Protecting Against SYN Flood Attacks

Protecting Against SYN Flood Attacks

In Windows, a protection allowing to detect and adjust the time when system is being targeted with a SYN flood attack, i.e., a type of denial of service attack.

When the protection is enabled, responses of this connection time out more quickly in the event of an attack.

The cure is here:

1. Open your registry, type in run "regedit".
2. Find the key below: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
   
3. Then create a new DWORD value which is called "SynAttackProtect"
4. Set it to either 0, 1 or 2. Look at the table below.

If you use this value, Transmission Control Protocol (TCP) adjusts retransmission of SYN-ACKS. In the case you modify this value, the connection responses time out more quickly in the event of a SYN attack, i.e. a type of denial of service attack.
0 (default) - typical protection against SYN attacks
1 - better protection against SYN attacks that uses the advanced values below.
2 (recommended) - best protection against SYN attacks. This value adds additional delays for connection indications, and TCP connection requests quickly timeout when a SYN attack is progressing.

Optional Advanced Values
If you want extra control, you can create the additional DWORD values in the same key for each of the items which are introduced below. In this case, they are not required for SynAttackProtect to be effective.

TcpMaxHalfOpen - default value is "100"
TcpMaxHalfOpenRetried - default value is "80"
TcpMaxPortsExhausted - default value is "5"
TcpMaxConnectResponseRetransmissions - default value is "3"

Restart Windows for the changes to take effect.

Disable Send unique player ID through Windows Media Player.

Disable Send unique player ID through Windows Media Player.

Windows media player is not interested in personal information. It provides audio and video to your computer through media server. The server identifies your computer with ip address and player id number. The player id is prepared from a globally unique identifier (guid). The id is generated by the windows media player setup program through standard operating system functions and windows media player saves it for logging.

You can disable this, by following these:

1. Go to start > run menu,
2. enter "regedit"
3. Navigate to the registry path listed below: HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences
4. Find SendUserGUID (If you can't find the value in the registry under the exact location (i.e. it does not exist) - please right click in the right pane of the window and create it.)
5. Now, right-click and modify the binary value of SendUserGUID to 00 (in Value Data write 0000 00)

The changes take effect after a restart or logoff.

Disable Administrative Shares

How the Administrative Share in Windows NT/2000/XP/2003 can be disabled?

Every Windows NT/2000/XP/2003 machine automatically creates a share for each drive on the system. These shares are hidden, but available with full control to domain administrators. The drive letter, followed by the $ sign is the name, and it is shared from the root.

When trying to attain a highly secure network, you may wish to address this potential security issue by disabling these shares, or at least restricting their permissions to specific users or services.

The default-hidden shares are:
*C$ D$ E$ - Root of each partition. For a Windows NT workstation/2000/2003/XP Professional computer only members of the Administrators or Backup Operators group can connect to these shared folders. For a Windows NT Server/2000 Server computer, members of the Server Operators group can also connect to these shared folders.
*ADMIN$ - %SYSTEMROOT% This share is used by the system during any remote administration of a computer. The path of this resource is always the path to the 2000/NT system root (the directory in which 2000/NT is installed usually C:\Winnt and in XP it's C:\Windows).
*FAX$ - On 2000 Server, this used by fax clients in the process of sending a fax. The shared folder temporarily caches files and accesses cover pages stored on the server.
*IPC$ - Temporary connections between servers using named pipes essential for communication between programs. It is used during remote administration of a computer and when viewing a computer's shared resources. This share can be very dangerous and can be used to extract large amounts of information about your network, even by an anonymous account.
*NetLogon - This share is used by the Net Logon service of a 2000, 2003 and NT Server computer while processing domain logon requests, and by Pre-2000 computers when running logon scripts.
*PRINT$ - %SYSTEMROOT%\SYSTEM32\SPOOL\DRIVERS Used during remote administration of printers.

It is possible to simply remove the share from Server Manager (in NT) or Shared Folders (in 2000/XP/2003) but the problem with this method is that the shares will automatically be recreated when the machine reboots.

