Hacker News Reader

Comment by NikkiA | Hacker News Reader

Windows by default, un-firewalled, will announce its presence to a network, and in old versions, that could even be the internet at large (back then you could even see SMB shares over the internet and would often see thousands of 'nearby' system).

The malware he got appeared to use a PNG exploit to affect remote code execution once running, but we don't see what bootstrapped that malware into the system

View on HN

> Windows by default, un-firewalled, will announce its presence to a network, and in old versions, that could even be the internet at large

By announcements you are referring to broadcasts which are limited to the broadcast domain of whatever IP the ISP has assigned you. Plus those are largely blocked by the ISP beyond that.

So to say that you are broadcasting to the world that you have an SMB share available is not true. An attacker would have to scan for it (i.e. make an active connection to TCP port 445 on your machine).

This is the correct answer. Broadcast packets do not reach outside of a network segment. The “thousands” of Windows machines OP saw were probably part of the same office network they were sitting in (where other mechanisms may actually have made more of them visible than a simple broadcast would, but intentionally).

Sitting at home connected to the Internet over a point-to-point link, you’d see zero Windows machines that are not inside your home, now and back then.

When I got my first cable modem in maybe 1995, there were about half a dozen of my neighbors computers in Network Neighborhood. Most with unprotected shares and printers. Basically everyone running Windows on my C block. It got cleaned up within a few months tho.

Saw something similar at the summerhouse of a friend around 2008 or 2009. Somehow the whole neighborhood was in one giant LAN with one another there, sharing a common gateway to the internet? Around 30 or some such computers of neighbors showed up. Super weird.

Pre-cable modem era, the dialup networking "adapter" in Windows 95 was bound to "File and Print Sharing". People who had both a LAN and a modem could inadvertently "share" with the Internet.

I may or may not know something about sending print jobs that said "FEED ME CHEESE" in Figlet to inadvertantly shared printers and waiting for pings to stop coming back.

You’re lucky it was only a few months. I think it took until 1999 or 2000 for my cable isp to subnet their entire /16 so that you weren’t flooding the entire city with broadcast packets, getting random windows messaging service messages, etc.

That said, it was super nice to open Quake 3 and be able to plan LAN mode with anyone in town.

I stand corrected (sort of). I did specifically say that you‘d see zero other machines when connected to the Internet over a point-to-point link, but I indeed had no idea that in the US there were cable modems from different subscribers within the same subnet/segment and without any filtering.

In Germany, as far as I can tell it was all point-to-point.

That being said, around that time, or maybe slightly later, completely unencrypted WiFi networks were also commonplace, so…

Cable modem systems often ran with no broadcast filtering, and pretty big netmasks. Something like a /22 wouldn't be uncommon.

A local FTTH provider in my area does shockingly little broadcast filtering. It was interesting to see how much noise traffic was out here in the "business class" subnet that my Customer's static IP was coming out of.

Un-firewalled yes, but mostly behind NAT, so just everything from Internet to XP would not pass NAT.

Back in the XP days it wasn't uncommon to have your only computer directly connected to a modem (probably ADSL or Cable/Coax, but dial-up was also still around).

I'm not entirely sure when it became the norm for modems to have routers (and thus NAT) built-in, but I assume it coincided with the rise of smartphones around 2008. I certainly remember buying a separate wifi routers to connect to the single ethernet port of the modem even post-dialup.

My ISP didn't switch to combination devices until somewhere between 2013 (only got a modem) and 2018 (forced modem upgrade, included built-in router this time).

Back then (2000-2001) everyone I knew would buy a Netgear firewall with NAT.

Maybe it was my circle of friends but it was WELL UNDERSTOOD not to ever connect your machine directly to your ISP.

Common DSL providers back then were Telocity and Speakeasy.

I came of age with Windows 95 and friends... All my IRC friends pretty much dialed in directly to the internet from our main PC. When we got cable or DSL, if you had one computer, it got to connect directly.

Windows 98 Second Edition came with internet connection sharing, so you could dial up on one computer and share with the LAN, and I think it worked for cable/dsl with two NICs as well. Many of my circle ended up with a Linux (or BSD) box doing NAT too. There was other software to share on Windows if you didn't have 98SE.

Totally this.

You had one PC connecting to the DSL box, having directly a public IP, and then if you were smart you would install a second network card in your computer with a crossover Ethernet cable connecting to the second computer.

Routers were super expensive, they came only later when internet was democratized more.

Same for switches. Most users were using Ethernet Hubs at that time.

Home routers almost all had MAC cloning as well. ISPs would send a technician out to set up service and would only want to connect the modem to a single system. The modem would then lock onto that MAC and refuse to connect to other hosts.

So home routers would clone that system's MAC address on the WAN port so the shitty modems wouldn't complain.

At the time many broadband ISPs expected you to sign up a new broadband account for each connected machine. They'd balk if you mentioned connection sharing, I had an AT&T CSR go so far as to tell me it was illegal.

This idiocy subsided as WiFi became more common and added directly to home routers.

I've never had a technician come out to set up a broadband connection. It was always self-install.

I found my first NAT router: Netgear RT314 purchased in February 2001

Reply on news.ycombinator.com