This "deny all" policy will prevent attacks against the
NETBIOS, http and Modbus protocols from a remote attack, assuming that the protocol used by the agent-based protocol is secure and the firewall is configured correctly.
NetBIOS provides two kinds of data transfer methods--session support and datagram support.
The Scanner allows the user to scan the network from a hacker's perspective enabling it to identify all machines, their
NETBIOS info, open ports, shares and more, giving the same information that a hacker would have.
At ORHS, we have a mixture of SNA, TCP/IP, IPX, DECNET and
NETBIOS protocols.
CD-ROM networking technologies for information retrieval and management using dedicated servers and software for Novell, Banyan, NT,
NetBIOS and peer-to-peer local area networks.
Significant features include client/server architecture; implementation based on the
NETBIOS standard; simultaneous access to as many as eight table servers; number of clients limited only by
NETBIOS implementation; multiple users can access tables on any TM/1 table server, as well as from their own disk; tables are pre-loaded on the table server so there is no loading delay at workstations and memory usage is minimized; changes to the data are immediate and visible to other users as soon as they recalculate; automatic "log-on" and user identification; read and/or write access can be controlled not only at the table (file) level, but all the way down to individual data elements; complete and automatic audit trail.
The solution also highlighted the massive network impact of
NetBIOS over IP.
It includes a NetStat utility that displays all a computer's inbound and outbound network connections capable of mapping open ports to the owning application; advanced
NetBIOS and TCP port scanners that can facilitate routine tasks often carried out by system integrators, administrators, and analysts.
The most surprising flaw located by the red team is that
NetBIOS (a program that allows computers on a network to communicate) port 139 is open to all AcmeProducts.com Windows systems, which means that any unauthorized person outside the network could access the local hard drives given enough time and some freeware technical resources.
In addition, because Observer supports TCP/IP, SNA, IPX/SPX,
NetBios, and many other protocols over Ethernet, Token-Ring, and FDDI LANs, administrators and technicians can also utilize the DICOM Extension for general network troubleshooting.
Connections can be made over LANs (
NetBIOS or TCP/IP), asynchronous networks (9,600 bps modem or above), an ISDN service or synchronous networks (e.g., X.25).
All of the Windows stations had
NetBIOS turned on as a default, creating double traffic every time someone logged on as it searched for a Microsoft server.
