0

When diagnosing Internet connection issues (slow speed for example), an ISP technician may ask a user to connect their ISP-provided Ethernet cable directly to a device (typically a Windows PC) to run speed tests in the browser or pings, etc. (to rule out the possibility of the Router being the culprit).

What are the likely (realistic) as well as theoretical security implications in as far as getting access to the device / retrieving information from it (accessing files, etc.) under the following assumptions:

  • This is done for a short period of time ~ 30 minutes
  • The new network is identified as Public (in Windows UI)
  • Remote assistance is enabled
  • Windows built-in firewall is OFF, but third-party application-level firewall is enabled (restricts Internet access to apps).

And does this compromise saved passwords of network-mapped drives and locations (which are normally only accessible within LAN via the Router)?

1

If you only do that for a small time in order to test the connection, it should be fine; but it's better to use a spare PC with nothing important on it.

BTW, that "ISP-provided Ethernet cable" is definitely connected to a router somewhere, otherwise it would have no connectivity at all.

5
  • Thank you for your answer. Would ISP be able to sneakily access files on the computer in this scenario, provided default Windows settings for Public Network are enforced (File Sharing enabled, but no shares defined) and I did not specifically grant any access to things like remote assistance requests? – Fit Nerd Jan 17 at 18:05
  • 1
    No, by default you can't remotely access a Windows system if you don't have login credentials. It could be subject to an attack and that could be successful in some situations even if the system is properly configured, which is why systems are not routinely exposed on the Internet without protection. But a random PC connected for only half an hour of testing is very unlikely to be of interest to anyone. – Massimo Jan 17 at 18:24
  • Thank you for clarification. Would this affect network-mapped drives? That is if there are defined network-mapped drives on a windows system (with credentials), and then network changes (like in my example, instead of being connected to LAN via router, it is connected to ISP directly), would system try to reconnect those drives, thus exposing credentials (to ISP in this case)? – Fit Nerd Jan 17 at 19:11
  • 1
    The system will try to reconnect to network shares, but since it will not be able to find the server(s), this will fail well before a logon attempt can be made. Also, credentials are never exposed anyway on the network, only the destination server can receive them. – Massimo Jan 18 at 8:09
  • Thank you for the details. I have actually posted a more detailed question specifically on this issue: serverfault.com/questions/1050277/…, which if you are willing to provide an answer for the benefit of others in more depth, I would gladly accept. – Fit Nerd Jan 18 at 13:46
1

Keep in mind how the Internet is supposed to work:

  • every desktop and server gets a public, routable, IP address

And if you don't want someone connecting to services on your PC, then don't accept packets from subnets you don't want traffic from.

The issue, of course, is that some of your services running on the PC might have vulnerabilities (buffer overflows, faulty authentication, faulty authorization, etc)

So the brute-force answer is to firewall the PC.

  • you block people from the Internet compromising your server
  • and instead only allow people on your local network to compromise your server

Windows has a firewall itself - which is sufficient.
If you're paranoid, you can place another firewall in front of it.
And for the even more paranoid, they place a 3rd firewall in front of that.

tl;dr: Keep your firewall turned on

Bonus Chatter

NAT is not a security measure. Anyone thinking Network Address Translation provides security: they're doing it wrong.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.