You can disable the automatic administrative share creation via Group Policy, but this is a much simpler way is also available:

In order to disable these shares permanently, a registry edit will be necessary.

Security note:
Unfortunately this registry hack does NOT stop the IPC$ share and this is a share that is often used by hackers to enumerate systems before attack since it can yield a wealth of information about your system names, your user names, and more. If your ACL permissions are not correct or you haven't disabled anonymous user access or you haven't disabled the guest account then this port can lead to total system compromise within minutes!

Servers:
For NT 4.0/2000/Windows Server 2003s, the change is:
Hive: HKEY_LOCAL_MACHINE Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Name: AutoShareServer
Data Type: REG_DWORD
Value: 0

If you can't find the value in the registry under the exact location (i.e. it does not exist) - please right click in the right pane of the window and create it.

Note: A reboot is necessary for this to take effect.

Workstations:
For NT 4.0 Workstation/2000 Pro/XP Pro, the change is:
Hive: HKEY_LOCAL_MACHINE Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Name: AutoShareWks
Data Type: REG_DWORD
Value: 0

If you can't find the value in the registry under the exact location (i.e. it does not exist) - please right click in the right pane of the window and create it.

Note: Again, a reboot is necessary for this to take effect.

If you want the administrative shares to be re-created, you can change the value back to 1.

Note: Some applications depend on the presence of these shares. If things stop working you'll know to re-enable the shares.

How to Disable/Restrict Remote Registry Access in Windows

How to Disable/Restrict Remote Registry Access in Windows

Windows 2000, Windows XP and Windows 2003 supports Remote Registry access using Remote Registry service. This allows a remote user or a remote administrator to connect to the PC or server systems registry remotely and view or modify it.

This is ideally a feature for Remote Administrator or Management Applications to efficiently manage systems without having to manally logging onto the system, but on the other hand this can be a potential security risk.

Hence, if this service is not used for any management purpose then needs to be disabled.

To disable the service,

1. Click Start – RUN and type “services.msc”
2. In the right-pane, right-click “Remote Registry” and select Propertes.
3. Select Startup type as “Disabled” and click “stop” if the service is running.
4. Click Apply and OK.

The above mentioned steps are needed, if there is no need for anyone to connect and modify the Windows Registry remotely. However, if this PC or a system is a part of a corporate network and is part of Active Directory domain then select list of admins or admin groups might need permission to control the registry. In this case, the alternate option to selectively restrict access to the registry remotely the following procedure will be of help to you:

1. Click Start – RUN.
2. Type “regedit” and press enter. This will open the Windows Registry Editor.
3. Navigate to
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\
4. Select “winreg” and click Edit, Select “Permissions”
5. Select appropriate users/groups & appropriate permission like “Read” or “full Control”.
6. Click OK and exit.

This should restrict Remote Registry access on your Windows Server or PC.

Kaspersky Mail Checker Add-In Problems With Office Outlook 2007

Problem:

After uninstalling Kaspersky Anti-Virus, when I open Outlook 2007, I get the Microsoft Office Outlook pop up that says

"The Add-in "Kaspersky Mail Checker" (C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\mcou.dll) cannot be loaded and has been disabled by Outlook. Please contact the Add-in manufacturer for an update. If no update is available, please uninstall the Add-in."

Even there is no response from Kaspersky, regarding the same. Even I searched for the mcou.dll, but cannot find it. and also, I can't find anything Kaspersky related when I do a search of my hard drive. It appears it has been completely removed.

Some says http://download.avg.com/filedir/util/avg_arm_sup_____.dir/avgremover.exe
can solve the problem. Tried the same. Weared off.

How do I disable this pop-up?

Solution:
This is a common problem with Outlook 2007 and the Kaspersky Addin.

What to do?

• Open up Outlook 2007>tools>trust center>add-ins...
• At the bottom of the menu you'll see "manage"
  
• Select "Exchange Client Extensions" in the drop down box
  
• Select "GO"
• Uncheck the "Kaspersky Mail Checker"
• "OK"....

That's all, no more of that pesky/persky error after that... N-Joy