2KKUU7ita

In This Chapter
▶ Port scanning Windows systems
Chapter 11
Windows
▶ Gleaning Windows information without logging in
▶ Catching the Windows 8 security flaws you don’t want to overlook
▶ Exploiting Windows vulnerabilities
▶ Minimizing Windows security risks
M icrosoft Windows (with such versions as Windows XP; Windows
Server 2012; Windows 7; and the newest flavor that many have yet to
warm up to, Windows 8) is the most widely used operating system (OS) in
the world. It’s also the most widely abused. Is this because Microsoft doesn’t
care as much about security as other OS vendors? The short answer is “no.”
Sure, numerous security flaws were overlooked — especially in the Windows
NT days — but Microsoft products are so pervasive throughout today’s networks
that Microsoft is the easiest vendor to pick on; therefore Microsoft
products often end up in the bad guys’ crosshairs. The one positive about
hackers is that they’re driving the requirement for better security!
Many of the security flaws in the headlines aren’t new. They’re variants of
vulnerabilities that have been around for a long time in UNIX and Linux, such
as the remote procedure call (RPC) vulnerabilities that the Blaster worm
exploited. You’ve heard the saying, “The more things change, the more they
stay the same.” That applies here, too. Most Windows attacks are preventable
if the patches are properly applied. Thus, poor security management is
often the real reason Windows attacks are successful, yet Microsoft takes the
blame and must carry the burden.
In addition to the password attacks I cover in Chapter 7, many other attacks
are possible against a Windows-based system. Tons of information can be
extracted from Windows by simply connecting to the system across a network
and using tools to pull out the information. Many of these tests don’t
even require you to be authenticated to the remote system. All someone with
malicious intent needs to find on your network is a vulnerable Windows computer
with a default configuration that’s not protected by such measures as a
personal firewall and the latest security patches.