rec.autos.simulators

by **Mart** » Mon, 07 May 2001 04:27:58

>> Knowledge and caution with installing new programs is by far the safe
>> approach than just installing a fancy FW and forget about security
>> because "I have a firewall installed".

>You are correct, Martin, a safe approach is to be suspicious of all
>executables. However, I don't think I was insinuating that installing a
>firewall and forgetting about security was the idea.

Of course not, but a lot of people seem to get on that track, that why is
I thought I'd mention it.

Well if a trojan is sophisticated enough to slip by "the most careful
person"(TM) it may as well be able to disable a personal firewall and
disguise itself so it can sneak by external FWs .

In any case a FW can only detect that your system has been infected and the
trojan code is already executing - the secutity has been breached and if
you had sensible data on that machine you'd have to consider that data
exposed and been tampered with.
It is of course better than being infected and not knowing it.

Yeah happened to me too, fortunatly chances are quite good that this will
be discoverd pretty fast - if you're using a popular commercial software.

In those cases it's hard to distinguish between authorized and
unauthorized network access. After all the purpose of the program is to
communicate with the outside world and a FW cannot tell a "good" from a
"bad" connection unless you verify each connection attempt by hand or the
"bad" connections are easy to detect (e.g. using a special port or ip -
which they don't have to do).

ACK.

Right, I just wanted to point out that you need all of that. And not just
get a FW and a scanner and feel safe and install every piece of ***you
can download.

Regards,

Martin

by **Jan Koh** » Mon, 07 May 2001 06:24:15

Yes, and I've even got a trojan at the moment that another security guy
sent to me that is purposely built to disable ZA and then create a running
icon in it's place so that you don't realize ZA has been compromised...

as well, you really have to know what network connections
are going on in the first place...for people that do network admin, that's usually
not TOO big of a problem, but for the common user, they probably wouldn't
know what to look for...

Yep, I figured we were on the same sheet of music... <grin>

Cheers!
--
?? Jan Kohl ??
SECURITY CONSULTANT
The Pits - http://www.racesimcentral.net/
Castle Graphics - http://www.racesimcentral.net/

by **George Lewi** » Mon, 07 May 2001 20:37:14

I bought BID (Black Ice Defender) the day I got a cable modem (a few
years ago) and kept up with the updates. I tried Zone Alarm but it
drove me nuts. I'm also running an internal LAN with a W2K server and
a few PCs, which caused me all sorts of grief.

BID worked great for me, plus let me know who was doing what. The
later versions did stop outbound stuff.

Now I use it in conjuction with the NAT firewall (very basic, but does
the trick).

>I agree George except with your choice of firewall. Black Ice is a
>good firewall but IMHO Zone Alarm is much better and it's FREE (which
>is amazing.) I have a Linksys router and run ZA on all my workstations
>and I have never had a problem. Basically, the router gets the attacks
>that originate from the outside and ZA gets them from the inside.

>Todd Walker
>twalker at jam dot rr dot com
>http://twalker.d2g.com

>On Sat, 05 May 2001 11:49:16 GMT, George Lewis

>>Hey old buddy....

>>I agree... even MS Proxy Server 2 I wouldn't consider a "great"
>>firewall. would you really put PIX and Checkpoint in the same league?
>>just curious...

>>However, NAT should do the trick for most home users, and throw in
>>something like black ice stopping outbounds from weird ports and
>>stuff... what I like about Black Ice is the user doesn't have to
>>learn a bunch of technical information and therefore mess up the
>>security configuration.

>>>> Jan, would you recommend firewall software on top of a hardware
>>>> firewall built into a broadband router, such as the products from
>>>> Linksys, SMC, and Netgear?

>>>Definitely. They (hardware) only protect (and marginally at that) inbound connections, they
>>>do nothing against a program which has installed itself and is attempting outbound.
>>>See our writeup in the hardware section for details...

>>>All the mini-firewall/routers are really just a convenience...they do not provide a really
>>>solid firewall (as compared to things like Checkpoint, Cisco PIX, ect). That's not to
>>>say that they don't work well, but if someone REALLY wanted to attempt to break
>>>into your system, a Linksys/Netgear/whatever would not stop them...

