427 Botnet fm qxd

www.syngress.com
Botnet Detection: Tools and Techniques • Chapter 5
149
427_Botnet_05.qxd 1/9/07 9:59 AM Page 149

---

■
Block ports 135-139, and 445 
due to numerous exploits aimed at
Microsoft File Share Services.
■
Block access to port 25
for officially recognized e-mail servers.
■
Block access to ports (TCP) 1433, and (UDP) 1434
.The
former is due to widespread SQL password-guessing attacks and the
latter due to the SQL slammer, of course.
By blocking these ports and logging the results, you can gain a warning
when some of your internal hosts become infected.You can also configure
the firewall to alert you when these occur, to improve your response time to
these infestations.
Remember, this list is a minimum, but it is effective, given botnet attacks
against Microsoft File Share (CIFS) and spammers as well as certain historic
attacks. A local site with a small set of rules that falls into the bad security
practice called “access all, deny a few” should also factor in local experience
based on local incidents. On the other hand, if you are blocking nearly every-
thing with the classic corporate firewall and you log the blocked traffic, you
will see interesting things. If a bug gets loose on the inside, it might get loose
again, due to either fan-out or the fact that once hackers discover a local hole,
they could try to see if you repeated that hole elsewhere on your site.This is
because infection may arrive over VPNs, mobile hosts (or USB earrings), e-
mail attachments, Web surfing, and even P2P applications. Firewall logging is
an essential part of defense in depth.
T
IP
Here are two classic books on firewalls that are worth reading:
Building Internet Firewalls
(Second Edition), Zwicky, Cooper,
Chapman; O’Reilly, 2000
Firewalls and Internet Security 
(Second Edition), Bellovin, Cheswick,
Rubin; Addison-Wesley, 2003
The first edition is available free online at
www.wilyhacker.com/1e/.