Setting-up a secure dual-boot system - part 1

by , 22 January, 2002

A look at the "Which OS do you run?" Linuxdot poll shows almost half of you run Windows and Linux in a dual-boot configuration. This series of articles is intended to help you do so in as secure a fashion as possible.

Securing Windows

There are things that you can do yourself to make your Windows installation a more secure one. Simple little things can sometimes make a world of difference.

The first step is to get as much information as you can about how bad things are right now. Before you do anything else you should open the Control Panel. Look around for the Networking section. There should be a spot in there for "File and Printer Sharing" or something similar. Unless you know for a fact that you need to have that enabled, make sure it is not.

Next step is to go to Gibson Research and take the "Shields UP!!" test against your machine. Also, another spot offering security scans is at DSL Reports. I just found out this one, a few days ago from my ISP.

You may be shocked by what you find during these scans. Especially if you have a default install of Windows.

Next, go to Zone Labs and download ZoneAlarm. ZoneAlarm is a personal firewall program for Windows. In my opinion it is the best. It's also free for personal use, which doesn't hurt any. Install it, then go back to do the port scan test again. Quite a difference. ZoneAlarm, by default, uses stealth techniques to make your computer invisible to port scans.

Dial-up is not "secure"

You may be thinking, "I'm on a dial-up, do I really need a firewall program?" Let me put it to you this way. If you can see the Internet, then people on the Internet can see you. Your Internet connection is a two-way street.

Most people think that a dial-up connection is "secure" because you call in, get a different IP address every time you connect, and the connection is often of short duration. All those things are true.

However, you also need to take into account that most of the people looking for systems to hack aren't people at all. They're little programs, or scripts, and they couldn't care less if your IP address this time is different than it was the last time you connected. All that matters is they've found you.

Also, that random IP address really isn't all that random. It can't be. The rules of the Internet allow each domain--like your ISP--only so many addresses. Your ISP has already allocated some of those as fixed IP's to businesses, or people with DSL lines. That leaves them with a subset of the total allotment, which they use as for dial-up users.

Your ISP is not able to hide the IP address. They can not. It is a function of their business. They provide Internet connections, i.e. they must be visible to do that. The people writing these scripts know that.

How hard do you think it is to start with a known good IP address in a given domain and then just walk the list with a for-next loop? Is the fact your IP address is different from the last time, going to save you? I think not.

Mailing lists

Getting your system secure is only half the battle. Now you need to keep it secure. To do that is reasonably straight-forward, and more than anything, means keeping yourself informed. The simplest way to do this is to subscribe to a few mailing lists that focus, entirely or in part, on security-related issues for your operating system.

Gibson Research has one. I'm on it. It doesn't come around very often but when it does it's usually something worth knowing about.

A good general-purpose Windows-related list is the LangaList. Go to Langa and sign up for it. It's free, comes around a couple of times a week, and I've been on it myself for a few years now. Fred Langa is someone that I may not always agree with, but that I have respect for.

The LangaList covers Windows and when there is a security-exploit for one of Microsoft's products Fred is pretty good about letting you not only know about it, but where to get the fix for it, if there is one. Also on his site is an archive with a wealth of informtion and useful utilities.

For a good "general security" announcement list go to CERT and get signed up for their newsletter. It's not Windows-specific but has security announcements about UNIX, Linux, Windows 2000, you name the operating system or program, CERT covers it. For new and home users, CERT has also compiled a set of documents.

Wrap-up

Now, you see how easy that was? No matter what Microsoft may or may not do, there are things under your control that can make your system more secure.

However, no matter what operating system you run, or what precautions you take, there is almost surely going to come a time when some script-kiddie finds an exploit and hacks your system. No security system is perfect. You do the best you can. Make sure you have a known good backup, then if all else fails, you can re-install.

This is why I'm so upset by Microsoft not wanting to give CDs with Windows XP. I promise you that someday you are going to have to re-install your operating system. How do you do that with no CD?

Next time we'll start with the Linux side of the secure dual-boot equation.

About us
Latest stable kernel: 2.4.19 | Latest development kernel: 2.5.39 Copyright © 1998-2002 Linuxdot.org. Linux ® is a registered trademark of Linus Torvalds.