General Q's, mostly fire walls....

Was wondering about zone and tiny. How safe are you with them. I figure they keep things as far as trojans from getting out, also the script kiddies from getting in. As far as actual good hackers though. How safe am I? Are they super easy to bypass for basically anyone that knows what he/she is doing.

Also, are there ways to hide connections from netstat in dos. Basically, if I think someone is in my system, but has bypassed zone alarm. When I do a netstat, will that show that they are connected, or can they hide that as well??

Thanks in advance.

I have had great luk with Zonealarm. Have had one breach. Blocks anything that goes to or comes from your computer unless you give it permission. Haven't had a chance to try TPF yet but I have heard that it is good.
ZA makes your computer ports invisible so it will be almost impossible to find any access points.
if you want to test out the firewall you choose go to
HackerWhacker,
GRC and try there firewall tests.
Hope thats hat you were looking for.

I feel as though Zone is a pretty good firewall, if its a question of integrity. I often try to advise people to roll their own level of security though. I know there are a few sites out there that will test your over-all protection level like this site www.grc.com. As for good hackers..in all honesty it comes down to the simple "if there is a will, there is a way" idea. Peace.

Thanks for the info, I was aware of the testing sites, and currently use zone alarm. I have tried Tiny but didnt really care for it. I was mostly wondering about how easy they are to bypass, I have seen multiple references on these boards about how they will not protect you if a real hacker wants in. Thats what I was wondering is if I should worrie and its super easy to bypass. Not too worried, I try not to piss too many people off online hehe. Also was wondering about the dos netstat command and if you could hide from it.

Again, thanks for the info :D

If they replace your version of netstat with their own modified version they can keep you from seeing any connections that they don't want you to see.

try running a "netstat -an" , that'll list all protocols along with the ports they're listening on.

l8r,

I use tiny, and as with zone alarm, nothing goes in or out without your permission. It did well at hackerwhacker but I want to test it against the trojan they have at grc.com.

If you are an old-timer I am sure you well know my opinion on software firewalls and IDS.

Basically....They are worthless, nothing more than a false sense of security.

A firewall to be truly effective needs to be a seperate entity. no exceptions. Similar to a moat around a castle. A firewall is meant to allow ONLY the good traffic to pass to the server.

If you are using a software firewall then the attacks/attackers are already at the door. Not to mention the fact that the IDS/firewall could be used to punish the machine it was meant to protect. If you do not have the resources to buy a good hardware firewall appliance, then look in the paper, and find someone selling any older PC for around $75-100. Add another NIC to it and install BSD or Linux. Each distro has the ability to be *just* a firewall. At install time it is one of the options.

-Q

Quote:

---

Originally posted by NoNeckJoe
If you are an old-timer I am sure you well know my opinion on software firewalls and IDS.

Basically....They are worthless, nothing more than a false sense of security.

If you are using a software firewall then the attacks/attackers are already at the door.

-Q

---

Better to just keep them at the front door rather than let 'em in!
Not everyone can afford to buy a new box just to run as a firewall, especially when the majority of software firewalls are free!


I think that if you've configured your firewall correctly (and lets face it....it's not very difficult) then you're a hell of a lot safer than a box without a firewall.


As for prefrences I think Tinys' Firewall is the best currently available, just my opinion.

whoooo, good info, thanks! Ok, more Q's....


Pr3shuR: Thanks :D will give that a shot :)


ThePreacher: The trojan thing was weak, all it is, is a program that trys to contact grc. Its meant to be simple though. If your firewall doesnt catch that though, then u got probs hehe. It does its job though. Just dont expect alot of bells and whistle's.

NoNeckJoe: Hrm, yeah would be nice, but gotta get the funds for that. Was wondering, I have a 10/100 3com hub. Do you know of anyway that I can set that up to have the cable modem plugged into the hub, and have 2 computers also plugged into hub and able to access the internet. I do not have a router or anything, so its pretty much hub only. On firewalls and such right now making sure im patched up and running ZA is about all I can do.

Also what do you think about the routers they have out now, like linksys that come with DHCP nat and firewalls? Gud/suck/noway?


Conf1rm3d_K1ll: Troo, better have something then nothing. I used tiny for a bit, but its too quiet, zone warns me whenever something trys to get to the net, also gives me hit counts and such. Who is trying to get in where. Again, I used tiny for a bit, but do not know it that well. I also like zones options of letting stuff access the net only when I want it too. Say like winamp, it allways ask to get to the net, if im running shoutcast then I allow it, if not then I dont allow it. With tiny it seems like I couldnt just click allow for this time. I had to click allow like 5 times, and then again some later. Or if I set to allow then it would allways allow it. Call me fickle hehe.

Thanks again for the info guys :D

Quote:

---

Originally posted by S1lv3r
whoooo, good info, thanks! Ok, more Q's....



