Re: Why not use NETBEUI on Windows XP ??
From: Jeff Cochran (jeff.nospam_at_zina.com)
Date: 11/28/04
- Next message: Justin Jeffries: "password for accessing network folders"
- Previous message: phongshader: "Re: setting permissions perhaps?"
- In reply to: ehgoodrich_at_hotmail.com: "Why not use NETBEUI on Windows XP ??"
- Next in thread: Gcorpuz: "Re: Why not use NETBEUI on Windows XP ??"
- Reply: Gcorpuz: "Re: Why not use NETBEUI on Windows XP ??"
- Reply: ehgoodrich_at_hotmail.com: "Re: Why not use NETBEUI on Windows XP ??"
- Messages sorted by: [ date ] [ thread ]
Date: Sun, 28 Nov 2004 04:31:34 GMT
On 27 Nov 2004 10:52:18 -0800, ehgoodrich@hotmail.com wrote:
>I've been googling for several hours now on this subject and can't
>find a thread that answers all my concerns in this area. NETBEUI
>seems to be a good solution for small office or home networks that
>want to share files/printers internally in addition to sharing an
>internet connection. Here are the pros and cons as I see them.
>
>PRO:
>
>It seems to me that NETBEUI offers an additional level of security for
>small networks connected to the internet, even those using a hardware
>router/firewall. Most people seem to agree that a protocol other than
>TCP/IP is recommended when all your computers have a separate external
>IP address (no NAT translation).
Okay, that's just dumb. You already have a full TCP/IP network if
each has their own IP address, NetBEUI offers no protection or
security. NetBEUI isn't routable, which is where this idea is coming
from, but NetBEUI has to be the *only* protocol on the systems, not
TCP/IP.
>However, even if you do have a NAT
>firewall, it seems to me that someone could format packets designed to
>access your internal IP addresses. If they were successful, and you
>are using TCP/IP for Microsoft Networking, they now have access to all
>your network resources. However, if you are using NETBEUI (or some
>other protocol) for Microsoft Networking, they have some additional
>work to do in order to get to those same resources.
True. Unless you use both.
>In addition, if you start messing with your firewall (opening ports,
>etc. as many gamers, VPN users, etc. must do), it is difficult to know
>exactly what security holes you have opened up. Again, if you're
>using NETBEUI for internal file/printer sharing, it's simple: your
>network resources are protected because Microsoft Networking is not
>bound to TCP/IP.
Only if you remove the bindings or don't use TCP/IP on internal
systms.
>(NOTE: I realize that if you open up a big enough
>hole in your firewall, someone could get onto one of your machines and
>reconfigure MS Networking to do whatever they wanted. However, I
>think most would agree this is more difficult than just getting past
>the firewall.)
I wouldn't, but it's not an actual issue. When you're compromised,
you're compromised.
>I also use a software firewall (NIS 2004) on my computers, especially
>my laptop that is frequently connected directly to the internet away
>from the house without any hardware router/firewall. In that program
>(and most other simple software firewalls), I have to put my local
>Microsoft Networked computers in a "Trusted Zone" to allow
>file/printer sharing over TCP/IP. I'm not sure (and have never gotten
>exact information from Symantec) what this does, but I have to assume
>the worst: there are NO firewall limitations AT ALL on communications
>between computers in the "Trusted Zone".
What is most disturbing is that you have configured the system
security without knowing what it does. The admin is far more often
the culprit than any software issue in any security breach.
>This does not seem
>acceptable to me, since it is easy to invision a scenario whereby my
>daughter takes her laptop to school and picks up some malicious code
>and returns to my network, or a friend comes over with his infected
>wireless laptop and connects to my network to print something. In
>either case, if all computers in my local subnet are in my "Trusted
>Zone", the malicious code can spread throughout the network with no
>restrictions.
Not even close to a valid assumption. Malicious code is simply code.
It doesn't actually "spread". That requires a mechanism of some sort,
such as a trojan, active virus, activated email link, or the code
being run. And firewalls don't block that.
>HOWEVER, if I use NETBEUI for internal file/print
>sharing, I don't have to put ANYONE in the "Trusted Zone", and the
>same scenario would result in my NIS firewall (hopefully) raising a
>flag when the malicious code attempts to spread itself inside my home
>network.
You don't have to put anyone in any "trusted zone" and never should
unless you actually trust that system.
>CON:
>Microsoft no longer "supports" NETBEUI... SO WHAT??!! Microsoft
>support has never been that great anyway for home users and
>furthermore, WHAT's to support? Whenever I have used NETBEUI in the
>past (since ~ 1996, when I began moving away from IPX/SPX), it has
>worked. (read "it has worked period"). It's trivial to install
>NETBEUI on XP from the Install Disk (or as someone pointed out, you
>can use the NETBEUI files from a W2K installation).
>
>So, please tell me why I shouldn't use NETBEUI to reduce my security
>concerns in this day when security is the single biggest problem
>computer users face??
Because you've drawn the conclusion that NetBEUI is a secure protocol,
and that NetBEUI will protect your network by virtue of being on it.
Any worm that travels by Windows networking will travel via any
protocol you have on the system. NetBEUI is a non-secure protocol.
>Please be specific: I've already seen too many general answers like:
>
>"too many protocols slows down your network" (I only want to use two)
>"NETBEUI is not supported" (see above)
>"NETBEUI causes problems, especially with XP" (Please give specific
>example)
NetBEUI is chatty and causes additional overhead on the network.
NetBEUI in addition to another protocol can disguise networking
problems making troubleshooting harder. NetBEUI is inherently
insecure because you cannot block or modify any protion of it, it's
either on or off.
And mostly. NetBEUI is only a security assett when used correctly, as
the only protocol on an internal network which only faces threats from
an outside network, running through a router that can translate
between NetBEUI and TCP/IP.
Jeff
- Next message: Justin Jeffries: "password for accessing network folders"
- Previous message: phongshader: "Re: setting permissions perhaps?"
- In reply to: ehgoodrich_at_hotmail.com: "Why not use NETBEUI on Windows XP ??"
- Next in thread: Gcorpuz: "Re: Why not use NETBEUI on Windows XP ??"
- Reply: Gcorpuz: "Re: Why not use NETBEUI on Windows XP ??"
- Reply: ehgoodrich_at_hotmail.com: "Re: Why not use NETBEUI on Windows XP ??"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
