Hackers - What to look out for and prevention!?

Question

Hi, I was just looking through my logs and such and saw some alot of gobbly gook. It made me nervous. so I was wondering what are the main tips on detecting a Hacker, spotting Hacking attempts and prevention of Hackers?
I understand that I depends on what kit you have and such and that your computer has to make connections with others to use the internet but what do I and every other average Apple user need to look out for in logs on modems, firewalls and applications.
I personaly have looked at my logs on my Netgear Modem and logs on my System Profiler application. I see connections to various things but i'm no good at networking. All I know is to have my firewall on!
Also...I am always nervous when using Bit Torrent, do I have any need to be?
Thanks all ~ Joe
p.s - I have also read in other posts that posting log information is a dumb idea so have played safe and kept them to myself. So there's my tip! :)
PowerBook G4 15" - Sept 04- 1.5 GHz   Mac OS X (10.4.2)   Power Mac G4 1GHz DP - Airport Extreme - 2MBPS Broadband

Answer 1

It's not always true that an invalid access is an attack. For example, if your firewall application reports that the misused source port is a high port number, it might be a trigger packet. Some ISP may configure the servers system incorrectly or insufficiently. Some organization or a group of companies may send scanning packets to P2P users in a special way in order to improve heavy WAN traffics caused by P2P software users. You might mis-configure your modem or router firewall system or a built-in firewall has a bug, etc.
If a source port number is in the rage between 49152 and 65535, it is normally either dynamic or private ports. Dynamic ports are randomly assigned, and private ports are used by OS software or applications. By seeing any high ports with other logs events, you may guess whether someone attacks your node, about his/her skills/ability and the time zone. You may see one of high ports displaying on Netstat program for Network Utility application when pressing "Display the state of all current socket connections"-- udp4 0 0 localhost.xxxxx. Netstat may help to know who is on networks but not in real time. You need to refresh the button manually.
Here are two basic points:
* It is important to know yourself and think of your computer configurations before you start thinking who is there or your enemy.
* The most important matter in computer security is to be aware, and watch the systems carefully something most people do not do. For example, check if asl.log facility status with the level integer value displays differently from regular bases. If system.log or console.log reports that your computer name and the host name are changed, you may be facing to a serious security situation.
If you want to see whether your ISP blocks ports or you have opened ports, security scan service such as grc.com (Shields UP), dshield.org or seifried.org are available on the Internet.
Mac OS X Tiger built-in firewall (ipfw) has basic features. You can add rule-sets if you want. See for example here. Normally, you do not need to change the default rule-sets that blocks unwanted incoming packets.
Here is how to read about a log example for Mac OS X built-in firewall:
ipfw: 64000 Deny TCP 123.456.78.900:4990 444.555.66.777:1433 in via en1
The ipfw rule-set 64000 denies a Transmission Control Protocol IP packet sent by the source address 123.456.78.900 via the port number 4990 to attempt an invalid access to the destination address 444.555.66.777 targeting to the port 1433 in via your interface "AirPort." The destination address in this case is your local IP address, but not a remote IP address assigned for your ISP (for instance) node. The BSD device name for Built-in Ethernet interface is "en0." "en1" is used for AirPort or the first PCI Ethernet card if you install one.
You see the Mac OS X built-in firewall do not tell you the service name of a misused port number and the host name of the source IP address in real time. Therefore, it may be uncomfortable to analyze the background in details-- especially, if events of the firewall log would be flooded by access attempted every minute or more frequently. You may not even be able to send an e-mail to abuse team who is responsible for the source IP address net block to ask for the investigation if you want to do so. To send an enquiry has two meaning-- suggesting their server vulnerability or insufficient configuration and making a good use of their reply to your analysis.
In this case, an unassigned port number 4990 is misused by someone directly or indirectly (e.g. bot, botarmy, etc.) from the server 123.456.78.900, and the port 1433 for sniffing if a Microsoft SQL Server (Windows related) is running on your machine. There is also known history that some viruses try to exploit vulnerabilities in Microsoft SQL Server. The most known ports being misused in recent days are 8 (ICMP ping) 135, 139, 445 and ports for Trojan Horses and P2P technology driven software such as BitTorrent-- See also this world map, http://isc.sans.org/.
You may think about why bad IP packets pass through your ISP servers especially if servers are configured with a firewall system.
If you want to know more about Transmission Control Protocol specification, find "RFC 793" documentation on the Internet. All assigned port numbers document is available at www.iana.org.
If you are interested in third-party firewall, DoorStop X and Who's There are very good applications. You'll see it when you use their trial version with the full features.
Good firewall applications may protect your computer from various invalid access attempts but not for the real solution. Good packet analyzing (Sniffers) applications may help to inform you a result of analysis but not for the real solution. End-users, ISPs and the authorities need to run to the same direction together.