Ok, I dont know If I should post this but here goes.

I downloaded a program a couple of days ago, which we will call Program_A - it was a utility for scanning 254 hosts at a time for the NetBIOS port and reporting any open shares.

I would appreciate that this program remains anonymous!!

I scanned the subnet which is my neighbourhood cable service and found at least 7 PC's which had completely open shares, and connected with full access to the C: of peoples machines in my neighbourhood.

Being the person I am I simply left the machines alone as I was simply in it for the test.

It makes you realise that if I found out of the 254 machines, 7 machines that were unprotected, then do your calculations and you will soon notice that:

255*255*255*255 = 4,228,250,625 (not exactly that many but im doing a rough calculation)

so 254 machines = 7 totally open = 7/254 = 2.76%

So, 2.76% of the computers I scanned were completely open, now lets look at the whole world:

4,228,250,625 / 2.76% = 116,699,717

So, if we assumed all nodes on the internet were windows machines of home users, that would be over 116 million vulnerable machines.

Now accounting for unused IP's, other OS's, routers, switches, other devices, and generally non applicable IP's we can say maybe under 10% of those are open but think about it, thats still over 10 million machines just sitting there with completely open administrator passwords and open shares, just begging to be smacked with a trojan.

Originally posted by xtstrike
just sitting there with completely open administrator passwords and open shares, just begging to be smacked with a trojan.

Heh, no suprises there - I've just finished scanning my port sentry log for the day. 10 seconds into scrolling through it and you start to wonder what the net would be like if people looked after their own backyards a little better :)

Greg Moore

Originally posted by xtstrike
Now accounting for unused IP's, other OS's, routers, switches, other devices, and generally non applicable IP's we can say maybe under 10% of those are open

I'd put the figure closer to 1%. There's an awful lot of dark address space out there.

I think a netbios scanner, or just a port scanner is an important tool for internet security people and regular users to have. Security through obfuscation doesn't work. Everyone needs to know about the tools. And everyone needs to be more aware of what Windows File Sharing is, and how to disable it. Keeping the tools secret, so that only the illicit users are aware of them does not help the victims. IMHO.

I bet 99% of those computers who unknowingly have shares on the Internet are also infected with one of the viruses that spread that way.

If you watch TCP port 139, you'll probably get at least 2-3 hits a day from machines with viruses that are spreading through CIFS. Not to mention the occasional hit from the bored person having fun looking for people's harddrives to browse.