>>>Cheers!

by **George Lewi** » Mon, 07 May 2001 20:39:36

Jan! I'll drop you an email and catch up....

Yeah, sorry... I'm suffering the same problem. trying to keep it basic
and simple but still satisfy the techies :)

Black Ice did fix the outbound stuff. Zone Alarm caused me too many
hassles with questions and stuff for my LAN setup (a server and 4 PCs)

At work I have a Cisco setup with ACLs and stuff, but not at home.
Nice hearing from you!

>> Hey old buddy....

>> I agree... even MS Proxy Server 2 I wouldn't consider a "great"
>> firewall. would you really put PIX and Checkpoint in the same league?
>> just curious...

>> However, NAT should do the trick for most home users, and throw in
>> something like black ice stopping outbounds from weird ports and
>> stuff... what I like about Black Ice is the user doesn't have to
>> learn a bunch of technical information and therefore mess up the
>> security configuration.

>GEORGE!!!!!!!!!!!!!!
>Geez, it's been a long time! Nice ta see you! ;]

>Well, what I was referring to was the fact that a properly set up 'real' firewall
>will only allow connections that have been designated as 'ok', all other inward/
>outbound connections are halted at the firewall. With Linksys/Netgear/whatever,
>there are certain programs on the operating system which could be given a buffer
>overflow and thus give access to the target computer. Not *quite* so likely on
>something such as Checkpoint, but combined with a good IDS it would be much
>more difficult.

>I know Black Ice on previous versions did not stop outbound connections, but I
>heard they were going to fix that. I've not tried it recently to see...

>Cheers!

by **George Lewi** » Mon, 07 May 2001 21:45:25

Well, the problem with virus checkers are that they are "stupid" -
they only check for known situations and conditions. I have yet to
see an intelligent one that can look at something and say "hey! this
doesn't look right!" if it fits the conditions, it gets marked. but
the problem is that most new viruses haven't been "defined" yet so the
stupid virus checker lets the files go on through.

It's not the virus checker's reponsibility to check outbound ports on
your PC, either. A file may be perfectly "harmless" until it's run
and then you have your troubles.

As mentioned in another usenet message - hacker software alot of times
has a few extra suprises in it...

>clipped
>> The ONLY way to be safe is to prevent trojans (and other nasties) from
>> getting onto your system, i.e. don't install software of questionable
>> origin, use an email client without all the fancy automation stuff,
>> browse with the highest possible security settings, etc. Also check for
>> secutity updates for your programs/OS. The best way is of course to store
>> sensible data on an extra machine that connects to the net only when
>> absolutly neccessary.

>I've been following this thread with interest and appreciate the info.
>Since many viruscheckers don't detect trojans (if I understand this
>correctly) then what's the best way to check for them on your system? I've
>recently installed a firewall and other protective measures but want to be
>sure that there's nothing already on my system

>tia for any advice

by **Dave Henri** » Mon, 07 May 2001 23:52:59

When the hacker ***y-trapped my system, my NOD32 virus checker caught it.
Unfortunately, I didn't have it up and running after updating my system.
Even if the virus checker had been active, I don't think I could have
prevented it once the hacker got into my system. I have some very unkind
words for that individual if we ever meet. Nod32 found the virus and said
it couldn't fix it...but saved it so I could email it to the Nod32
programmers. What the virus did was re-assign a windows function to itself
so that when I removed the file all my windows programs quit working. i.e.
I couldn't open Windows Explorer because such & such a file was missing. I
couldn't email because the file was missing. I couldn't even shut down or
reboot because the file was missing.

by **Jan Koh** » Tue, 08 May 2001 00:55:39

> When the hacker ***y-trapped my system, my NOD32 virus checker caught it.
> Unfortunately, I didn't have it up and running after updating my system.
> Even if the virus checker had been active, I don't think I could have
> prevented it once the hacker got into my system. I have some very unkind
> words for that individual if we ever meet. Nod32 found the virus and said
> it couldn't fix it...but saved it so I could email it to the Nod32
> programmers. What the virus did was re-assign a windows function to itself
> so that when I removed the file all my windows programs quit working. i.e.
> I couldn't open Windows Explorer because such & such a file was missing. I
> couldn't email because the file was missing. I couldn't even shut down or
> reboot because the file was missing.

