Re: Using Messenger Service for 'Net Send' Functionality --- Dangerous?Why?

"Net send" first tries a netbios connection to deliver the message, and will 
then attempt delivery via UDP 135 (the endpoint mapper.)

There is no functional reason why a firewall should be allowing netbios/f&p 
traffic or UDP135 into your network.

T

------
*Secure your infrastructure*
Microsoft Ninjitsu: Securely Deploying MS Technologies
security training delivered by Timothy Mullen.
Registration now open for Blackhat Vegas 2005:
http://www.blackhat.com/html/bh-usa-05/train-bh-usa-05-tm.html








----- Original Message ----- 
From: "Jesse Weigert" <weigert@gravitec.com>
To: "Nick Duda" <nduda@VistaPrint.com>
Cc: <kurt.buff@gmail.com>; <michael.mailinglist@securityfocus.com>; "at" 
<gmail.com@securityfocus.com>; <focus-ms@securityfocus.com>
Sent: Thursday, June 23, 2005 8:33 PM
Subject: Re: Using Messenger Service for 'Net Send' Functionality ---  
Dangerous?Why?


> I would like to add that there is malware which does just this.  Which
> is why sometimes even blocking the service at the firewall doesn't stop
> the messenger spam.
>
> Nick Duda wrote:
> | FYI, It's very easy to write a short VB app that:
> |
> | A. doesn't record net sends to event viewer
> | B. can spoof the sending name of the computer (NetBIOS)
> |
> | - Nick


---------------------------------------------------------------------------
---------------------------------------------------------------------------