Re: Interesting thing about ICF and SP2

From: Thor (thor_at_hammerofgod.com)
Date: 10/17/04

  • Next message: Laura Robinson: "Re: Re: Remote connections" 
    To: "Jim Harrison (ISA)" <jmharr@microsoft.com>, <focus-ms@securityfocus.com>, <ntbugtraq@listserv.ntbugtraq.com>
Date: Sun, 17 Oct 2004 14:27:04 -0700

    And just to add to this thought, Group Policy allows you to prevent even
    local administrators from changing WF settings...

    t

    ----- Original Message -----
    From: "Jim Harrison (ISA)" <jmharr@microsoft.com>
    To: <focus-ms@securityfocus.com>; <ntbugtraq@listserv.ntbugtraq.com>
    Sent: Friday, October 15, 2004 10:15 AM
    Subject: RE: Interesting thing about ICF and SP2

    Easy; stop running on the machine as an administrator.
    I realize that this is the default for WinXP, but it's not carved in
    stone, either.
    Users outside of the Power Users and Administrators can't change ICF
    settings.

    Jim Harrison
    MCP(NT4/2K), A+, Network+
    Security Business Unit (ISA SE)

    "The last 10 years of Internet usage has disproven
    the theory that a million monkeys typing on a million
    typewriters would eventually produce the complete
    works of Shakespeare. ..or maybe it only works for
    typewriters..."
    (unclaimed)

    -----Original Message-----
    From: Erik Pace Birkholz [mailto:erik@specialopssecurity.com]
    Sent: Thursday, October 14, 2004 12:04 PM
    To: focus-ms@securityfocus.com; ntbugtraq@listserv.ntbugtraq.com
    Cc: Erik Pace Birkholz
    Subject: Interesting thing about ICF and SP2
    Importance: High

    I wrote a script back in 2002 for Internet Connection Firewall (ICF)
    called
    toggleICF.vbs. The purpose of the script was to turn ICF on and off via
    command line. It saved time (fighting through the GUI) when using port
    scanners and other security tools. FYI, the script is still available
    from
    www.SpecialOpsSecurity.com under the Resources, Scripts section.

    http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0140.html

    The only bummer was WMI prompted the user via Win32 popup and asked for
    permission before it would activate/deactivate. This made it less useful
    for
    scripting purposes, but more secure. Here is a reference from a MSDN
    page
    about the ICF disable method and it clearly states (in the remarks) that
    the
    user makes the final disabling decision.
    http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ics/ics
    /inetsharingconfiguration_disableinternetfirewall.asp

    Here is the new problem I just found today after finally installing SP2
    on
    my XP system. I noticed that if you run the toggleICF.vbs script, it no
    longer prompts the user via that annoying popup. Albeit annoying, that
    little popup did buy some mitigation against the bad guys trying to turn
    off
    ICF with a script.

    Microsoft's new ICF activation/deactivation "process" change has
    introduced
    a new attack vector for malicious scripts. If my script can be used to
    turn
    ICF on and off for "good" without requiring user-intervention, then it
    can
    certainly be done for "evil".

    Erik Pace Birkholz, CISSP
    Special Ops Security, Inc.
    [Cell] 323.252.5916
    [SOPS] 888.RU.OWNED
    [Email] erik@SpecialOpsSecurity.com

    Read Special Ops and mount an assault to eradicate network negligence
    today.
    www.SpecialOpsSecurity.com

    ------------------------------------------------------------------------ 

    ---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Laura Robinson: "Re: Re: Remote connections"

    Relevant Pages

    • RE: Interesting thing about ICF and SP2
      ... stop running on the machine as an administrator. ... Users outside of the Power Users and Administrators can't change ICF ... I wrote a script back in 2002 for Internet Connection Firewall ... longer prompts the user via that annoying popup. ...
      (Focus-Microsoft)
    • Re: Interesting thing about ICF and SP2
      ... Interesting thing about ICF and SP2 ... Users outside of the Power Users and Administrators can't change ICF ... I wrote a script back in 2002 for Internet Connection Firewall ... longer prompts the user via that annoying popup. ...
      (Focus-Microsoft)
    • RE: Interesting thing about ICF and SP2
      ... Interesting thing about ICF and SP2 ... I wrote a script back in 2002 for Internet Connection Firewall ... longer prompts the user via that annoying popup. ...
      (Focus-Microsoft)
    • Interesting thing about ICF and SP2
      ... I wrote a script back in 2002 for Internet Connection Firewall (ICF) called ... The purpose of the script was to turn ICF on and off via ... longer prompts the user via that annoying popup. ...
      (NT-Bugtraq)
    • Re: Can not install applications using any admin account
      ... You could try if it works without those restrictive policy ... I also have a vbscript running at logon ... these Computer Policy Settings: ... restrictions is *not* applied to Administrators. ...
      (microsoft.public.windows.terminal_services)