LOL! Eeerrrmmm...hate to tell you this, Dave... ;]

Remember when I said search the registry for the trojan? What they had done
was map shell extensions to executables to the trojan, then everytime you ran a program,
it attempted to restart the trojan. Very common practice with trojans, it insures
that other methods of restarting the trojan don't fail.

Cheers!

--
?? Jan Kohl ??
SECURITY CONSULTANT
The Pits - http://www.racesimcentral.net/
Castle Graphics - http://www.racesimcentral.net/

by **Robi** » Tue, 08 May 2001 01:41:52

SNIP
> A firewall will not stopping trojans from infecting your system at all.
> It might have difficulties reporting your data to someone but that does't
> stop a trojan from doing anything to your system. Since trojans -once
> installed- have the same rights as any other program they can do pretty
> much the same things you can do - e.g. disable your (software) firewall,
> send emails, read/format your disk, etc.

> The ONLY way to be safe is to prevent trojans (and other nasties) from
> getting onto your system, i.e. don't install software of questionable
> origin, use an email client without all the fancy automation stuff,
> browse with the highest possible security settings, etc. Also check for
> secutity updates for your programs/OS. The best way is of course to store
> sensible data on an extra machine that connects to the net only when
> absolutly neccessary.

Ummm, you mean "software of a questionable origin" such as warez?!? Hee hee
hee, serves them right for dl'ing it in the first place!

by **Mart** » Tue, 08 May 2001 02:28:22

>Ummm, you mean "software of a questionable origin" such as warez?!? Hee
>hee hee, serves them right for dl'ing it in the first place!

That's not restricted to warez/gamez... depending on the site I'd assume
that those are usually "safer" than some other areas of downloadable
software. After all if you put a trojan in a 100MB+ download that is
mainly d/l'ed by people with at least some computer knowledge you won't
find many victims. However if you put a trojan into a small utility that
is supposed to help you with applications that a lot of unexperienced
people use (e.g. AOL, ICQ, etc.) you'll probably have more "success".

So basically "software of a questionable origin" means any software that
hasn't been

a) bought as commercial software in a store
b) downloaded from a site of a known (and trusted) company
(updates/patches)
c) written by yourself or someone you trust - on a safe system.

Note that a) & b) are not perfectly safe (shit happens) but it's likely
that problems will be discovered soon and quickly solved.
In short: if you don't know who to sue if a program contained a trojan
then the origin is questionable ;-)

Martin

by **Nos v7.000000** » Tue, 08 May 2001 03:59:58

On Sun, 06 May 2001 12:45:25 GMT, George Lewis

>Well, the problem with virus checkers are that they are "stupid" -
>they only check for known situations and conditions. I have yet to
>see an intelligent one that can look at something and say "hey! this
>doesn't look right!" if it fits the conditions, it gets marked. but
>the problem is that most new viruses haven't been "defined" yet so the
>stupid virus checker lets the files go on through.

Most so called new viruses are not new, just different variations of
an old virus so a good virus checker should pick up on them.
--
eFalcon keyboard chart in PDF format
http://storm.prohosting.com/~nos146/ef4_keys.zip

by **nascaro** » Tue, 08 May 2001 06:33:27

I went to a questionable site today and Norton detected that this site was
trying to perform a registry write and asked if i wanted to stop or
continue. Naturally, i selected stop and it shut down netscape. So norton
does look for some funny things with VBscripts

> >Ummm, you mean "software of a questionable origin" such as warez?!? Hee
> >hee hee, serves them right for dl'ing it in the first place!

> That's not restricted to warez/gamez... depending on the site I'd assume
> that those are usually "safer" than some other areas of downloadable
> software. After all if you put a trojan in a 100MB+ download that is
> mainly d/l'ed by people with at least some computer knowledge you won't
> find many victims. However if you put a trojan into a small utility that
> is supposed to help you with applications that a lot of unexperienced
> people use (e.g. AOL, ICQ, etc.) you'll probably have more "success".

> So basically "software of a questionable origin" means any software that
> hasn't been

> a) bought as commercial software in a store
> b) downloaded from a site of a known (and trusted) company
> (updates/patches)
> c) written by yourself or someone you trust - on a safe system.

