RE: unwelcome downloads (sorta long)

[jknebel -at- ospreyus -dot- com]

Jo and other Techwr-Lrs,

I went and spoke to our Technical Architects in our Hosting Practice, and
they gave me the following unsettling answer.

Yes, this can be done easily. It uses the same technology as some viruses
do. 

Software is available that scans the internet for open ports (either at an
ISP, a personal computer, etc.) once they locate an open port, they can push
unwanted content onto your computer.

So, they suggested installing a firewall (which several are available as
freeware/shareware or really cheap for personal use)

By having file sharing turned on (which I don't know if you do), and being
connected to the internet you open yourself up for these kinds of attacks.
It's something to be aware of, and cautious about.

Hope this helps,
Jhan 
(Glad that I am working closely with the Hosting practice right now!)
**************************
Jhan A. Knebel
Technical Writer, Enterprise Management Solutions
jknebel -at- ospreyUS -dot- com		(704) 943-7950
http://www.ospreyUS.com


-----Original Message-----
From: Jo Francis Byrd [mailto:jbyrd -at- byrdwrites -dot- com]
Sent: Friday, June 30, 2000 9:17 AM
To: TECHWR-L
Subject: OT: unwelcome downloads (sorta long)


Cross posted to Techwr-L and WinHlp

I connect to my IPS via a dialup modem. Twice in the past couple of
weeks, I've not disconnected from my ISP and left the connection open
all night. The first time, I got distracted and simply forgot to
disconnect. The second time was deliberate as I was sending across a
HUGE file to the client site and it took, well maybe not forever, but
darned close. Both times I came in the next morning and noticed an
additional icon on my desktop. Now, since I'm one of those who stores
all her icons on the taskbar and have only the Recycle Bin and My
Computer on the desktop, new ones are VERY apparent.

The first time this happened, I was puzzled by this icon, one I didn't
recognize, and, like a total idiot, no excuses, unfortunately,
double-clicked it. It started to install something which I suspect to
be, at best, soft porn. Canceled the setup, banished it immediately to
the Recycle Bin (Get thee to the Recycle Bin, do not pass Go, do not
collect $200). At this time I thought I must have accidentally clicked
something to cause the download (I had been out on the 'Net looking for
something the night before).

Night before last, it was late, and I went to bed, leaving the
connection open so I could e-mail the file across (SLOWLY, the ISP must
have been running on geologic time) to the client site where I had to go
the next morning. Came in yesterday morning, I was still connected, and
there was that damned icon on my desktop again, and this time I KNEW I
did nothing to initiate the download!

When I got home from the client site yesterday evening, I called my ISP
and asked them what's going on that I'm getting this unwelcome download.
The tech claimed there was no way it could have come through without
permission or action on my part (excuse me, but it did! The only humans
were in bed asleep, and the dogs don't show any interest in the
computer).  At the tech's request, I retrieved the thing from the
Recycle Bin and e-mailed it to him - with case number and CYA text. It's
apparently some sort of portal to a porn site. Needless to say, I don't
want the nasty thing, and I obviously need to start seriously
investigating firewalls.

My question, does anyone out there know how the host site is managing to
do this, and how I can find out where it's coming from (and maybe get it
stopped before some innocent kid gets exposed to the filth)? It's
apparently programmed to work during the wee hours when the weary are
supposedly sound asleep, snug in their beds. I suspect there's some
money involved somewhere, and the slimballs behind it must get enough
bites from interested perverts to make it worth the bother - or maybe
risk is a better word.

Thanks!

Jo Byrd