[fw-wiz] Re: Blocking Kazaa

From: Boni Bruno (boni_at_dsw.net)
Date: 06/27/03

  • Next message: Jeff Falgout: "RE: [fw-wiz] Blocking Kazaa" 
    To: firewall-wizards@honor.icsalabs.com
Date: Fri, 27 Jun 2003 09:59:10 -0700

    Another alternative to proxies are transparent in-line IDS/IDP products.

    I've installed a few Netscreen IDP products that effectively
    deal with Kazaa, AIM, Yahoo IM, MS Messgener, Chat, etc.

    I believe the latest filter code from Tipping Point also offer
    protection to these services as well.

    Both are commercial products.

    Regards.

    -boni

    >
    > --__--__--
    >
    > Message: 1
    > From: "Bruce Smith" <bruce_the_loon@worldonline.co.za>
    > To: "Dante Fressone" <FressoneD@officenet.com>
    > Cc: <firewall-wizards@honor.icsalabs.com>
    > Subject: Re: [fw-wiz] Blocking Kazaa
    > Date: Thu, 26 Jun 2003 21:27:07 +0200
    >
    > I would add my voice to Paul's, setting a proxy up would solve your problem.
    >
    > We found that we successfully blocked new installations of Kazaa by blocking
    > TCP and UDP packets going to port 1214 and also, oddly enough, sourcing from
    > 1214 on the inside of our network. That coupled with a blanket port 80 block
    > has prevented new Kazaa instances from connecting. We've been purging the
    > existing installations by using the PS Tools package to remotely search and
    > destroy the Kazaa folder.
    >
    > Regards
    >
    > Bruce
    >
    >
    > ----- Original Message -----
    > From: "Paul Armstrong" <army@cyber.com.au>
    > To: "Dante Fressone" <FressoneD@officenet.com>
    > Cc: <firewall-wizards@honor.icsalabs.com>
    > Sent: Thursday, June 26, 2003 7:04 AM
    > Subject: Re: [fw-wiz] Blocking Kazaa
    >
    >
    >
    >>On Wed, Jun 25, 2003 at 03:20:54PM -0300, Dante Fressone wrote:
    >>
    >>>Hi, I want to block kazaa from my pix fw blocking port 1214 TCP, but it
    >>>seems like it's using port 80 now,,,,and I can't drop that port because
    >
    > web
    >
    >>>wont work.....
    >>>
    >>>Any ideas?
    >>
    >>Use a HTTP proxy such as Squid and only allow traffic to port 80 from the
    >>proxy.
    >>
    >>This has other advantages such as faster response time for cached objects,
    >>general filtering (e.g. if your policy says people aren't allowed to
    >
    > download
    >
    >>anything with a .vbs extension) and will save you money if you pay by the
    >
    > byte
    >
    >>(or if you pay for pipe size and the traffic reduction means you don't
    >
    > need
    >
    >>such a large pipe).
    >>
    >>Paul
    >>_______________________________________________
    >>firewall-wizards mailing list
    >>firewall-wizards@honor.icsalabs.com
    >>http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    >
    >
    >
    > --__--__--
    >
    > Message: 2
    > From: Ste Jones <root@networkpenetration.com>
    > To: firewall-wizards@honor.icsalabs.com
    > Date: Thu, 26 Jun 2003 23:36:35 +0100
    > Reply-To: root@networkpenetration.com
    > Organization: Network Penetration
    > Subject: [fw-wiz] Distributed port scanning using OpenBSD's packet filter
    >
    > By using openBSD's packet filter pf one can utilize the NAT address pools added into OpenBSD 3.3 to aid in distributed port scanning.
    >
    > http://www.networkpenetration.com/pfdistnatscan.html
    >
    > --
    > ste jones
    > root@networkpenetration.com
    >
    >
    >
    >
    > --__--__--
    >
    > Message: 3
    > From: "Danny Salinas" <salinasd@harlingen.isd.tenet.edu>
    > To: <firewall-wizards@honor.icsalabs.com>
    > Subject: RE: [fw-wiz] Blocking Kazaa
    > Date: Thu, 26 Jun 2003 08:25:52 -0500
    >
    > You might try blocking the destination ip address. I think the kazaa
    > application tries to contact the "mother ship" every time it fires up.
    >
    > Hope this helps..
    > Danny Salinas
    >
    > Network Specialist
    > Harlingen C.I.S.D.
    >
    > -----Original Message-----
    > From: firewall-wizards-admin@honor.icsalabs.com
    > [mailto:firewall-wizards-admin@honor.icsalabs.com]On Behalf Of Dante
    > Fressone
    > Sent: Wednesday, June 25, 2003 1:21 PM
