Re: Begginers basic questions, can someone help?
From: Calvin Crumrine (Calvin_Crumrine@dced.state.ak.us)Date: 03/11/02
- Next message: Dr. Bob: "Re: adverts - blocking with firewalls"
- Previous message: dr.emailposter: "Re: Norton Internet Security -- Automatic Access Configuration"
- In reply to: news.bellatlantic.net: "Begginers basic questions, can someone help?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: Calvin Crumrine <Calvin_Crumrine@dced.state.ak.us> Date: Mon, 11 Mar 2002 10:53:54 -0900
"news.bellatlantic.net" wrote:
> Zone alarm constantly requests permission for a program to access the
> internet. how am I supposed to know which are safe & which may be a Trojan
> program? Some are easy, but others I don't recognize.
>
> Also, I have gotten a number of messages that someone has attempted to
> access my computer but Zone alarm blocked access. Are these routine or does
> it truly signify someone trying to "hack" into my computer? I leave my DSL
> connection on all the time relying on Zone Alarm to protect me is this
> stupid & naive?
There's no easy way that I know of to identify which programs are safe to give
Internet access to and which are not. It's not too hard to tell that Trojan.exe
is malware but simple name-changing can defeat that. (Sort of like 'identifying'
terrorists at airports. If you could rely on them to use their true names then
the problem would be simple. Since they don't then there's no easy way.) A good
start is to build a list of ports known to be used by Trojans, then deny
anything trying to use those ports. That won't stop everything (some Trojans use
valid ports) but it's a start.
As for the port scans, they're probably not only meaningless but might be valid.
Many ISP's scan their own customers looking for violations of TOS-like running a
Web or FTP server. Those can be identified because they not only come from your
ISP but also because they probably come from the same addresses. Also they'll
probably only target 'normal' ports. Build a list of them so you can ignore
those-then concentrate on the others if you care. (As noted, many of the others
will be people scanning for file-sharing services. If you don't offer those
services I can't see why you would get repeated scans from the same addresses,
but then I don't use those services & don't know how they work. Maybe they're
really so inefficient that they scan everything every time.)
- Next message: Dr. Bob: "Re: adverts - blocking with firewalls"
- Previous message: dr.emailposter: "Re: Norton Internet Security -- Automatic Access Configuration"
- In reply to: news.bellatlantic.net: "Begginers basic questions, can someone help?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
