I have read somewhere that it could be dangerous to use unknown
networks
When one mentions "unknown networks", it usually means some public networks like cybercafe, airports, and other public places. As long as you are speaking with your home, then the network is known because you have access to all configuration and under normal circumstances all connected devices are yours or at least known by you.
because the router owner could open ports and attack programs
that would run on the victim's system on precisely those ports.
A router owner can only open a port at the router level. It will not open the ports on your machine.
The router owner usually designate the person having access to the router configuration. In the context of your home, the router owner will be you. ISP actions concerning the router stops at publishing updates for the router firmware in order to solve bugs.
Concerning ISP's, as far as I know in all situations where the ISP was mandated by some government to spy over a user, the router was not involved. The ISP instead passively collect your Internet traffic on his side which is both easier and more discreet than trying to tamper with your home router.
To successfully reach your machine, three conditions need to be met simultaneously:
- The router must be configured to route traffic coming from the internet to your local machine,
- Your local firewall must be configured to accept such incoming traffic,
- You must have a software listening on the requested port.
Following your linked exchange, I need to stress a few things:
- What we are dealing now is really incoming connections. When you use Firefox, the initial connections goes from your local machine toward the Internet, then it is only replies which comes back from the Internet to your local machine. The router is perfectly in measure to distinguish a reply from a new incoming connection, so the fact that you are able to browse the web do not show in any way that anybody could bypass your router. By default, a router allows new connections only in one direction: from your local network to the Internet, and not the other way around.
- You mentioned a port being opened for file-sharing. Usually file-sharing is done on the local network, sharing the PC file to make them accessible on the tablet or the TV for instance. Such file sharing is not accessible from the Internet since the router will not let incoming connections pass through (step 1) in the above list).
- In the linked discussion you mention a video you saw on the Internet. Personally I saw a video explaining how to produce pop-corn using a cell-phone... Just do not trust anything you see or read on the Internet: a lot of stuff is just done by people needing to feel valued. Even when the thing becomes viral, even when a lot of people blindly trust it: the fact that a lot of people trust a lie is not sufficient to make it become true.
If you check your router configuration (usually a web interface), you should find options labelled "NAT" or "port-forwarding". These are the option defining whether connections incoming from the Internet should be forwarded to your local machine or discarded. By default all these options are disabled or empty.
I asked in the named forum if a firewall would protect me against such
types of attacks and received the reply that it would not.
The actual question from the linked discussion was translated as this:
In relation to the first case study (Port was opened and the used
file-sharing program has vulnerabilities that can exploit the
attacker) one more question: Offer me the software firewall protection
in such cases, or not?
This case study assumes that all prerequisites (the 1 2 3 above) are met to allow the incoming connection, ie. you have specially configured your router, machine and software to be reachable from the Internet. In other words, you are offering a service on the Internet.
In this case, you have specific security measures to take, the most important one being to carefully apply all your system and software update to ensure that all security flaws are corrected as soon as possible.
But indeed a firewall will not block an attacker targeting this service. A firewall main job is to block unauthorized traffic. As soon as you configure it to authorize such traffic, then a firewall will not bring any protection over it.
A firewall cannot distinguish by itself an attacker from a genuine user.
Now I am a bit confused because I asked here on StackExchange what I
should take care of in unknown networks and received a reply that I
should just take care of my firewall being setup correctly and
encrypting my outgoing network traffic.
- Check that your router's configuration to ensure that "NAT" or "port-forwarding" options are disabled or empty, this alone will be sufficient to bring a reasonable guaranty that nobody from the Internet will be able to reach your local machine.
- Check that the firewall on your local machine is enabled, usually together with automatic software update enabled to benefit from early patches,
- If you are often accessing the Internet in a really unknown network (the public places I mentioned in the beginning like cybercafes, airports, hotels, etc.), then you may be interested in VPN's. VPN services (you will find a bunch of them on the Internet with variable price depending on the proposed features) will create a tunnel between your machine and their server to it cannot be intercepted in the middle.
- Otherwise, simply ensuring that whenever you transmit any sensitive data your are doing it through a SSL/TLS-secured webpage (a padlock appearing at the left of the URL-bar, often accompanied by the URL-bar becoming green for corporate websites) is usually just fine.