    > To: firewall-wizards@honor.icsalabs.com
    > Subject: [fw-wiz] Blocking Kazaa
    >
    >
    > Hi, I want to block kazaa from my pix fw blocking port 1214 TCP, but it
    > seems like it's using port 80 now,,,,and I can't drop that port because web
    > wont work.....
    >
    >
    > Any ideas?
    >
    >
    > Thanks!
    >
    >
    > Dante Fressone
    > Networking
    > e-mail: fressoned@officenet.com
    > Tel: 54-(11)-4126-2728
    >
    > _______________________________________________
    > firewall-wizards mailing list
    > firewall-wizards@honor.icsalabs.com
    > http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    >
    >
    > --__--__--
    >
    > Message: 4
    > Subject: RE: [fw-wiz] Blocking Kazaa
    > Date: Thu, 26 Jun 2003 08:43:31 -0500
    > From: "James Baumgardner" <jbaumgardner@primarycarenet.org>
    > To: <firewall-wizards@honor.icsalabs.com>
    >
    > I can't seem to find anything that isn't commercial (expensive) to help
    > me out with this, so I just have to monitor, slap hand, monitor ...
    > Rinse ... Repeat. =20
    >
    > I would love to hear if someone has a way to block it with a PIX.
    >
    > -----Original Message-----
    > From: Dante Fressone [mailto:FressoneD@officenet.com]=20
    > Sent: Wednesday, June 25, 2003 1:21 PM
    > To: firewall-wizards@honor.icsalabs.com
    > Subject: [fw-wiz] Blocking Kazaa
    >
    >
    > Hi, I want to block kazaa from my pix fw blocking port 1214 TCP, but it
    > seems like it's using port 80 now,,,,and I can't drop that port because
    > web wont work.....
    >
    >
    > Any ideas?
    >
    >
    > Thanks!
    >
    >
    > Dante Fressone
    > Networking
    > e-mail: fressoned@officenet.com
    > Tel: 54-(11)-4126-2728
    >
    > _______________________________________________
    > firewall-wizards mailing list firewall-wizards@honor.icsalabs.com
    > http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    >
    > --__--__--
    >
    > Message: 5
    > Date: Thu, 26 Jun 2003 16:08:59 -0400
    > From: "Pettus, Duane R." <dpettus@GryphonLC.com>
    > To: <firewall-wizards@nfr.net>
    > Subject: [fw-wiz] I am having a problem with check point and I need a little help
    >
    > Yeah, I was having a problem with this checkpoint crap. =20
    > My firewall server when connected to the checkpoint services on any =
    > internal NIC Card will not open a web page.=20
    >
    > Let me give you the run down:
    >
    > 1 2000 server (Running Check point) (10.0.0.100-internal network ; =
    > 127.0.0.1-external network ; 10.20.0.1 - DMZ )
    > 1 workstation (10.0.0.1 internal)
    > 1 workstation (10.20.0.2 web server)
    > 1 2003 server (10.0.0.3)
    > 1 workstation simulating the internet (172.0.0.2 & connection to the =
    > internet & DNS for the test environment)
    >
    > This is not a problem when I just have the Checkpoint service running on =
    > the external card ONLY.=20
    >
    > When I turn the service off of the internal cards (10.0.0.100 and =
    > 10.20.0.1), I can tracert, ping open a website and it opens correctly.=20
    >
    > When I turn the service on the internal cards (10.0.0.100 and =
    > 10.20.0.1), I can tracert, ping but I cannot open a web page. =20
    >
    > I am allowing everything on the firewall. It can resolves the web-site =
    > (I see that at the bottom), it has the ability of resolving the host =
    > name because I can resolve the name in the ping, but it will not open =
    > the web page. If I put in the ip address of the website it will not =
    > open that either
    >
    > I have a rule that states to all everything from the internal network
    > I have a stealth rule and a cleanup rule that is it.
    >
    >
    >
    >
    > Duane R. Pettus
    > Gryphon Technologies
    > Sr. Network Administrator
    > dpettus@gryphonlc.com
    > 240-387-1000 x409 work
    > 301-675-0439 cell
    > www.gryphonlc.com
    >
    >
    > --__--__--
    >
    > Message: 6
    > Date: Fri, 27 Jun 2003 08:57:07 -0400 (EDT)
    > From: Paul Robertson <proberts@patriot.net>
    > To: Dante Fressone <FressoneD@officenet.com>
    > Cc: firewall-wizards@honor.icsalabs.com
