how-to block ads
|
|
Uniqs:
5773 |
Share Topic
 |
 |
|
|
|
 jvmorrisI Am The Man Who Was Not There.Premium,MVM
join:2001-04-03
Reston, VA | reply to gt7697c
Re: New Stealth Attack Found Against Personal Firewall GT,
Check your IMs. As I've stated before, I have no intention of downloading, installing, and running this little goodie. gwion is free to do so (indeed, I think he has a test box), Time Out says he's got a test box, and I'm not sure about Zhen-Xjell.
I would not be surprised by a false positive. We've seen that before with another Leaktest clone. (As previously noted in this very thread.) If you can't find a connection (and data transfer inbound) for the test file (and do you now find the test file on your box?) at the time tested, then it didn't connect.
Incidentally, I have on rare occasions in the past, seen similar attempts by IAMAPP.EXE to connect. I've always blocked, with no adverse effects. There's absolutely no reason of which I'm aware why IAMAPP.EXE should need to run an Internet connection. Hell, at one point during that little fiasco with Tiny or Kerio, I actually threw up an IGNORE rule on IAMAPP.EXE -- nothing, nada, zilch.
Here's a penultimate test. Once you've got the basic download, physically disconnect from the Internet (no, don't log off; physically disconnect). If it still says it got through, well, we've just achieve a new high in system subversion! 
--
Regards, Joseph V. Morris | |
 gt7697cPremium
join:2001-02-16
The Hive | Jv, and others no need to worry about my system. I have GoBack alive and well. And have already reverted my main hard drive back to before I did any of this. Then I deleted the file on my other hard drive.
I may test it again this time with no connection to the internet, very easy to do on Win 2k and see what happens.
If I do test it again what programs do y'all recommend for me to download to watch what happens???? (Freeware please, and only programs that work with Win 2k.;))
--
Just my 2 bits. | |
 gwionwild colonial boyPremium,ExMod 2001-08
join:2000-12-28
Pittsburgh, PA
kudos:1
| reply to Zhen-Xjell
KERIO USERS: Please read! I will post a follow up, later on, to this in Kerio-Tiny, with detailed instructions and observations... but, for now, let's say that a rule blocking persfw.exe, as noted above, is effective in preventing access by this app. However, the test app will erroneously report successful penetration, anyway. Seems to take place as soon as the packet is sent. However, the firewall blocked the packet...  The alert was given, the log entry made, and the packets were stopped. Naturally, I guess this precludes using update notification, though I guess you could still resolve DNS, if you like, by putting it below your DNS rule(s)...
The app will state it has breached the firewall, and it will prepare the container file, but the container file remains a zero-byte file, the wire remains silent on the sniff, and the firewall "catches "itself" trying to reach the internet, and responds correctly. It seems this is one exploit that employs a single bit of faulty logic, that being that a firewall can't prevent itself from reaching the internet... it can. In this regard, it's actually inferior as an exploit to Firehole, which rides IE in much the same way... it's a great deal harder to have a usable machine with an unsandboxed IE and not allow it to the internet than it is to have a usable machine prohibiting Kerio from reaching the internet... since the firewall, in theory, never needs access for core functionality. Just for add ons like DNS and update notifications.
Well, it looks as though I was wrong; this one CAN be addressed with a packet filter... BECAUSE it targets the firewall, instead of an app that requires default internet access... sort of an interesting reverse Catch 22. By targeting the firewall for subversion, instead of an app behind it with loose permissions that are required for access, it makes itself an eminently blockable exploit...
--
Adam was not alone in the Garden of Eden, however, and does not deserve all the credit; much is due to Eve, the first woman, and Satan, the first consultant.
-Mark Twain, Notebook, 1867
[text was edited by author 2002-04-30 16:50:30] | |
jvmorrisI Am The Man Who Was Not There.Premium,MVM
join:2001-04-03
Reston, VA | Gwion,
Oh, that was worth a big wet one! Unfortunately, the dog just got through eating and has since been doing something else, so I think you'll probably pass.
--
Regards, Joseph V. Morris | |
gwionwild colonial boyPremium,ExMod 2001-08
join:2000-12-28
Pittsburgh, PA
kudos:1 | reply to Zhen-Xjell
Re: New Stealth Attack Found Against Personal Firewall JV, a simple thanks is fine  ...