> Note that a) & b) are not perfectly safe (shit happens) but it's likely
> that problems will be discovered soon and quickly solved.
> In short: if you don't know who to sue if a program contained a trojan
> then the origin is questionable ;-)

> Martin

by **Jan Koh** » Tue, 08 May 2001 07:57:54

Can you point me to that site?

I'd like to take a look at it... ;]

Cheers!
--
?? Jan Kohl ??
SECURITY CONSULTANT
The Pits - http://www.theuspits.com
Castle Graphics - http://www.castlegraphics.com

> I went to a questionable site today and Norton detected that this site was
> trying to perform a registry write and asked if i wanted to stop or
> continue. Naturally, i selected stop and it shut down netscape. So norton
> does look for some funny things with VBscripts

> > >Ummm, you mean "software of a questionable origin" such as warez?!? Hee
> > >hee hee, serves them right for dl'ing it in the first place!

> > That's not restricted to warez/gamez... depending on the site I'd assume
> > that those are usually "safer" than some other areas of downloadable
> > software. After all if you put a trojan in a 100MB+ download that is
> > mainly d/l'ed by people with at least some computer knowledge you won't
> > find many victims. However if you put a trojan into a small utility that
> > is supposed to help you with applications that a lot of unexperienced
> > people use (e.g. AOL, ICQ, etc.) you'll probably have more "success".

> > So basically "software of a questionable origin" means any software that
> > hasn't been

> > a) bought as commercial software in a store
> > b) downloaded from a site of a known (and trusted) company
> > (updates/patches)
> > c) written by yourself or someone you trust - on a safe system.

> > Note that a) & b) are not perfectly safe (shit happens) but it's likely
> > that problems will be discovered soon and quickly solved.
> > In short: if you don't know who to sue if a program contained a trojan
> > then the origin is questionable ;-)

> > Martin

by **Don Burnett** » Tue, 08 May 2001 08:47:13

After reading this thread, I downloaded and installed the free version of
Zone Alarm.
I have had it installed for about an hour, and already have received 4
alerts of different ip addresses that were blocked trying to access my
computer through the internet.
Is this normal? Would this be hackers trying to get into my system? I'm
just wondering what's been happening up until I installed Zone Alarm/

--
Don Burnette
D Burnette in N4

Some people do nothing wrong.
The problem is, they do nothing.
And THAT is wrong.

by **Gaul** » Tue, 08 May 2001 09:01:47

I'm assuming you have a cable modem based on your email address. I do too,
and periodically the ISP itself sends out a ping, in my case easily
identified by having an almost identical IP number but with a '1' at the
end. I've been told that no harm is done by blocking this and so far
nothing has happened despite my blocking it. This is probably the source of
some of your pings, but I bet there's more than that at play here. I know
that I get pinged by all kinds of IPs even when I'm not doing anything that
might cause it (some programs try to connect by themselves as I'm sure you
know).

by **ymenar** » Tue, 08 May 2001 10:45:11

> After reading this thread, I downloaded and installed the free version of
> Zone Alarm.
> I have had it installed for about an hour, and already have received 4
> alerts of different ip addresses that were blocked trying to access my
> computer through the internet.
> Is this normal? Would this be hackers trying to get into my system? I'm
> just wondering what's been happening up until I installed Zone Alarm/

Yes it's normal Don, but it's not really "hacking". You see, most of the
script kiddies (because they aren't really hackers, just kids thinking they
are hackers) do that. It's like going to somebody's house and testing the
door knob. If it's locked, they move to the next house. If not, then they
have a potential case of a non-safe computer. They are just sending you
packets, it is not illegal.

Zone Alarm protects you against that because it/you decide what port (door
knob) you want to leave open and which one you want locked up. They do it
all the time, I receive in average 10-12 alerts per day. Sometimes more,
sometimes less. Unless you are not safe (check out grc.com which itself
just had a Dos lol), you shouldn't pay attention to them.

--
-- Fran?ois Mnard <ymenard>
-- May the Downforce be with you...
-- http://www.ymenard.com/
-- This announcement is brought to you by the Shimato Dominguez
Corporation - helping America into the New World...

rec.autos.simulators

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....

If you're worried about getting hacked....