    > Subject: Re: [fw-wiz] Blocking Kazaa
    >
    > On Wed, 25 Jun 2003, Dante Fressone wrote:
    >
    >
    >>Hi, I want to block kazaa from my pix fw blocking port 1214 TCP, but it
    >>seems like it's using port 80 now,,,,and I can't drop that port because web
    >>wont work.....
    >
    >
    > http://honor.trusecure.com/pipermail/firewall-wizards/2002-December/013694.html
    >
    > Also, snort's been mentioned in conjunction with killing the connections,
    > so you might want to search on that too too.
    >
    > Paul
    > -----------------------------------------------------------------------------
    > Paul D. Robertson "My statements in this message are personal opinions
    > proberts@patriot.net which may have no basis whatsoever in fact."
    > probertson@trusecure.com Director of Risk Assessment TruSecure Corporation
    >
    >
    > --__--__--
    >
    > Message: 7
    > Subject: Re: [fw-wiz] Application Intelligent vs ALG
    > To: Frederick M Avolio <fred@avolio.com>
    > Cc: firewall-wizards@honor.icsalabs.com
    > From: SimonChan@lifeisgreat.com.sg
    > Date: Wed, 25 Jun 2003 19:41:41 +0800
    >
    >
    > Hi all,
    >
    > I would like to thank all for sharing their valuable views on this matter.
    >
    > For the benefit of the rest of the folks, the answer is in volume 4 of
    > Information Security Managment Handbook Chapter 9 - an examination of
    > Firewall Architectures.
    >
    > ;-)
    >
    >
    >
    > Rgds,
    >
    > Simon Chan, MCP/MCSA/CCNA/CCSA/WCSP
    > Senior Security Engineer
    > Great Eastern Life Assurance Co. Ltd.
    >
    > ------------------------------------------------------------------------------------
    >
    > "My statements in this message are personal opinions
    > which may have no basis whatsoever in fact."
    >
    >
    >
    >
    > Frederick M Avolio
    > <fred@avolio.com> To: SimonChan@lifeisgreat.com.sg,
    > Sent by: firewall-wizards@honor.icsalabs.com
    > firewall-wizards-admin@honor.ic cc:
    > salabs.com Subject: Re: [fw-wiz] Application Intelligent vs ALG
    >
    >
    > 06/23/2003 09:18 PM
    >
    >
    >
    >
    >
    >
    > A fancy proxy.
    >
    > Three different people from Check Point wrote me in response to a recent
    > column of mine, basically asking me if I had heard of this new feature.
    >
    > I replied with a brief history. In short: Firewall-1 comes on the scene,
    > most FW1 users implement it with modules from the TIS FWTK (for adding user
    >
    > authentication to FTP and TELNET), Check Point's marketing says proxies are
    >
    > old technology, stateful inspection is the next generation of firewall
    > technology (before the term became a product name), people persisted in
    > using proxies, CP added "security servers" (proxies by another name), and
    > now this.
    >
    > I asked them, how is this different from application gateways (security
    > proxies). I applaud the addition of them (like there are other hybrid
    > firewalls). But none of the three folks from CP replied to me.
    >
    > I have no agenda, except the truth. (Boy, is this guy noble, or what? :-))
    > I'd like to know the answer to this: How this is different than application
    >
    > gateways (if it is), and why is it better than Sidewinder, Firebox, Raptor,
    >
    > et al.
    >
    >
    > Fred
    > Avolio Consulting, Inc.
    > 16228 Frederick Road, PO Box 609, Lisbon, MD 21765, US
    > +1 410-309-6910 (voice) +1 410-309-6911 (fax)
    > http://www.avolio.com/
    > PGP Key Fingerprint: 928D 0903 934F 8CFA 6124
    > BBF6 0B45 93C7 3521 CEA0
    >
    > _______________________________________________
    > firewall-wizards mailing list
    > firewall-wizards@honor.icsalabs.com
    > http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    >
    >
    >
    >
    >
    > --__--__--
    >
    > Message: 8
    > Date: Wed, 25 Jun 2003 22:31:44 -0700 (PDT)
    > From: James Cutter <JamesCutter@thedoghousemail.com>
    > To: firewall-wizards@honor.icsalabs.com
    > Cc: fressoned@officenet.com
    > Subject: RE: [fw-wiz] Blocking Kazaa
    > Reply-To: JamesCutter@thedoghousemail.com
