Re: Agnitum Outpost

From: Art Kopp (artnpeg@claymania.com)
Date: 03/04/03 

From: Art Kopp <artnpeg@claymania.com>
Date: Tue, 04 Mar 2003 20:41:57 GMT

On Tue, 4 Mar 2003 11:11:19 -0000, bassbag
<bassbag@bodybags.dragon.wales> wrote:

>In article <2gg46v4p7u5dcrb2jd670kgkt1jvhrv6mc@4ax.com>,
>artnpeg@claymania.com says...
>> On Sun, 2 Mar 2003 11:55:56 -0500 (EST), "bluejay"
>> <bluejay-no-spam@cotse.com> wrote:
>>
>> >Well, praise from the "mighty" is...etc., etc. : )
>>
>> Hmmm.
>>
>> >I had never heard of the Plank site. I tried it just before posting this.
>> >Outpost passed all the exploits with only the default ICMP settings.
>>
>> The ICMP setting I mentioned is to acheive stealth on all ports, and
>> it has nothing to do with the exploits test so far as I know.
>>
>> >But I did cheat some. I use the ancient Netscape 3.04 browser, which is too
>> >"dumb" to allow itself to be buggered by all these new fangled hacker
>> >tricks. That's why I love it. It works just fine with Win98SE.
>>
>> That's not good. Older versions of Netscrape have known
>> vulnerabilities. Update your browser for sure!! You might take a look
>> at the other Moz based browsers such as Mozilla itself. Personally, I
>> like K-MELEON because of its speed. Anyway, your browser is irrelevant
>> to firewall testing. Browser security is a separate issue.
>>
>> >I also keep Java and JS off, and I keep the cookie file write protected.
>>
>> No need if you update to a good Moz based browser. That's the
>> advantage over using IE.
>>
>>
>> Art
>> http://www.epix.net/~artnpeg
>> artnpeg@claymania.com
>>
>Hi art...Im curious why that setting need s to be unticked to achieve the
>stealth status as im using outpost ,on the default setting which is to
>have it ticked.Im using w98se and outpost probut i think the icmp
>settings r same for free and pro versions.I wonder if tehres any other
>factor involved here , that needs u to untick icmp in to achieve stealth?
>me

I never did raise the question at the Outpost forum. All I know is
that on my Win 98 PC I must uncheck that ICMP setting or only a
certain small handful of ports are stealthed. I simply pass that
tidbit on to clue others in who might run into the same situation.

Any ideas? I've poked around my W98 network settings and I don't see
anything giving me a clue there. I've done Gibson's W98 unbinding
procedure and without any firewall all ports are normally closed. But
I haven't run across any reference in there to ICMP.
  
Art
http://www.epix.net/~artnpeg
artnpeg@claymania.com

Relevant Pages

  • Re: sygate and shields up
    ... ICMP doesn't have ports. ... the quite obvious difference is that error message from the router. ... The only thing stealth MAY buy you is preventing O/S fingerprinting, ...
    (comp.security.firewalls)
  • Re: Ok to let all ICMP traffic through firewall?
    ... > My question is Should a firewall let all ICMP traffic through because ... > he gives about ICMP traffic and if it is still true these days. ... > Some firewalls have a hiding mechanism they call stealth. ... Whereas Stealthing ports breaks the TCP protocol. ...
    (comp.security.firewalls)
  • Re: Ok to let all ICMP traffic through firewall?
    ... > My question is Should a firewall let all ICMP traffic through because ... > he gives about ICMP traffic and if it is still true these days. ... > Some firewalls have a hiding mechanism they call stealth. ... Whereas Stealthing ports breaks the TCP protocol. ...
    (alt.computer.security)
  • Re: Ok to let all ICMP traffic through firewall?
    ... > My question is Should a firewall let all ICMP traffic through because ... > he gives about ICMP traffic and if it is still true these days. ... > Some firewalls have a hiding mechanism they call stealth. ... Whereas Stealthing ports breaks the TCP protocol. ...
    (comp.security.misc)
  • D-link dsl 504 and Iptables problems
    ... I have a Bto Adsl connection plugged into a D-link DSL 504 router. ... I have then set up port forwarding on the d-link to forward ports ... $MPB ip_conntrack ... #ICMP Dead Error Messages protection ...
    (comp.os.linux.security)
Quantcast