Heck, this is what it's all about, isn't it? Trying to solve a problem, not wallowing in the fud of it all [sic.]. Hey, you've been there, too. I remember some great discussions we had regarding that last crop of leak demos. Thanks for all YOUR time and comments... they're much appreciated.
I think one aside needs to be posted, by the way. The container stays "in use" AFTER the test unloads, leading me to believe the dll remains loaded in Kerio's memory space until reboot... in other words, you can't delete the container after running the app, until you release the dll from memory... I just rebooted. It doesn't appear to tamper with anything, though, but I'll still run a change log diff on my registry watcher, just to be safe and sure...
I figure, on a whole in the big scheme, this is less threatening than the backdoor/app masquerade issue we detailed in the old versions of Tiny/Kerio ... in fact, it may have been, at least in part, Kerio's response to that issue (making persfw abide by its own rules) that provided us with this available solution... those who recall, certain versions sort of forgot to treat persfw.exe, itself, as a potential target... their response was to patch up the backdoor (very promptly, too, kudos to the Kerio team, there) and to address an issue with persfw.exe behaving erratically with its own "self-awareness" ... interesting overlap, there... that was a built-in backdoor, by trhe way, and it was VERY exploitable. Fortunately, we were able to get a response from Kerio well before the exploit became widespread common knowledge, because it was an utterly trivial way of doing pretty much the same thing with NO api programming required, at all. I remember sitting there, that first night, marvelling, and thinking of at least 5 or so jackass simple exploits that I could accomplish through there with just a fast script file.
Again, let me make sure I clearly give credit where due, they were VERY responsive at Kerio, and had a patched version literally as fast as any development team could be expected to prototype, test and release it... a professional text book perfect response; don't talk about doing something in the next version, just silently do it and release the "next version" post haste... a great job. But I just want to put this all in perspective. It's the nature of IT generally, exploitable features are always being discovered ... nothing's perfect; we patch 'em up, and wait for the next one to come along... and it rarely disappoints us with tardiness.
--
Adam was not alone in the Garden of Eden, however, and does not deserve all the credit; much is due to Eve, the first woman, and Satan, the first consultant.-Mark Twain, Notebook, 1867 | |
 Lex LuthorPremium,Mod
join:2000-09-17
Hicksville, NY
kudos:3
OptimumOnline
Users find Hot Deals
Users find Hot Dea..
Requests for Hot D..
| reply to gwion
Re: KERIO USERS: Please read! said by gwion:
Naturally, I guess this precludes using update notification, though I guess you could still resolve DNS, if you like, by putting it below your DNS rule(s)...
Couldn't you put a rule before this rule to let kerio check for an update? As long as you know how/where Kerio checks for an update, I think it would work, no?
Please update us with specifics once you are sure of everything.
Thanks | | |
|
 VampirefoPremium,MVM
join:2000-12-11
Huntington, WV
kudos:1 | reply to gwion
Re: New Stealth Attack Found Against Personal Firewall Both our ways worked cause TPF create this hole itself, Had the firewall not called home, this hole would not exist, by changing exe you can see the firewall call home, and if the call home is allowed the hole is opened.
TPF doesn't detect or report itself calling home, unless the exe is changed, so I wonder why the call home is needed, and if the companies simply stops it the hole wont exist.
--
TrojanHunter Stands For Privacy!!!!!!! | |
VampirefoPremium,MVM
join:2000-12-11
Huntington, WV
kudos:1 | reply to Zhen-Xjell
Here is what I get now from TPF when I click on the Backstealth, So I can now control it, even though TPF is telling me it want permission to connect, I know this is Backstealth. If I press allow it gets through, if I press deny Backstealth just lies and says it gets through.
--
TrojanHunter Stands For Privacy!!!!!!! | |
 Time Out$Premium
join:2002-04-28
North Myrtle Beach, SC | reply to Vampirefo
If you guys would get a REAL firewall, you would not have to fool around with Italian Utilites to call out.
How to Manually Open Ports in Internet Connection Firewall in Windows XP (Q308127)
SUMMARY
This article contains the steps to manually open ports in Internet Connection Firewall (ICF) in Windows XP.