    >
    > PIX can't do this. Other Cisco gear can't as well.
    > There is a Peer to Peer firewall from Akonix (http://www.akonix.com/ ) that you can use.
    >
    > another option that you might want to try is checkpoint NG (starting at FP3) that can block Peer-to-Peer (including kazaa) applications traversing the firewall on port 80.
    >
    >
    > Original message:
    >
    >
    > Hi, I want to block kazaa from my pix fw blocking port 1214 TCP, but it seems like it's using port 80 now,,,,and I can't drop that port because web wont work.....
    >
    >
    > Any ideas?
    >
    >
    > Thanks!
    >
    >
    > Dante Fressone
    > Networking
    > e-mail: fressoned@officenet.com
    > Tel: 54-(11)-4126-2728
    >
    > _______________________________________________
    > firewall-wizards mailing list firewall-wizards@honor.icsalabs.com
    > http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    >
    >
    > _____________________________________________________________
    > Get your FREE TheDoghouseMail email address at http://www.thedoghousemail.com
    >
    > _____________________________________________________________
    > Select your own custom email address for FREE! Get you@yourchoice.com, No Ads, 6MB, IMAP, POP, SMTP & more! http://www.everyone.net/selectmail?campaign=tag
    >
    > --__--__--
    >
    > Message: 9
    > Subject: RE: [fw-wiz] Blocking Kazaa
    > Date: Fri, 27 Jun 2003 09:24:47 -0400
    > From: "Whiteside, Larry [contractor]" <BAE14@SPHQ.SSP.NAVY.MIL>
    > To: <firewall-wizards@honor.icsalabs.com>
    >
    > Due to the way Kazaa functions it is going to be hard to block it via =
    > the traditional blocking methods (ports, protocols). The best way to =
    > defend against this type of issue is POLICY. I would go straight to the =
    > Executives and explain the problem (legality, viruses, trojans, etc.). =
    > This is to help facilitate them approving a policy quickly. Once it has =
    > been approved get it on the street and begin to punish those people that =
    > are breaking the policy. Once a few folks realize this could get them in =
    > trouble, it will cut it out. With the economy the way it is the one =
    > leverage you have is no one wants to lose their job.
    >
    > L
    > ***************************
    > Larry Whiteside Jr.
    > Sr. Security Engineer/Security Program Manager
    >
    >
    >
    > -----Original Message-----
    > From: James Baumgardner [mailto:jbaumgardner@primarycarenet.org]
    > Sent: Thursday, June 26, 2003 9:44 AM
    > To: firewall-wizards@honor.icsalabs.com
    > Subject: RE: [fw-wiz] Blocking Kazaa
    >
    >
    > I can't seem to find anything that isn't commercial (expensive) to help
    > me out with this, so I just have to monitor, slap hand, monitor ...
    > Rinse ... Repeat. =20
    >
    > I would love to hear if someone has a way to block it with a PIX.
    >
    > -----Original Message-----
    > From: Dante Fressone [mailto:FressoneD@officenet.com]=20
    > Sent: Wednesday, June 25, 2003 1:21 PM
    > To: firewall-wizards@honor.icsalabs.com
    > Subject: [fw-wiz] Blocking Kazaa
    >
    >
    > Hi, I want to block kazaa from my pix fw blocking port 1214 TCP, but it
    > seems like it's using port 80 now,,,,and I can't drop that port because
    > web wont work.....
    >
    >
    > Any ideas?
    >
    >
    > Thanks!
    >
    >
    > Dante Fressone
    > Networking
    > e-mail: fressoned@officenet.com
    > Tel: 54-(11)-4126-2728
    >
    > _______________________________________________
    > firewall-wizards mailing list firewall-wizards@honor.icsalabs.com
    > http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    > _______________________________________________
    > firewall-wizards mailing list
    > firewall-wizards@honor.icsalabs.com
    > http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    >
    >
    > --__--__--
    >
    > _______________________________________________
    > firewall-wizards mailing list
    > firewall-wizards@honor.icsalabs.com
    > http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    >
    >
    > End of firewall-wizards Digest 

