I am a little bit afraid about remote hacking, since I'm using a Windows 7. I see what a hacker can do if he exploits the DCOM vulnerability in Windows XP, but does this sort of exploit exist on Windows 7 or Windows 8? It other words, can hackers compromise a system with only knowing the IP address of my machine and get it hacked remotely like a Windows XP machine?

  • 3
    I think the answer is: there's no publicly known attack vector to compromise a vanilla installation of windows 7/8 computer by only knowing its IP". So there might be known attacks by NSA or similar groups, but are not public, and/or an attack might be found tomorrow. Windows has gone a long way and it's not any more the only popular attack vector. I think there are more chances that you'll compromise the computer by visiting a dodgy site using a slightly old version of a web browse / flash / java, pluging an USB device or just installing a cool tool that has a trojan inside. – Augusto Aug 17 '14 at 11:35

There are new hacks always happening. Here is one in particular that was rather famous. In the late 1990's there was the teardrop attack which was pre-packaged as 'win nuke' which would send a packet to an ip address. The name tear-drop comes from what it did: it created a bad packet, tore it into a pair of half-packets, sent them both to the target ip address. The incomplete packets would not be recognized by security apps and would 'drop it' past the firewall, where the error correction in the network interface would see a broken packet and sew it back up.

The win-nuke app that went all over the net would simply be used to send a packet to someone that would crash the network interface... (denial of service) 'nuke-ing' them off the net until they restarted their network connection. Rather than a 'kill' function, anything that could be sent in a network packet would conceivably be possible.

Ports 139 and 145 were the usual targets because they were vulnerable, so the end result for this particular attack was that they were blocked by firewalls.

Telnetting to a computer (netcat is a tool that people use to do this) to a specified port and sending corrupted data is still used. Just different ones. If you have figured already, this is not limited to windows.

| improve this answer | |
  • 1
    Many hacks that are ip-targetable, not just denial of service, are reliant on extra applications being installed such as a web server or database server. Connecting over the web port or db port -- or simply in a web browser, targeting a web server on a machine with a database installed like recently happened with the rash of Russian sql injection attacks just required the web server and database server of machines with those server apps running. Not on a vanilla install of course. – Jeff Clayton Aug 17 '14 at 16:56

A very common way today is to attack the system while you surf the web. These drive-by-downloads gets loaded by the browser when you visit a hacked web site or through advertisement networks ("malvertising"). Probably the most common attack vectors for drive-by-downloads are Flash, Java and Acrobat Reader plugin, but there are others too (other plugins, bug in the browser, bug in image libraries...).

Once the attacker has infiltrated your system with a small malware payload it will usually download more complex malware. The attacker does not need to know the IP address of your system because the downloading of the malware is initiated from your system.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.