Re: Blocking port 135?

[Mans Nilsson <mansaxel () sunet se>]

Subject: Blocking port 135? Date: Fri, Aug 01, 2003 at 01:37:21PM -0500 Quoting Adi Linden (adil () adis on ca):
> http://www.cert.org/advisories/CA-2003-19.html
>
> Would blocking port 135 at the network edge be a prudent preventative 
> measure?

As most have said, no. 

* It does not cover all possible attacks.

* It may block legitime traffic. 

* If you block and interfere, you are responsible for what your 
  customer does. You Do Not Want That. 

* If my home ISP tried this on me, I'd take them to the consumer 
  protection authority and have them explain why they are calling their
  filtered service "Internet access". 

Instead, I'd suggest this: 

- Have the customer responsible for all things on their own machine. 
  In writing if necessary. 

- Inform them that "real Internet" is a Good Thing, but emphasize 
  that it takes some care and feeding of connected devices. 

- Tell them where to get free or cheap protection software. 

- Inform them that devices found to be broken into will be sent to null0
  until proof of cleanliness has been obtained. 

- If they have a larger net (corporate customers) tell them you *will*
  take their CPE interface down if they are visibly broken into and fail 
  to respond. 

Works for us. 

-- 
Måns Nilsson         Systems Specialist
+46 70 681 7204         KTHNOC
                        MN1334-RIPE

I fill MY industrial waste containers with old copies of the
"WATCHTOWER" and then add HAWAIIAN PUNCH to the top ...  They look NICE
in the yard ...

Attachment: _bin
Description: