Re: Terrifying results from online test

From: Michael J. Pelletier (mjpelletier_at_mjpelletier.com)
Date: 12/10/04 

Date: Thu, 09 Dec 2004 21:13:18 -0800

winged wrote:

> spamme2@mailinator.com wrote:
>> I did this test, which simulates an unknown Trojan attack on a windoze
>> computer. The program successfully bypasses my beloved (and well
>> configured) Kerio firewall. It also evades my universities hardware
>> firewall, which is configured very well (the admins are the block all
>> apart from port 80 type :-( )
>> Check out PCAudit from http://www.pcinternetpatrol.com/page/view/49
>> The program works by causing applications that have the privileges to
>> connect to the internet to upload data to their server.
>> I thought I would be safe because I configure kerio so it only permits
>> outbound connections to IP addresses of the resources that I connect
>> to, for example smtpserver:25, nntpserver:119, pop3server:110 and
>> proxy:8080
>> PCAudit appears to scan its way out. Even when I click deny it gets
>> through!
>> The company behind PCAudit have publicised a vulnerability that affects
>> almost all firewalls. Their PCAudit program could easily be reverse
>> engineered by crackers, and then a real and more malicious Trojan could
>> be produced that bypasses almost all firewalls.
>>
>> What do you guys think of this? Did you pass the test (without
>> unplugging your internet wire/blocking all traffic Lol)?
>>
>
> Yes I passed the test(s) (my computer would not(it refused) allow the
> software to run :-P). I have actually met Mr. Gibson at GRC;-) No I did
> not have to disconnect. Any inappropriate software allowed to run
> inside "can" compromise security often invisible to the user. One can
> "hide" processes and files on a computer that are not easy to discern.
>
> One can attach files to other legitimate processes or programs using
> alternate data streams that can really make life an adventure. The key
> is keeping crap out. If one runs inside a VM it is an easy matter to
> identify what, where, who, and how and throttle/kill the offending
> processes.
>
> The code you allow to run inside is only as trustworthy as the
> individual who wrote the code, and the security of the code.
>
> If you are using IE as your default browser you have many more issues to
> worry about. My current count is 5 known unpatched vulnerabilities in IE
> where the system can run code of the attackers choice at varying
> permission levels. One should constrain where IE is allowed to talk
> (Microsoft was right you break things when you remove it) as well as how
> it can communicate.
>
> The default browser should not be "allowed" to run with system level
> permissions. The browser should not be run as an administrator of a
> system, nor even permissions of a standard user but only with restricted
> permissions required to meet the user requirement securely.
>
> Winged

If there are people reading this who are new to security, re-read the last
paragraph. Then re-read it again.....

As a general rule, su to root when needed then exit (translated for Windoze
users, you should not login as administrator unless you are installing
something, etc).

Relevant Pages

  • Re: Terrifying results from online test
    ... which simulates an unknown Trojan attack on a windoze ... The program successfully bypasses my beloved (and well ... > configured) Kerio firewall. ... nor even permissions of a standard user but only with restricted ...
    (alt.computer.security)
  • Re: XP File and printer sharing SOLVED!! A HIDDEN FIREWALL!!
    ... problem is probably caused by share permissions or NTFS file system ... After going through everything in all the various posts, links, etc., multiple times, I decided that it /had/ to be a firewall problem. ... I then deleted the Registry keys, rebooted, and deleted the files. ... I see similar posts to mine here every day--can't see one computer on the network--and the firewall is always given as one likely cause. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Wish list
    ... At work, I am not the firewall guy, and don't even have a login on ... None the less, the windoze anti-virus providers, and SANS ... port number. ... Disable messenger service. ...
    (comp.os.linux.security)
  • Re: Setup Error 0x80070005 Access is Denied
    ... BTW firewalls don't control the registry or permissions. ... > whatever firewall is controlling those layers needs to be adjusted or you ... >> Notice that the files for the Windows installer 3.1 update are downloaded ... >> into the software distribution folder in the windows directory. ...
    (microsoft.public.windowsupdate)
  • Re: Why you have hardware firewalls
    ... You can actually run the typical windoze server with all the ... much less running the defaults) behind a very restrictive firewall ... But what about the "local" businesses? ...
    (comp.security.firewalls)