MORE INFORMATION
Programs may potentially require ports to be manually opened so that they function properly when ICF is in use either on the local computer or on the gateway computer. You may have to use this procedure if there is a service that is running on a computer that has ICF enabled that you want to make available to users on the Internet.
»support.microsoft.com/default.as···;Q308127
___________________________________________________________
Programs Require Manual Port Configurations with Internet Connection Firewall (Q307554)
This article lists some programs that require you to manually open ports so that the programs can work correctly. To work correctly, some programs need to have specific ports open so that traffic can pass through the Internet Connection Firewall.
»support.microsoft.com/default.as···;Q307554
___________________________________________________________
Identity of this poster has been "stealthed" to prevent any dog from licking his face or "passing" anything without opening up all the Windows in this place no matter what M$ OS of your choosing. | |
VampirefoPremium,MVM
join:2000-12-11
Huntington, WV
kudos:1 | reply to Zhen-Xjell
I use a real firewall, on my host Look N Stop, I use TPF and kerio on my client for outbound protection mainly, also I have System Safety Monitor which catches everything. It caught this exploit as well, but I chose to let the exploit run and test it to see if XP or MS was as fault, and it's not the firewall is 100% to blame.
This hole is opened, and would have gone unnoticed without this exploit, so I did enjoy the exploit. One can learn a lot from these type of test.
--
TrojanHunter Stands For Privacy!!!!!!! | |
| reply to Zhen-Xjell
Humm well using Tiny Firewall 3.0 produced the results below:
looks like to me that the person that is looking to exploit the machine would need to know what firewall the person is running.
--
SYSRELAPSE "Better to look stupid for 5 minutes and ask a question than to be stupid for the rest of your life." | |
Time Out$Premium
join:2002-04-28
North Myrtle Beach, SC | reply to Vampirefo
"This hole is opened, and would have gone unnoticed without this exploit, so I did enjoy the exploit. One can learn a lot from these type of test."
I enjoy them also.
But the first rule in Security is an exploit does not exist unless you allow it in the first place.
The second rule is if you allow everything and know how to "contain it" an exploit does not exist.
I you can not obey the first rule and the second is your only alternative make sure you contain it off your system and away from the software. | |
gt7697cPremium
join:2001-02-16
The Hive | reply to jvmorris
Jv, I have tested this .exe again. It is is a rip off. I disabled my connection and it still said it had successfully penetrated my firewall and made a connection.
How could it do this with my Network Card Disabled???? Which means nothing is getting out of my computer or in to my computer. (Love Win 2k for this little feature.:))
I also tested Gwion's rule which is the same for NIS 2002, NIS 2002 as I have already verified prompts you to create a rule for it to access the Internet. (The .exe is different, but the rest is the same.) Now if you don't have it set to prompt you for a rule creation then....it of course would configure allowed access to the net. However, for anyone who posts here in this forum that would be a no no, so as long as you have it set to prompt you for creation you control what your firewall does.
After reading Gwion's follow up in the Kerio/Tiny forum, I found the retrieve .dat file. Sure enough it was a zero byte file. Which means no connection was made.
I have to agree with what has been said about these little programs to breach your firewall. It seems to me that they are only intended for the shock factor and that is all.
--
Just my 2 bits. | |
 CrazyMPremium
join:2001-05-16
BC Canada | said by gt7697c:
I also tested Gwion's rule which is the same for NIS 2002, NIS 2002 as I have already verified prompts you to create a rule for it to access the Internet. (The .exe is different, but the rest is the same.) Now if you don't have it set to prompt you for a rule creation then....it of course would configure allowed access to the net. However, for anyone who posts here in this forum that would be a no no, so as long as you have it set to prompt you for creation you control what your firewall does.
Thanks for testing NIS2002 gt7697c. Good to know it will prompt for iamapp.exe. When you refer to those who may have auto create enabled, it would be interesting to know how NIS would handle it then. Does NIS even have an automatic rule for iamapp.exe which in the normal course of things never requires internet access?
CrazyM | |
 hpguruCurb Your DogmaPremium
join:2002-04-12
| reply to Zhen-Xjell
Backstealth does indeed connect, he just didn't spend a lot of time refining the code.