    -- 
Boni Bruno, CISSP, IAM
Chief Technology & Security Officer
P:818.226.1773 F:818.883.4604
6110 Variel Avenue, Woodland Hills, CA
www.dsw.net
_____________________________________________________
Data Systems Worldwide 
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
  • Next message: Jeff Falgout: "RE: [fw-wiz] Blocking Kazaa"

    Relevant Pages

    • Re: Port 3060? What in the hell is going on?
      ... >> a service that expects return traffic to port 3060, ... but since I do not use or allow Kazaa anywhere ... > on my network, there is no reason that someone ... Kazaa site and set rules with my Watchguard FW appliance and block all ...
      (comp.security.firewalls)
    • Re: Kazaa Block !
      ... >> security breach, but worse, it is a blatant abuse of work computers. ... >> If this is a home LAN, and these are your children, ground them first, ... >> block KaZaA from their computers, ... > goes over port 80. ...
      (comp.security.firewalls)
    • Re: Kazaa Block !
      ... >>> security breach, but worse, it is a blatant abuse of work computers. ... >> goes over port 80. ... >> to a kazaa server and then to the other client to ... >> bad guy by uninstalling software and talking to boss. ...
      (comp.security.firewalls)
    • Re: Strange back-orifice looking scan...
      ... Port 1214 used by Kazaa aka Morpheus, this is obviously the remote port that ... a/ He/she has somehow manipulated Kazaa to scan not for other Kazaa users on ... actively portscanning either your network I wasnt sure if it was a network ... MSN Photos is the easiest way to share and print your photos: ...
      (Incidents)
    • RE: Stopping File Sharing Programs...
      ... Make it corporate policy that these programs are not permitted ... application layer firewalls will not actually block these guys over port 80. ... then when your IDS sees a user using one of the ... Kazaa by blocking the port 1214. ...
      (Security-Basics)
    • Quantcast