by Jason Thomas
If you’re smart and you’re connected to the net, you’re concerned about computer security. Open ports on your computers are invitations to criminal hackers and other evildoers to wreak havoc - and if you don’t protect yourself, no one else will. Your ISP and the cops have better things to do than chase hackers from Belarus who deleted the cosplay photos of you in your beard and Sailor Moon schoolgirl outfit. (That’s right, I know about that whole sordid affair).
The good news is that much like home security, it’s quite easy to lock the door. Test out those locks with a port scanner utility, which probes your computers for security holes.
Note: It should go without saying that your computer should be behind a firewall - a HARDWARE firewall. You traveling laptop types may have to settle for a less-than-bulletproof software firewall on the road.
The Nmap port scanner
Originally a UNIX utility, the Nmap port scanner utility has been ported to most other operating systems. It’s available as a Windows .exe, and also runs on Macs. I run it on my linux and BSD machines because of the scripting features available there, but you can accomplish the same thing through Lifehacker favorite Cygwin.
Download and install Nmap. If you’re running Cygwin, just move the nmap executable into your c:/cygwin/bin folder (or wherever cygwin is located on your machine.) Parts of this article will assume that you’re using Cygwin, but you can probably get away without it. Pardon the instructus interruptus, but I think here’s a good place to tell you something. You could theoretically get in trouble with Nmap. Most likely not felony or even misdemeanor-level trouble, but you could very easily accidentally annoy people who you really don’t want to annoy - so do be sure to point Nmap at your own machines, and no one else’s. Back to the tutorial. Once Nmap’s installed, you’re ready to scan your network. Start up a Cygwin bash shell and type the following: nmap -v -A 192.168.1.1-255 This command will scan your entire subnet. The actual address range used might be different depending on your router or the way you have it set up, but for most home routers, this is the default. The last field, 1-255, tells Nmap to scan all machines on your network. The -v makes the output more verbose and is probably all you will need. If you want much more information, use -vv or -vvv, but you probably won’t need that level of detail. The -A option causes nmap to scan for OS type. If you’re running a large network, you might want to run this every day or every hour to detect any new machines popping up on the network. This command line should produce some output right away, and then produce more output at intervals. It may take a little while depending on how many machines are on your network. Now, type the same command again, but this time pipe it to a file, like so: nmap -v -A 192.168.1.1-255 > nmapoutput.txt The “>” is the UNIX redirect symbol. If you don’t know how to use UNIX pipes and redirects, it’s really something you should learn, but you don’t really need to understand how they work for the purposes of this article. (See also a primer on useful Cygwin commands for more on Unix redirects and less.) Open nmapoutput.txt in your text editor, or just use “less:” less nmapoutput.txtIt’s possible you’ll see very little here. If your systems are locked down, this part will be pretty boring. In my case, I’m running a webserver on my home network, so I saw this line:
Discovered open port 80/tcp on 192.168.1.123
You might also see port 80 open on 192.168.1.1, which is most likely your router’s IP address. That’s normal, because it’s your router’s configuration port.
This first chunk of lines comes from nmap’s first probe pass, where it tries to tell which ports on which machines are open and listening. Next, it tries to find out what services are running on those ports. If you’re running a Windows machine on your network, you’re likely to see something like the following:
Interesting ports on 192.168.1.100:
(The 1671 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
139/tcp open netbios-ssn
445/tcp open microsoft-ds
Interesting ports on 192.168.1.100: (The 1671 ports scanned but not shown below are in state: closed) PORT STATE SERVICE 139/tcp open netbios-ssn 445/tcp open microsoft-ds
Now you’ll notice that nmap has dug a little deeper into what’s running on given ports. It does this by throwing data at them and analyzing what comes back. These are some of the services running.
Nmap has a pretty good list of normal services, and it should give you an idea of what’s running on your network. If you see something that comes up as “unknown” or otherwise looks strange or suspicious, check the port number through Google as well as some websites that have port databases, like this one.
IANA is the organization that programmers talk to when they want to introduce a new protocol. If the port you’re wondering about isn’t on this list, there’s a good chance there’s something shady about it.
If you do a Google search for a port, e.g. “port 27374,” you should be able to get a good idea of whether the service is legitimate or not.
Stop services from keeping a port open
A process that opens a port on your machine may be legitimate, but it might be something you don’t want. Let’s say you’re running a Bulletproof FTP server on your Windows machine that you forgot about and you don’t want anymore.
Choose Start -> Settings -> Control Panel -> Administrative Tools. Select Services. Scroll down in the list until you see the name of the service you want to close. Select it, change the startup type to “Disabled,” and click “Stop” to stop the service. Try to know what you’re doing here, because you could stop services required to keep your machine running.
Here’s some good information about closing services. (This isn’t my page, it’s a different Jason. But it’s good anyway.)
Nmap alternatives
If you don’t want to install anything, there’s a nice web-based scanner called Shields Up which will automatically probe all the service ports on your IP address as seen by the net. This is great, and important if you have a firewall, because you need to know what your network looks like from the outside. But if you have more than one machine in your network, you’re going to also want to know what ports are exposed on those machines, and since Shields Up and other similar services can’t see much past your firewall, you should install a scanner that runs on one of your local machines.
A windows-based application to do this is Angry IP Scanner (see screenshot at the top of this article). It’s easy to use, fast and efficient, and if you need to do something immediately, you wouldn’t really need to look any farther than this.
I hope this article gave you a basic idea of how to secure machines on your network. While running a hardware firewall and closing all unnecessary ports inside your network is the bare minimum, it will keep out all but the most determined attacks, and scanning periodically will let you know if you’ve somehow installed malware or become infected with a trojan.
Jason Thomas is a writer and computer professional living in the Twin Cities.
[More articles like this..]
Note that, in order to effectively use fgdump, you’re going to need high-power credentials (Administrator or Domain Administrator, in most cases), thus limiting its usefulness as a hacking tool. However, hopefully some of you other security folks will find this helpful.