RE: Spyware

From: Paris E. Stone (pstone_at_alhurra.com)
Date: 12/17/04

  • Next message: Kelly Martin: "SF new column announcement: Zero Viruses In 2005?" 
    Date: Fri, 17 Dec 2004 08:15:47 -0500
To: "dallas jordan" <dallas.jordan@gmail.com>, "Matt Stern" <sternm@comprehensive.com>

    That is correct, the best way too.

    But, most spyware uses the outbound HTTP & HTTPS ports.

    Why?
    Because almost every firewall in the world allows that out.

    Why?
    Because those are the ports we browse the web on.

    Spyware authors are pretty smart. I just found some spyware that set a
    system restore point on a XP box, and whenever it's files got removed,
    and registry keys got deleted, it system restored it's self right back!

    ~~~~~
    Paris E. Stone, "Linux Zealot"
    CISSP, CCNP, CNE, MCSE, CIW Master Administrator
    ~~~~~
    "Not all who wander are lost."
    J.R.R.T.
    -----Original Message-----
    From: dallas jordan [mailto:dallas.jordan@gmail.com]
    Sent: Wednesday, December 15, 2004 2:09 PM
    To: Matt Stern
    Cc: security-basics@lists.securityfocus.com
    Subject: Re: Spyware

    I believe as a general rule, all traffic should be denied unless
    explicitly permitted. this includes incoming as well as outgoing
    traffic. You should start off with a "deny all" rule and then only
    allow specific traffic through your firewall. This way, there is less
    chance you may miss something. HTH.

    On Tue, 14 Dec 2004 17:37:48 -0500, Matt Stern
    <sternm@comprehensive.com> wrote:
    > Hello all:
    >
    > I was just wondering if spyware sends its answers "back home" on any
    > particular TCP or UDP port. If so, then couldn't I doubly safeguard
    the
    > LAN (after trying to keep all the spyware off the workstations) by
    > disallowing outbound communications via the firewall, for those ports?
    > Or conversely, instead of allowing all outbound traffic, only allow
    the
    > usual ports, such as 80, 443, 23, etc?
    >
    > Thanks.
    >
    > --
    > Matthew H. Stern, CCP/CDP, sternm@comprehensive.com
    > Serving the IT industry since 1976
    > Comprehensive Computer Services Inc.
    > www.comprehensive.com
    > Phone: 631 755-2250, Fax 755-2254
    > 560 Broad Hollow Road, Melville NY 11747
    >
    > 

    -- 
Dallas Jordan CCNA, Security+
Ernst & Young LLP
Security & Technology Solutions (STS)
Office:   404-817-5940
Mobile:  843-991-0271
EY/Comm:   7455673
E-mail:  Dallas.Jordan@ey.com
  • Next message: Kelly Martin: "SF new column announcement: Zero Viruses In 2005?"

    Relevant Pages

    • Re: Ports getting hammered?
      ... >>> If your Watchguard can't stop outbound traffic... ... >>> Would not the Windows XP firewall do exactly the same work? ... >> protocol analysis to see if protocols are being broken only a IDS ... > permitted ports and protocols. ...
      (comp.security.firewalls)
    • Re: Networking over mains cables
      ... 'inbound and outbound, only if initiated by me' and ... the firewall so a webserver needs to allow inbound HTTP ... In this context the ports are conceptual. ...
      (comp.sys.acorn.networking)
    • Re: should i install windows xp service pack 2
      ... I don't care about monitoring outbound traffic. ... some Cyber nut or spyware bot has successfully penetrated my ... firewall is very effective at stopping unwanted inbound ...
      (microsoft.public.windowsxp.general)
    • AdAware, SpyBot S &D, etc. + leave PC connected to Internet
      ... Does it have somehting to dow the Firewall ... with spyware services and adsites, the latter of which can be worse ... What ports are open? ... routers do absolutely zero as far as preventing outbound connection ...
      (comp.security.firewalls)
    • Re: should i install windows xp service pack 2
      ... I don't care about monitoring outbound traffic. ... some Cyber nut or spyware bot has successfully penetrated my ... firewall is very effective at stopping unwanted inbound ... sure if SP2 is or is not warning me about traffic in either ...
      (microsoft.public.windowsxp.general)
    • Quantcast