Thou shalt have no other gods before the ANSI C standard 1372

Brian Inglis

Both at home and at the office, I run a typical "small business" server and a gagle of Windows desktops around them. And in both places, I find a server compromised every few months, despite a moderately aggressive amount of firewalling. I usually find them when I read the periodic reports from the programs that scan the system logs. Cleaning up is ugly, boring and timecon- suming and I tend to be defensive when my business partner asks why I have my head in the server all day again. He is somewhat sceptical when I explain what happens and how a 'bot sits and waits for a chatroom-server in Romania, Sweden or the Nether- lands to give it commands. Of course we can't have this kind of infection on the server that holds our critical business data.

My partner keeps asking if it is such a challenge for me, whom he is charitable enough to consider competent, how do most businesses handle this? My answer is that most of them are infected, but they don't pay enough attention to discover it.

I'm beginning to work on a dynamic firewall ... an embedded system that has a list of legitimate services, and notes and totally blocks access from anyone who tries to connect to anything else, at least for a time interval that increases exponentially on repeated attempts. (The idea being that anyone who is knocking on a non-existent service is probably up to no good, and should not be allowed into the legitimate services either.) Yes, I know there are commercial products out there, but they contain too much code for me to feel entirely safe. By rolling my own, I can keep it to a few thousand lines, which makes me feel much safer.

Lars Poulsen