4 ms·

I've always been a fan of ShieldsUP! https://www.grc.com/shieldsup https://www.grc.com/shieldsup

sidewndr46 6y ago
I think I've heard of this before but never actually used it. It is interesting because it misses the ports I have that are wide open, maybe it doesn't scan all ports. Also, I run some IP block whitelists for ports under 1024. So they must be scanning from outside the regions I allow traffic on those ports from.
- wnevets 6y ago
  Service Ports is the first 1056, you can also fill in specific ports you want to check.
  - bmn__ 6y ago
    No, there are much more than that. See file {/usr}/etc/services or http://www.iana.org/assignments/service-names-port-numbers/ http://www.iana.org/assignments/service-names-port-numbers/
    - wnevets 6y ago
      What I meant was the Service Ports buttons on ShieldsUP! was the first 1056. "Determine the status of your system's first 1056 ports" That is the headline for that page.
hamburglar 6y ago
Wow, I haven't thought about GRC in a long time. I've always thought the guy was somewhat of a crackpot/sensationalist/self-promoter because he seemed to have a standard recipe of finding some interesting-to-him feature/aspect of a system and then declaring it a glaring security problem and then writing sensationalized screeds about how everyone needs to use his utilities to protect themselves from it (I swear, he probably shouted about the world ending because of XP raw sockets for a decade longer than it was even relevant). I kind of liked SQRL as a concept but I also remember thinking, "ugh, but it's this guy". He seems to have a decent amount of technical knowledge but a lot of what he writes just seems to be about a need to be considered an expert at something, aimed at people who don't know any better. Just as an example, the idea of people referring to his web page [1] to validate the cert fingerprints of popular websites is ... really bizarre from a security standpoint. I understand him having concern (as do many of us) about the security of the CA hierarchy, but where did he get the fingerprints? How did he validate them? And why should anyone trust him to have done so? Is his web page more secure than the CAs? [1] https://www.grc.com/fingerprints.htm https://www.grc.com/fingerprints.htm ... but I digress. Apparently I have some very strong skepticism of Steve Gibson that I wasn't even aware of until I had a visceral reaction to ShieldsUp! (which is probably a perfectly fine service) :D
- tialaramex 6y ago
  The word that comes to mind for Steve Gibson is "kook". Not in a nasty way, just the sort of person who keeps sending purported proofs of the abc conjecture to a University mathematics professor they met briefly twenty years ago, or who frequently writes to their senator with opinions about a show they saw on TV. Harmless yet somehow mildly annoying. But as to that fingerprints page. The idea isn't really about any problem with the Web PKI (what you're calling "the CA hierarchy"). Instead it's about a method you can try to use to figure out if you're using a client that's configured to trust something else entirely. In most cases this means a middlebox, maybe at a school (to stop kids looking at porn and maybe cheating on tests) or at work (porn again, and maybe other non-work stuff, sometimes anti-exfiltration technology) but it could be your own AV software. It can't really do what it says on the tin, for a few reasons. You're going to get some false alerts this way because the certificate Steve (and Steve's web site) sees won't necessarily match the one you see, and if a sophisticated adversary was trying to defeat Steve's system they could just use the same technique to replace Steve's own site. Also as often happens with these little projects, it isn't properly maintained. The stuff about EV in Firefox (and I think Chrome too?) is no longer true.
  - hamburglar 6y ago
    Ah, you're right, I didn't actually read through the alarmist stuff to see that he was referring to MITM proxies that actually install their own roots on your machines. Now I'm amused at the idea that there could be some off the shelf MITM proxy out there that simply does content editing to replace any occurrences of the FP of the real cert they're MITM'ing with the FP of the cert they generated for you on the fly. :D When I saw the alarmist stuff about knowing the cert fingerprints for certain sites a priori, I thought he'd invented a crazy ad hoc version of cert pinning and just rolled my eyes.
- wnevets 6y ago
  Ultimately Gibson was proven correct about raw sockets on Windows and they were removed a few years later [1] [1] http://www.interact-sw.co.uk/iangblog/2004/08/12/norawsockets http://www.interact-sw.co.uk/iangblog/2004/08/12/norawsocket...

