device. So, if the device's version is every changed then the API commands would remain the same even if the function of the device changed. This not only protects the device from unwanted tweaking, but also protects your programs from breaking if an upgrade occurs.

As you may have guessed the features provided by WMI could be considered a security risk. Since WMI allows remote probing and execution any user that can be authenticated through a username and password with the proper security that user would have compromised the security of the computer. Plus besides the security concerns the WMI logger has been known to immensely slow down computers if the WMI engine gets caught in a error loop. For these reasons I would highly recommend disabling this feature unless you are on a corporate or managed network.