Conf1rm3d_K1ll: Troo, better have something then nothing. I used tiny for a bit, but its too quiet, zone warns me whenever something trys to get to the net, also gives me hit counts and such. Who is trying to get in where. then I dont allow it. With tiny it seems like I couldnt just click allow for this time. I had to click allow like 5 times, and then again some later. Or if I set to allow then it would allways allow it. Call me fickle hehe.

Thanks again for the info guys :D

---

LOL...Of course you had to click around 5 times! You should have checked the little box that says "Create appropriate filter rule?"

Quote:

---

Originally posted by Conf1rm3d_K1ll




LOL...Of course you had to click around 5 times! You should have checked the little box that says "Create appropriate filter rule?"

---

Hehe, I KNOW! But if its a program that I want tiny to ask me everytime it wants to access the internet, then how should I set the filter. From what I remember it was off or on, not ask me for auth. Is there an option for this?? Again tiny was so quiet, felt like it wasnt doing its job hehe.

I see what you mean now.


Unfortunatley you would still have to create the appropriate filter rule to let the program access the 'net.........then when you've finished with that program you would have to delete the appropriate filter rule so Tiny would ask you next time it tried to access..

NoNeckJoe: Hrm, yeah would be nice, but gotta get the funds for that. Was wondering, I have a 10/100 3com hub. Do you know of anyway that I can set that up to have the cable modem plugged into the hub, and have 2 computers also plugged into hub and able to access the internet. I do not have a router or anything, so its pretty much hub only. On firewalls and such right now making sure im patched up and running ZA is about all I can do.

Also what do you think about the routers they have out now, like linksys that come with DHCP nat and firewalls? Gud/suck/noway?


You would need a router to with at least gateway address then you could plug that into the DSL line and then in to the hub and give multiple PC's access to the internet.

Yes personally I like the new linksys routers with the built-in firewalls.

-Quad

Conf1rm3d_K1ll: Yeah, thats too much work hehe. So I just stick with zone :D

NoNeckJoe: Yeah looks like I will have to get a router then :(

On the routers with firewalls, thanks for input :D

s1lv3r, GET the LINKSYS bro! The thing is filthy, it has probably been the best addition to my network at home................

I am using a linksys in a small business setting, and am woudering how secure it really is. Its good enough to keep what I know out..but I also dont know that much. I guess I feel like its too easy, and generally if its too easy I am forgetting sumthen. For may purposes I want everyone denied, but people behind it to browse.
Thanks
Phil

Quote:

---

Originally posted by S1lv3r
Are they super easy to bypass for basically anyone that knows what he/she is doing?

---

Depends on your security level, to some degree. I would almost always go with the strategy of blocking everything by default, and only allowing explicit things to work... rather than allowing everything by default, and making filters to catch stuff you don't want.

Quote:

---

Also, are there ways to hide connections from netstat in dos. Basically, if I think someone is in my system, but has bypassed zone alarm. When I do a netstat, will that show that they are connected, or can they hide that as well??

---

What Pressure said. It is possible (though not that likely, given that they would have to make it look exactly like netstat), if there is a trojan on your computer that really starts mucking with system stuff. But if there isn't a hostile program on your computer, and it's strictly from the outside, I would say no... Unless you cound a stealth scan as a 'connection'... (Which it isn't, if you think about it.)

Quote:

---

Originally posted by S1lv3r
I used tiny for a bit, but its too quiet, zone warns me whenever something trys to get to the net, also gives me hit counts and such. Who is trying to get in where. Again, I used tiny for a bit, but do not know it that well. I also like zones options of letting stuff access the net only when I want it too. Say like winamp, it allways ask to get to the net, if im running shoutcast then I allow it, if not then I dont allow it. With tiny it seems like I couldnt just click allow for this time. I had to click allow like 5 times, and then again some later. Or if I set to allow then it would allways allow it. Call me fickle hehe.

---

Uhm... Did you click 'remember for this specific computer'? The thing is, it MIGHT have created a rule that was specific to either a certain computer or a certain port. (I can't speak for the latest version, it doesn't work for me. I've only used 2.0.6) That way, whenever you want to connect to one that you haven't connected to before, it might ask you. There is a simple way to fix it... Just edit the rule yourself so that it works for the stations you like. Tiny's auto-add feature isn't that wonderful. (But I didn't mind, because I always wanted to edit it myself anyway.)

Pr3shuR: Thanks for the input, I will look into linksys as soon as funds allow :D

Terr: When I get home going to work a bit with zone, will post up some results. This pertains to the other vuneralbility<gg spelling> post that I put up. Seems as though no software firewall is that secure, but again, better then nothing at all.

On Netstat, yeah I was just wondering if that could be faked at all. Seems like they would have to have full access to your computer before they could fake anything out of netstat.

On Tiny, yeah I used for a bit, its just too quiet, I got so used to zone alarm allways having stuff for me to look at, tiny just sat there. Im sure it was doing its job, but bells and whistles just work better for me i guess hehe.

Thanks for the response :D