Administrator's knowledge of anti-hacker intrusion

Hacker intrusion is a serious injury. It not only easily results in data leakage and system damage, but also has many unnecessary troubles. As a network administrator, can I learn some related knowledge and be prepared for hacker intrusion? The following article describes how to defend against hacker intrusion.

1. disable unnecessary ports

Port scanning is an important part of the preparation before hacker intrusion. Therefore, disabling unnecessary ports can reduce our troubles. On the Forum, new users often asked questions about how to close a port. Here, we need to first clarify the relationship between the port and the service and open a port, there must be corresponding services. We hope that the virus and network security edition of the IT Forum will have a comprehensive article on port lists. IT is necessary for system administrators and individual users to understand these ports. We suggest you check them out. After learning about the service corresponding to the port, it is easy to close a port. We only need to stop the corresponding service in the service of the management tool. Of course, you can also right-click the line network neighbor "graph and select" attribute ". View "Local Connection Properties", double-click "Internet Protocol (TPC/IP)", select the "advanced" dialog box, select "option", and click "TCP/IP filtering ", set port filtering here. As for the specific ports that need to be closed, it depends entirely on the individual's needs. However, from the previous hacker intrusion process, we can find that some hacker tools can remotely open services that we have disabled, such as Telnet and terminal services. What should I do in this situation? The Microsoft Resource Package and the XP system provide the manager with the SC .exe applet, which can completely delete a service and is easy to use. The specific usage is not described here.

Here we need to say a few more to port 139, because it is a harassing port in the network hacker intrusion, but for many people, it is necessary to open and share resources. Because port 445 is used as an alternative to port 139, files can still be shared as long as port 445 is not closed. The method to disable port 139 is very simple. As long as we do not install the netbeui protocol, port 139 and NetRios will not be opened, and other users will not be able to know our operating system version after scanning. User List and so on-series information.

2. Install patches and Set passwords

From the first step of hacker intrusion, we can see that IIS vulnerabilities have helped us a lot. In fact, more people are using weak passwords as a breakthrough point. No matter how hackers intrude into the system, they always try to obtain an account and password first. Therefore, we need to set a strong and memorable password for the Administrator account of the operating system and install the latest patches. SP3 is required, and the latest patches for IIS are also indispensable. If it is too troublesome, you can use Window up date to install the patch. For the system administrator, it is necessary to subscribe to Microsoft's Security Bulletin. It will tell sports about the latest vulnerabilities and solutions. This is free of charge. You only need to apply for it on Microsoft's website.

3. Disable IPC $

IPC $ may be a wishful thinking of Microsoft, but it is not practical for most users. On the contrary, it has become a good method for hacker intrusion ." At least from this hacker intrusion, IPC $ has played a major role. To disable IPC $, You need to modify the registry. The specific method of anti-virus has been mentioned a lot before, so I will not talk about it here. For individual users, if they do not have special requirements, it is easiest to stop the Server service and disable it in administrative tools, so that sharing can be completely disabled.

4. Configure group policies

Although this hacker intrusion has not met the good fortune of a weak user password, it is not uncommon from experience. Therefore, it is necessary to strengthen the password policy. Since Microsoft provides us with a powerful group policy, we have no reason not to use it. Run gpedit. msc. Select "Security Settings" in "Windows Settings". First, select "password policy" in "Account Policy". Here, we can set the password complexity, note, and maximum retention period. These settings ensure that our passwords are not easily guessed, and dynamic passwords are implemented by most scanners with simple password cracking functions by default, if you change h to a dictionary file that is large enough, the password of Our administrator account may be cracked.

You can solve this problem by setting the account lock threshold and account lock time in the account lock policy. You can set the password to be locked after five wrong attempts, and unlock the account after 30 minutes. This effectively prevents brute force password cracking, there are still many configurable items in the Local Security Policy, so we will not talk about them here for limited space and applicability. Interested readers can study them carefully. Of course, security and performance are always in conflict. High Security will inevitably reduce the performance to a certain extent, and vice versa. Therefore, we need to select a balance point based on our actual situation.