I think I've heard of this before but never actually used it. It is interesting because it misses the ports I have that are wide open, maybe it doesn't scan all ports. Also, I run some IP block whitelists for ports under 1024. So they must be scanning from outside the regions I allow traffic on those ports from.

wnevets 6y ago
Service Ports is the first 1056, you can also fill in specific ports you want to check.
- bmn__ 6y ago
  No, there are much more than that. See file {/usr}/etc/services or http://www.iana.org/assignments/service-names-port-numbers/ http://www.iana.org/assignments/service-names-port-numbers/
  - wnevets 6y ago
    What I meant was the Service Ports buttons on ShieldsUP! was the first 1056. "Determine the status of your system's first 1056 ports" That is the headline for that page.

hamburglar 6y ago

Wow, I haven't thought about GRC in a long time. I've always thought the guy was somewhat of a crackpot/sensationalist/self-promoter because he seemed to have a standard recipe of finding some interesting-to-him feature/aspect of a system and then declaring it a glaring security problem and then writing sensationalized screeds about how everyone needs to use his utilities to protect themselves from it (I swear, he probably shouted about the world ending because of XP raw sockets for a decade longer than it was even relevant). I kind of liked SQRL as a concept but I also remember thinking, "ugh, but it's this guy". He seems to have a decent amount of technical knowledge but a lot of what he writes just seems to be about a need to be considered an expert at something, aimed at people who don't know any better. Just as an example, the idea of people referring to his web page [1] to validate the cert fingerprints of popular websites is ... really bizarre from a security standpoint. I understand him having concern (as do many of us) about the security of the CA hierarchy, but where did he get the fingerprints? How did he validate them? And why should anyone trust him to have done so? Is his web page more secure than the CAs? [1] https://www.grc.com/fingerprints.htm https://www.grc.com/fingerprints.htm ... but I digress. Apparently I have some very strong skepticism of Steve Gibson that I wasn't even aware of until I had a visceral reaction to ShieldsUp! (which is probably a perfectly fine service) :D

tialaramex 6y ago
The word that comes to mind for Steve Gibson is "kook". Not in a nasty way, just the sort of person who keeps sending purported proofs of the abc conjecture to a University mathematics professor they met briefly twenty years ago, or who frequently writes to their senator with opinions about a show they saw on TV. Harmless yet somehow mildly annoying. But as to that fingerprints page. The idea isn't really about any problem with the Web PKI (what you're calling "the CA hierarchy"). Instead it's about a method you can try to use to figure out if you're using a client that's configured to trust something else entirely. In most cases this means a middlebox, maybe at a school (to stop kids looking at porn and maybe cheating on tests) or at work (porn again, and maybe other non-work stuff, sometimes anti-exfiltration technology) but it could be your own AV software. It can't really do what it says on the tin, for a few reasons. You're going to get some false alerts this way because the certificate Steve (and Steve's web site) sees won't necessarily match the one you see, and if a sophisticated adversary was trying to defeat Steve's system they could just use the same technique to replace Steve's own site. Also as often happens with these little projects, it isn't properly maintained. The stuff about EV in Firefox (and I think Chrome too?) is no longer true.
- hamburglar 6y ago
  Ah, you're right, I didn't actually read through the alarmist stuff to see that he was referring to MITM proxies that actually install their own roots on your machines. Now I'm amused at the idea that there could be some off the shelf MITM proxy out there that simply does content editing to replace any occurrences of the FP of the real cert they're MITM'ing with the FP of the cert they generated for you on the fly. :D When I saw the alarmist stuff about knowing the cert fingerprints for certain sites a priori, I thought he'd invented a crazy ad hoc version of cert pinning and just rolled my eyes.
wnevets 6y ago
Ultimately Gibson was proven correct about raw sockets on Windows and they were removed a few years later [1] [1] http://www.interact-sw.co.uk/iangblog/2004/08/12/norawsockets http://www.interact-sw.co.uk/iangblog/2004/08/12/norawsocket...