New personal firewall vulnerability

[proactive]

An application called Blackstealth is capabale of bypassing personal firewalls like McAfee, Norton, Sygate & Tiny by executing itself in the firewall's memory space.


Read more (http://piorio.supereva.it/backstealth.htm?p)

[casper3699]

sounds like it is not a good program

[KorpDeath]

Nice. Too bad it requires executing code on your box.

My feeling about this is it's a nice proof of concept but in reality you're only going to be able to get users to execute it that'd already execute arbitrary code on their box anyway. So if can't defeat the firewall from the outside then people who wouldn't get infected from regular virii will not be susceptible to this either.

[SoggyBottom]

You have to love the quote:

BackStealth is an innovative Security Utility which allows to bypass the outbound protection of a Personal Firewall in order to establish a remote connection.

Bit of an oxymoron, dont you think?

[KorpDeath]

Just the moronic part if you ask me......

[Manish]

If you are under the Administrator account on Win2k, WinXP, WinNT, then obviously you have the control to run code that bypasses your firewall. But the question is...is that program able to work when non-Admin users run it? (that's where the security of a box comes into question).

Also, try it with TPF 3 (www.tinysoftware.com -- ver. 3 is commercial now) - they have added a lot of beef in it now.

[s0nIc]

lol damn.. i cant view the link.. for some reason Opera blocks the cookies it sends

Cookie Security Breach
The server tried to set a cookie for a domain with no registered IP address.
For security reasons this is not acceptable, and the cookie has therefore been rejected.

Domain Address:
http://ads.dada.it/jserver/SITE=SUPEREVA/AREA=FREEWEB/AAMSZ=120x240/ACC_RANDOM=1020781545430/PAGEID=236182/POS=1

Data:
GUID=FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF; expires=Sun, 29-Feb-2004 23:59:59 GMT; path=/; domain=.dada.it;

thats the error message i got... from my end.. i dont think this look good.. but thank god Opera detected it.

[gold eagle]

hmm. Depressing.