The fact is that complacency is a bitch.
This image is a screenshot, suitably redacted, of a visit to Steve Gibson’s “shields up” page over at grc.com yesterday.
Now, in case you didn’t know, the Shields Up page will probe the first 1,024 service ports, and for each return a coloured square, a red square means the port is open, a blue square means the port is closed, and a green square means stealthed, as in there was no response of any kind, so no way to tell if there is even a system at the other end….. as you can see from this, every single one of the first 1,024 ports are stealthed, my router / firewall basically doesn’t respond to any incoming requests.
Steve Gibson has been around for a long time, and his shields up page has been around for a long time, by long time I mean over 15 years which is an eternity in internet terms, and it’s free, and easy to use, and simple to understand, and you would not believe how many small / medium business computers / networks fail it miserably.. given the recent wannacry noise you might believe how many corporate systems are wide open.
Put it this way, I’ve visited it from sites that hosted all sorts of private data, and the screen was a rash of red and blue dots, with no a green one to be seen, I won’t go into detail what the significance of open / closed / stealthed is as Steve Gibsons site does it eloquently enough on the shields up page.
Put it this way, strip away all the bullshit and PR and the facts are this, about corporate and business internet security.
1/ it’s illegal, so nobody will do it.
2/ our legal “due diligence” boxes are ticked, at minimal cost.
3/ “things just working” is more important than locking anything down or working safely around security considerations at extra expense or hassle.
An intrusion is treated the exact same way the police treat a report of a burglary, it’s not the same as knowing that a thief has been in *my* house violating all my shit…
Ten years ago I myself would build work computers for people and they were built locked down, ps2 keyboards and mice, USB ports filled with black epoxy, no CD or floppy drives, case sealed and BIOS passworded, the SOHO firewalls I used to sell and install also blocked off significant portions of the internet.
I was never a fan of VLANS either so I’d install two separate physical LAN’s for separate things, and I’d always use blue patch cables for data, yellow for telephony / voice, green for public lan and red for anything that touched a server, cctv if it was around used white, grey was always WAN side, and the general rule was you never saw more than one colour of patch cable going into one device or switch.
Users were free to misconnect their RJ45’s and patch PC’s into phones and out from the phone to the patch socket, or even (happened more than you would credit) bring in their own hub/switch/router and plug it in, and they could at worst via an unauthorised router doing DHCP take down only one of the network segments at a time, most stuff just failed to work, the PC > VOIP phone > wall socket scenario gave you either a working phone or a working PC depending which side of the socket you plugged in to.
Spare ports on switches were disabled.
Ten years ago I’d get a lot of shit, and it steadily increased and I steadily got less work as a result, by the time it petered out 3 years ago I was reduced to building high end silent PC’s for the managers and directors.
Today you’re violating employees human rights if they cannot access their twatter / fuckbook / fleabay / dating sites on a work PC during working hours, and/or if said PC then refuses to load or run *any* content on *any* web page, including yoo toob.
Here at home I have a “guest” wi-fi, it’s a completely separate network to the local LAN, it *only* has access to the WAN, and it’s rate limited to (checks) 250 kbit (31.2 kbyte) / sec up/down, so basically it’s modem speed, more than enough to send and receive emails or do basic web surfing on basic text sites.
It’s usually youth’s that complain, first of all it’s all “great you have free wifi” and then “it’s broken, too slow, youtube won’t load” and I explain that they can get on the *fast* network after;
1/ I audit their device, which will be a fifty quid non refundable fee.
2/ ***if*** their device passes audit, they can get on the 50 meg wifi network which is tied into the 150/200 meg cable WAN for ten quid an hour
Nobody has taken me up on it, but they all think I am a total cunt for not giving them free access to something that I have to pay for.
Go figure.
I will of course increase their enjoyment by whipping out my Note4 and pulling up speedtest which will of course use said QOS wi-fi, 16 ms ping, 25.22 mbps down and 10.72 mbps up, “works lovely” I smile.. because for 2.4 gig wi-fi those are *good* numbers.
They get even more unhappy, the free shit army is strong in this one.
As a boy I can still remember my mum and dad telling me to turn off the bloody light when I left a bathroom or bedroom etc, “you’re not paying for the electricity, I am” was always the tagline, not that my folks were poor, that wasn’t the point, the point was I wasn’t paying for the electric, they were… they weren’t raising no free shit army kids, no sir…
Steve Gibson comes from that era too, hang on, why are YOU using MY bandwidth and MY cpu cycles to run YOUR advertising shit??? , fuck you and the horse you rode in on, there you go doubleclick, blackholed at the firewall, and on and on and on… this very wordpress site takes about 30 seconds to load the first time I click “create a new post” because it’s trying to talk to google analytics, and sweet fuck all happens until that fails and times out…
Of course, it is no coincidence that someone who talks about microagressions and safe spaces and inalienable rights and all the other nouveau bullshit is fundamentally a member of the free shit army, nobody who pays their own way has any time for any of that bullshit, you want to use my free wi-fi, go ahead, it’s 33k, got any complaints, no fucking problem, MAC added to the blacklist, and by the way, that coffee you’re drinking, that’ll be two quid, and it’s 50p an hour to sit on my fucking sofa, and if you want to use the crapper that’s 50p too, and if you wanna give me an attitude I’ll introduce you to the only thing that is fucking free around here, the front door.
Last night I was told something by the parent of a 10 year old girl, the parent said she used to be a spoilt little princess, until that day about a year ago when she squirted you with a water pistol, and you told her not to do it again, because if she did, she’d lose, and of course being a princess she immediately did it again, and you tipped half a basin of cold water over her head, IN THE HOUSE, and then laughed at her when she burst into floods of tears.
At first the parent thought the lesson was “don’t take him on, you’ll lose” and then they thought the lesson was “don’t think he won’t do what he says he will do” but eventually the penny dropped, they were just the icing on the cake, everything, be it action or inaction, has a price, and it’s not my job to protect you from paying that price.
They still have difficulty coming to terms with how being taught that lesson JUST ONCE means they STILL have a completely different child over a year later, it seemed such a small thing.
Letting your kids watch just one fucking episode of fucking peppa pig seems such a small thing, giving into pester power just once seems such a small thing, but everything, action or inaction, has a price.