Light passing through the perforated grid of a server rack door

Security, Viruses, Trojans

The security notes in this archive are operational rather than strategic. They were written between 2007 and 2010 by someone defending small Windows estates with the tools that came in the box, and they show it: IPsec policies used as a poor administrator's firewall, ICMP and firewall profiles, password policy, SSL certificates, response-header hardening, compromised-server post-mortems, and anti-malware products that broke working machines by mistake.

Why this section looks the way it does

The defining constraint of the period is visible in almost every note here: a co-located Windows server frequently had no hardware firewall in front of it, and commercial software firewalls were expensive. The response was to use what Windows already had. That is the whole premise of blocking IP addresses using IP Security Policy in Windows Server 2003 — the IPsec policy snap-in as a general-purpose block list, applied once across every service rather than separately in IIS and SMTP. The same constraint produced the notes on TCP/IP filtering and on enabling ping replies in Windows Server 2008, which is really a note about which firewall profile a rule lands in and why the default is closed.

The second theme is compromise. Several notes are post-mortems on servers that were broken into, including a mass injection of redirect script into pages on IIS 6, and one broader piece asking why so many Windows servers were compromised at all — whose answer, then as now, is mostly unpatched components and reused credentials rather than anything exotic.

The third theme is the security product itself as a hazard. The clearest case is the 2009 note on a Malwarebytes false positive against atapi.sys, in which an anti-malware product flagged a required storage driver and removing it left the machine unbootable with a stop error. That episode is worth remembering as a general lesson rather than a specific one: a detection engine acting on a core operating-system file is a change with the blast radius of a bad patch, and the same class of incident has recurred many times since with different vendors.

What has changed since

Everything version-specific here is obsolete, and some of it is now poor advice. The certificate comparison predates the industry's move away from SHA-1 and the arrival of free automated issuance, so its conclusions no longer hold. netsh firewall was deprecated in favour of netsh advfirewall, and the current firewall is documented as Windows Defender Firewall. Content-filtering by browser feature, which one 2009 note uses, is not a control anyone should rely on now.

The reasoning transfers better than the mechanisms. Two principles run through the section and are still sound: reduce the surface a service presents before hardening what remains, and treat every security control as something that can itself fail dangerously. For current baselines, NIST Special Publication 800-123, Guide to General Server Security covers the same ground the archive covers informally, and the CISA Known Exploited Vulnerabilities catalogue is the practical modern answer to the patching question the compromised-server notes keep circling.

Web-server hardening notes such as the response-header material are also filed under Internet Information Server, and the operating-system-level controls under Windows and Server.

Notes filed under Security, Viruses, Trojans

Linked titles are restored pages. Plain titles are a record of what was published at that URL; the full corpus is indexed in the complete post archive.

23 May 2007 — Windows 2003 Password Tips
7 June 2007 — TCP/IP Filtering for Windows
11 June 2007 — SSL Certificate Comparison
6 July 2007 — Stop vBulletin and WordPress Spam
24 September 2007 — Windows Server 2003 Password Policy Changes
12 March 2008 — What Is prisoner.iana.org?
17 March 2008 — Windows TCP/IP Service Worm, and Uninstalling TCP/IP on a Domain Controller
18 March 2008 — JavaScript Spyware Redirect for IIS 6 (Malware)
23 June 2008 — Windows XP / 2003 / Vista Password Recovery
31 August 2008 — 1,000,000s of Spam Comments
10 September 2008 — Hacking the Trend Micro Security Dashboard for SMB
11 September 2008 — Trend Micro vs Malwarebytes Anti-Malware
25 October 2008 — Cisco ASA and PIX Vulnerabilities
30 November 2008 — A Free Way to Block Facebook or Other Websites
12 March 2009 — Using the IE Content Advisor to Block All Internet Access
7 November 2009 — Why are so many Windows Servers compromised?
10 November 2009 — Block IP Addresses using IP Security Policy in Windows Server 2003
11 November 2009 — Remove X-Powered-By: ASP.NET HTTP Response Header
11 November 2009 — Malwarebytes, atapi.sys and Registry False Positives
12 November 2009 — Are People the Weakest Point in IT Security?
22 February 2010 — Blue Screen (BSOD) With MS Patch 977165, Caused by the Alureon Rootkit
26 March 2010 — Removing the VMware Server SSL Certificate Trust Warning
20 July 2010 — Enabling Ping Replies in Windows Server 2008 and R2