RE: [Full-Disclosure] How to easily bypass a firewall...

From: Sir Humpsalot (sirhumpsalot97_at_hotmail.com)
Date: 07/30/03

  • Next message: Len Rose: "[Full-Disclosure] Administrivia: 10 messages delayed" 
    To: full-disclosure@lists.netsys.com
Date: Wed, 30 Jul 2003 04:27:17 +0200

    > > At 03:49 PM 7/28/2003 -0500, you wrote:
    > > >5. Firewall dialog box uses random numbers / letters represented by
    > > >graphics that the user has to enter in a password field if
    > > the password
    > > >is not correct sound alarm, halt system.
    > >
    > > know of anything that does this?
    > >
    >Would it matter? The scenario that was proposed is that there's a
    >trojan on the box, and it can attempt certain methods of
    >programmatically disabling the firewall. If there's a trojan on the
    >box, what does it matter? *Anything* on the box can be disabled at that
    >point.
    >
    >If I break in to a Linux box, for example, all I have to do, once I have
    >root, is type:
    >% /etc/rc.d/init.d/ipchains stop
    >
    >If it's a Windows box, I just kill the service:
    >C:\ sc stop {firewall servicename}
    >
    >Or install the pstools to do it.
    >
    >The point is, once the box is owned, nothing else matters.

    What you're doing requires admin/root privileges.

    You don't need to be an admin to enable the trojan Internet access. Most/all
    windows firewalls (eg. Sygate and if I remember correctly, at least one of
    Norton and ZoneAlarm) allow limited users to decide if an app should have
    access to the Internet. That is, they don't care if you're an admin or a
    user. Thus a trojan doesn't need to be running as an admin; a limited user
    is enough to access the Internet. Just click YES when they ask the user if
    he/she wants to allow the program Internet access...

    _________________________________________________________________
    The new MSN 8: smart spam protection and 2 months FREE*
    http://join.msn.com/?page=features/junkmail

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Len Rose: "[Full-Disclosure] Administrivia: 10 messages delayed"

    Relevant Pages