Re: WOL security issue

On Mon, 24 Mar 2008 21:33:07 +0000 (UTC), dold@xxxxxxxxxxxxxxxx wrote:

Jeff Liebermann <jeffl@xxxxxxxxxx> wrote:
crash the machine). If your client has reported that machines are
magically turned on in the morning, when nobody is on, look for remote
control software, usually installed by employees that wanna do work at
home.

I've had a desktop turn on in the wee hours of the morning. No intentional
holes in the firewall, and WOL is off.

Haunted house? Need an exhorcism?

Critters playing on the keyboard? My previous cat would walk all over
the keyboard. It was an HP that a power on/off button on the
keyboard. I also found the machine turned on at odd hours.

It's not impossible to punch a hole in your firewall to use for WOL.
I've often suspected that UPnP can do that

I think it is a Windows XP PC set for "automatic updates" at said wee hour
of the morning that isn't actually off, only in standby.

Hmmm... That's possible, but I don't think so. I've got several of
mine set like that, with WOL active (and functional). I haven't seen
that problem on my machines or my customers.

There are many BIOS's that have a wake up from standby feature for
various inputs. Mine shows wake on modem ring, which might be the
culprit.

I don't know what process, if any, runs in "standby".

Standby means that machine is still running, but at the very lowest
CPU clock speeds and with all the peripherals powered down. In
effect, it's turned on, but in a low power mode.

Do scheduled tasks
wake up a machine from standby?

Yes, but only in standby. If in hibernate or powered down, no way.

--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558 jeffl@xxxxxxxxxxxxxxxxxxxxxx
# http://802.11junk.com jeffl@xxxxxxxxxx
# http://www.LearnByDestroying.com AE6KS
.