5. disguise

After intrusion, hackers usually perform a series of disguised operations such as cloning user permissions and modifying ports. Why can't System Administrators perform a series of camouflage operations before being intruded by hackers to confuse intruders.

(1) disguised User: first, rename the default built-in account administrator, and then create an account named adminis-trator. Change the description to "Management Computer (domain) ", set a password long enough. Simply adding it to the guest group attracts intruders to crack an account with low permissions. Even if the attack succeeds, it will not make much use of it. Sometimes, we may worry about whether a user in our machine has been cloned with the administrator privilege. What should we do? Hacker intruders can use system tools as hacking tools. We can also use these tools to serve administrators. We can use the cca hacker tool for detection.

(2) disguised terminal door: Sometimes in special needs, we may need Terminal Services or Telnet services. The best way to reduce risks is to modify their default service ports. The modification method is the same as that in intrusion. For example, we can change Telnet to the default port 7626 of Mama and terminal service 5631 of pcanwhere.

When the intruders hit the port, they would naturally think that the machine was planted with a Trojan, so they could connect them slowly with the two remote control software.

Vi. Event Log Protection

Event Logs are very important to every administrator, so they become the eyes of hacker intruders. Any hacker who successfully intrude into a machine will try to clear the event log before exiting. Therefore, protecting Event Logs and backing up logs at any time is inevitable. For individual users, event logs also provide us with important clues. So where are these event logs?

Security logs, system logs, and applications are stored in the PATH % systemroot % system32config. The default file size is kb.

Security log file year: % systemroot % system32configSecEvent. EVT.

System log file: % sysytemroot % system32configSysEvent. EVT

Application Log File: % systemroot % system32configAppEvent. EVT

The location of IIS log files can be learned through the log record Properties dialog box. The Web log records are the W3WVC1 folder, and the FTP log records are the MSFTPSVC1 folder.

As a diligent administrator, frequent viewing and backup of logs will help to detect problems in a timely manner. During this hacker intrusion, if the administrator finds that the log files are cleared earlier, it will naturally cause suspicion. In this way, the program behind hacker intruders is likely to fail.

7. Comprehensive detection and hacker capturing

If we find that there are signs of hacker intrusion, do not be in disorder. We need to check, service, and account from every location that may be changed. Suspicious files, processes, ports, log files, Documentsand Settings folders in the system root directory ...... No more clever foxes can beat hunters. In the service list, we may find a service that is inexplicably added. For example, snake's socksserver generates a service, which is in the user list. We may find that the permissions of some accounts have changed, and the system root directory contains a reboot.exe file when the guest account is activated; cccproxy (agent server software installed) is added to the Job Manager's burst list ). Use netstatan in the command line to find the default port for developing a trojan. The log file shows that no one on the server accesses it one day ', in the Document sand Settings folder, a folder with an account name is created (this account has logged on to the operating system as a graphical interface ).

Of course. Only by understanding the vulnerabilities in your system can you better grasp the psychology and intrusion methods of hacker intruders. Here, I suggest you use the free detection software MBSA (Microsoft benchmark Security Analyzer), which relies on Microsoft's official database to detect the latest vulnerabilities in most Microsoft products, it is easy to use. In this way, we will be able to understand the weakness from which hackers intrude into our system.

In fact, from the whole process of hacker intrusion and defense, the security awareness of system administrators is much more important than technology. When the Administrator clicks the mouse one more time, the hacker may need to press N Less Than the keyboard. Administrators have poor security awareness, which is also an important cause of poor network security in China. Hacker tools and tutorials are everywhere. Today, network intrusion is increasingly foolish, and we hope to be a server administrator or individual user. They can take up their own responsibilities, improve security awareness, and eliminate all security risks before being attacked.