 |
There are known security vulnerabilities associated with Microsoft Networking.
In order to reduce the University’s exposure to attacks against those vulnerabilities,
the Office of Information Technology (OIT) will begin filtering NetBIOS and SMB packets (TCP ports 135, 139, and 445.
UDP ports 137 and 138) at the borders of the University Network. For residence
hall networks, this block will go into place on August 27th. For the remainder
of the campus, the block will take effect on September 2nd. This will not affect
most users of the University network including those who use
file sharing between buildings at the University.
You will be affected if you:
- Access a computer connected to the campus network from a remote location
using the Microsoft networking features of the Windows operating system
- Access a remote computer from a computer connected to the campus network
using Microsoft networking.
If you are unsure whether you are affected or have questions about this, please
contact your system administrator or the OIT Help Desk.
If you need to use these protocols from outside of the campus network, you
may do so by using a Virtual Private Network connection. For more information
on OIT’s VPN service visit http://www.helpdesk.umd.edu/vpn/.
Factors prompting this action include:
- Over 200 separate incidents involving the hijacking of campus Windows systems
via Microsoft Networking services have occurred thus far during 2002.
- An average of 200,000 intrusion attempts per week from outside the University
Network probing for vulnerable systems.
- Tools to exploit Microsoft Networking weaknesses are readily available
from Web sites dedicated to assisting would-be intruders.
- It is becoming common for Windows systems on-campus to be scanned and compromised
from off-campus during the installation process prior to the installation
of necessary update packages.
- Numerous NetBIOS probes of off-campus sites from the University network
have been observed exposing the University to potential liability issues.
- Microsoft Networking is increasingly a target of virus writers. The Klez
virus that has infected well over 500 computers at the University this year
uses Microsoft Networking as one of its infection vectors.
|