I ran the test after examining the code in a hex editor. There is a single http call. I changed the name of the test file to be downloaded and ran backstealth. The contents of an html file were written to received.dat. It was a 404 error document meaning the connection was made but the file could not be found. This was expected. Then I added "www.pc-facile.com" to my hosts file and gave it the address of localhost (127.0.0.1). I then ran backstealth again, knowing that eDexter (an ad blocker) would respond to the HTTP GET by serving up a small transparent gif. After this received.dat contained
HTTP/1.0 200 Okay
Content-type: image/gif
GIF89a...
So yes it most certainly is connecting. As stated before it is merely a proof of concept and the author simply didn't see the need to provide much in the way of error handling which is why it claims to connect even when you were physically disconnected.
[text was edited by author 2002-05-01 02:26:43] | |
Time Out$Premium
join:2002-04-28
North Myrtle Beach, SC | reply to Zhen-Xjell
Our freinds at Wilders have some thought on this also.
»www.security-pro.co.uk/yabb/YaBB···20116524 | |
| reply to Zhen-Xjell
I'd like to ask a question if I may, these exploits that you are talking about, are they purely designed to exploit IE security weaknesses?
The reason that I ask is because I use Sygate PF on Windows98 Lite and many of these programs do not work, even the ones that are supposed to be able to penetrate Sygate PF.
A lot of them don't even install to my system because they seem to be looking for .dll's that aren't there (presumably relating to IE). | |
jvmorrisI Am The Man Who Was Not There.Premium,MVM
join:2001-04-03
Reston, VA | Keillor,
Well, technically, it might be better to refer to these utilities (being charitable here) as "vulnerability demonstrators" rather than "exploits". In very simple terms, many of these 'piggyback' on top of another application.
For purposes, of demonstration, a browser (and particularly Internet Explorer) is a logical choice -- after all, anybody who cares about this issue is likely to have some browser installed on their system!
BackStealth did something a little bit unusual; it 'piggybacked' on top of a software firewall (well, at least tried to) obtainable from one of several vendors. Not a bad idea, if one is attempting to demonstrate a potential vulnerability in the software firewall itself.
However, a real exploit relying on one of these vulnerabilities is in no way necessarily restricted to a browser or a software firewall. Browsers and firewalls are simply convenient for demonstration purposes.
We seem to have an implicit presumption that an exploit is going to go for some sort of 'mass kill'. This is not necessarily what's going to happen. Indeed, there's a potential advantage to doing the 'piggybacking' on top of some rarer (but not exactly obscure) Internet-enabled application. That has a tendency to make it a bit more difficult to diagnose.
Does that help at all?
--
Regards, Joseph V. Morris | |
Time Out$Premium
join:2002-04-28
North Myrtle Beach, SC | Member looking to condense this thread. Markus tried to get this thread below going this AM in reference to this entire thread if anyone want to contribute
»New test to bypass firewalls - essentials!
The original topic is 5 pages long. It is REALLY hard to keep up what has happened and what are the facts there. Perhaps its time to start posting the FACTS under one topic. Please, just post short. Try to answer the following questions:
1. What firewalls are vulnerable for SURE? (Means that it has been tested with firewallX)
2. What browsers/default browsers are vulnerable?
3. Are all Windows OS vulnerable?
4. Has some vendor released a patches already? | |
jvmorrisI Am The Man Who Was Not There.Premium,MVM
join:2001-04-03
Reston, VA | Yes, John, I'm aware of Markus' thread, which I think is an excellent idea.
Unfortunately, neither Keillor's query nor my response is directly relevant to Markus' plea. In those circumstances, it seemed more appropriate (at least to me) to maintain the response in the current thread.
As I've said before, I won't test this app. And the more gwion writes about it in the Tiny-Kerio Forum, the less inclined I am to do so. Apparently, hpguru's also picking at it now.
GT says it really doesn't work with NIS/NPF (at least if set to High Security, but it says it does). On the other hand, a couple of my contacts at Symantec indicate that there is some problem, but they certainly haven't told me any details (at least not to date).
I dunno; I'm a spectator on this one. All I can do is ask questions that do not yet appear to have been addressed.
--
Regards, Joseph V. Morris | |
|
