Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?

retrocomputing.stackexchange.com

Post reply on HN
Print view View original

61–70 of 111 posts

Re: Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?

#61

Post by eterm »

owenmarshall wrote: post #56
wazoox wrote: post #44

Earlier quoted context omitted.

IIRC Windows XP up to SP2 was vulnerable to this. Basically if you ran the install with the DSL modem attached, your PC was compromised even before the end of setup.

When W32/Blaster[0] came out I worked at a small ISP doing tech support and computer repair. A tech and I imaged an old box we had in the corner with a clean XP, assigned it a static IP in our /24, plugged it in and started a stopwatch. It didn’t even make it two minutes before it was infected. [0] https://en.m.wikipedia.org/wiki/Blaster_(computer_worm)

Yeah Blaster is one of the few worms I've ever (knowingly) been infected with. As you say, it was literally less than a minute or two between connecting an unpatched box and getting it.

Re: Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?

#62

Post by dboreham »

Circuitstorm513 wrote: post #39
H8crilA wrote: post #19

Earlier quoted context omitted.

Remember when Win95 could be crashed or even rooted just by pinging it the right way? We really have come a long way. https://en.wikipedia.org/wiki/Ping_of_death I also remember SMB vulnerabilities that stayed unpatched for years on some machines. That was already when Metasploit existed, so you could inject VNC into most Windows hosts on local network with just a few commands. These days at least the patching is sup…

Earlier versions of Windows (98? 95?) also used to share things like drives (C$, D$) and printers with the dial-up connection by default. I remember connecting to a printer of a classmate over the internet and printing a page, to his surprise. All you needed was the IP, which was trivial to get from ICQ, back in the days.

There was a time when you could SMB mount shares from servers at MS over the public internet (and e.g. do things like download alphas and betas that were not visible on the ftp server).

Re: Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?

#63

Post by pixl97 »

owenmarshall wrote: post #56
wazoox wrote: post #44

Earlier quoted context omitted.

IIRC Windows XP up to SP2 was vulnerable to this. Basically if you ran the install with the DSL modem attached, your PC was compromised even before the end of setup.

When W32/Blaster[0] came out I worked at a small ISP doing tech support and computer repair. A tech and I imaged an old box we had in the corner with a clean XP, assigned it a static IP in our /24, plugged it in and started a stopwatch. It didn’t even make it two minutes before it was infected. [0] https://en.m.wikipedia.org/wiki/Blaster_(computer_worm)

I was working for a small ISP in that time frame and that's when we started blocking incoming windows ports. And yea, it was annoying for the few techie types that tried to run SMB and could actually protect their stuff.

For the other 99.9% percent of the users it protected them and us.

Windows was such a mess back then.

Re: Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?

#64

Post by qingcharles »

keepamovin wrote: post #54

Ah, the retro-computing rabbit hole. Harmlessly divorced from any real-world consequences, but truly satisfying nonetheless. A real honey trap for nerds. I just had to click that 6 more comments expander

I just about managed to snatch my cursor away as I saw it heading towards that expander. Might get some work done today!

Re: Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?

#65

Post by tivert »

cm2187 wrote: post #22
H8crilA wrote: post #19

Earlier quoted context omitted.

Remember when Win95 could be crashed or even rooted just by pinging it the right way? We really have come a long way. https://en.wikipedia.org/wiki/Ping_of_death I also remember SMB vulnerabilities that stayed unpatched for years on some machines. That was already when Metasploit existed, so you could inject VNC into most Windows hosts on local network with just a few commands. These days at least the patching is sup…

I remember those days. Even into the late 90s early 2000, modems (including ADSL) didn't come with a router, you had to establish a PPPoE connection from your computer, which also means your home machine was directly on the WAN with no firewall protection. I can't remember which version of windows but it must have been 98 or ME, you had to rush to download and install a patch when you connected it first to the intern…

> Even into the late 90s early 2000, modems (including ADSL) didn't come with a router, you had to establish a PPPoE connection from your computer, which also means your home machine was directly on the WAN with no firewall protection.

Even today modems don't always come with a routers. In fact, I like them that way :).

IIRC, the problem in the late 90s/early 2000s was routers were thought of as only necessary to get multiple computers online, and it was pretty common for people households to only own a single desktop. There wasn't enough security consciousness earned through repeated failure, so it "made sense" to direct connect consumer machines to the internet.

We actually had a LAN years before we had broadband, and I setup a PC running Linux as a router to share our 33.6 modem to the household. But before that? The PC direct dials into the ISP, and got a publicly-routable IP.

Re: Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?

#67

Post by MBCook »

H8crilA wrote: post #32
pjgalbraith wrote: post #21

Earlier quoted context omitted.

He does mention a bit more in a hidden comment: "NTOSKRNL.EXE + debug symbols + IDA helped me understand how the remote break-in is supposed to work. I knew that something in the remote break-in code path before the first debug packet is sent is going to reboot my machine. So I patched "JMP SHORT $" instructions into the relevant code-path. If I placed it before the crash point, the machine hangs. If I placed it afte…

Not sure why this is downvoted, the comment is on point. Is it because it is partly gpt-generated content? I wonder if patching memory worked in the debugger, if not this would have to be done by manually editing the kernel file with IDA or something, and rebooting the machine. But in either case this is a good way to find the problem.

That’s likely. ChatGPT is not reliable, dumping its explanation of an issue isn’t valuable. It’s noise.

Everything in the comment before that was great, no reason vote it down for that.

Re: Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?

#68

Post by JohnFen »

tivert wrote: post #65
cm2187 wrote: post #22

Earlier quoted context omitted.

I remember those days. Even into the late 90s early 2000, modems (including ADSL) didn't come with a router, you had to establish a PPPoE connection from your computer, which also means your home machine was directly on the WAN with no firewall protection. I can't remember which version of windows but it must have been 98 or ME, you had to rush to download and install a patch when you connected it first to the intern…

> Even into the late 90s early 2000, modems (including ADSL) didn't come with a router, you had to establish a PPPoE connection from your computer, which also means your home machine was directly on the WAN with no firewall protection. Even today modems don't always come with a routers. In fact, I like them that way :). IIRC, the problem in the late 90s/early 2000s was routers were thought of as only necessary to get…

> Even today modems don't always come with a routers. In fact, I like them that way :).

I agree. I have a better router that I'm going to use anyway, so I disable the router functionality in the modem if it has one.

My current one has no router or WiFi. Perfect!

Re: Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?

#69

Post by z500 »

keepamovin wrote: post #54

Ah, the retro-computing rabbit hole. Harmlessly divorced from any real-world consequences, but truly satisfying nonetheless. A real honey trap for nerds. I just had to click that 6 more comments expander

Tech history is basically crack.

Re: Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?

#70

Post by JohnFen »

mistrial9 wrote: post #58
pcdoodle wrote: post #55

Earlier quoted context omitted.

LSASS.exe would crash with about 5 minutes of IBR (Internet Background Radiation). I cant remember the name of the worm. XP SP3 fixed this.

> IBR (Internet Background Radiation) that is really unpleasant.. engineers worked, companies worked and volunteers also worked to make the modern Internet, then selfish-clever, thieving, control-oriented militaristic jerks from WINDOWS filled the content with WINDOWS virus activity to play cheap stealing tricks on unsuspecting people. And you call it "the Internet" .. it has nothing to do with "the Internet" as much…

Windows deserves a lot of criticism, but let's be honest and fair here... this would have been the case regardless of what OS was dominant.
Post reply on HN