More software firewall holes...

More misc software firewall vuneralbilities.

http://www.newsbytes.com/news/01/171949.html

This stuff bypasses any software firewall, zone tiny whatever. From what it says.

Quote:

---

Techniques for defeating the outbound data filters in popular personal firewalls such as Zone Alarm and Norton Personal Firewall have been independently posted on the Web by several researchers. Using the methods described, a rogue program could upload private user data without being detected by the firewall, the experts claim.

---

Dunno if this has been posted yet. But thought it was an interesting read.

Firehole failed to get past my firewall :D
Tooleaky won though :(

Here is some info i found on SetWindowHookEx.

Got thru my firewall... But ZoneAlarm says they will fix it, so no need to worry. :)

Quote -

Freund said that Zone Labs will release an update to Zone Alarm next week that will provide limited protection against the bug on Windows NT, 2000, and XP systems. A more complete fix will be incorporated in the next full release of Zone Alarm, version 3.0, which is due in January.

End of quote

Now this is scary. It busted through Tiny as though it wasn't even there. I need to know how to stop this, even if it means creating my own firewall.

Quote:

---

Originally posted by ThePreacher
Now this is scary. It busted through Tiny as though it wasn't even there.

---

I don't know how you've got Tiny configured but I'd take a guess and say that something's wrong!

I, like you, use Tinys' Personal Firewall. After running leak test this is what Tiny told me-

'Firewall Leak Testing Utility' from your computer wants to connect to 207.71.92.193, port 80

Obviously, you click on the deny button.


You then get the following message "Unable to connect due to a properly configured firewall"

Did you try one of the files listed on that site?? Leaktest wont get out, but those will. From what they say. Try one of those with tiny and see what ya get.

I'm at work right now. Planning on toying around with zone alarm when I get home, and seeing what it does.

I've used both leak test (the results are in my previous post) and when I tried using Firehole I got the following results-
Either the program or failed to connect or did not recognise your web browser (IE6 and Opera 5.12)


BUT, when I ran too leaky I got the following results-
Success! Which means your firewall is useless!



So, there you have it...I hope Tiny release a patch in the near future to rectify this "tiny" problem!


:killcompu


I have found a way of stopping too leaky breaching my firewall. What you do is delete the appropriate filter rules that allow IE access to the web and only allow Opera access. After doing this Tiny alerts you of too leakys attempts to access the web (which of course you block) and then gives some lame excuse that my connection is too slow or even down and it can't connect..


So there you go. It still seems having a software firewall is safer than not having anything..

Firewalls cause more tourble than they do help

u guys wouldnt have these problems if u werent running windows

Quote:

---

, like you, use Tinys' Personal Firewall. After running leak test this is what Tiny told me-

'Firewall Leak Testing Utility' from your computer wants to connect to 207.71.92.193, port 80

Obviously, you click on the deny button.

---

I was not talking about the leak test at grc.com. Tiny passed this with flying colors, and it also passed the Shields Up test perfectly. What I was talking about was "Firehole" at http://keir.net/firehole.html This thing got through Tiny Personal Firewall as though it wasn't even there.

Quote:

---

u guys wouldnt have these problems if u werent running windows

---

yeah ok it all makes since now..

Well it didn't get through Tiny and Zone Alarm just didn't do anything. That's is pretty crazy.

Quote:

---

Firewalls cause more tourble than they do help

---

actually they don't cause more tourble.

Quote:

---

Originally posted by Conf1rm3d_K1ll
I have found a way of stopping too leaky breaching my firewall. What you do is delete the appropriate filter rules that allow IE access to the web and only allow Opera access. After doing this Tiny alerts you of too leakys attempts to access the web (which of course you block) and then gives some lame excuse that my connection is too slow or even down and it can't connect..

---

Of course Too Leaky doesn't work anymore if you deny IE access to the net... I'm no C++ guru, but Bob Sundling was kind enough to include the source code... You might consider taking a look at it:

Quote:

---

// Step 1: Find the Internet Explorer executable (its location is in the registry).

---

Too Leaky was designed for IE, not for Opera. I'm pretty sure the C++ programmers around here can rewrite this thing to penetrate your firewall using Opera...

Quote:

---

Originally posted by Conf1rm3d_K1ll
After doing this Tiny alerts you of too leakys attempts to access the web (which of course you block) and then gives some lame excuse that my connection is too slow or even down and it can't connect..

---

That message ('"There was apparently no leak, your computer or Internet connection is very slow, or, most likely, the GRC.COM website is down temporarily. Please try again later.") will show up if
- you deny IE acces to the net (because Too Leaky was designed for IE).
- 30 seconds pass without Too Leaky being able to connect (due to a slow connection, GRC being down, or not using IE - or having a real good firewall, of course).

Again, I'm no C++ guru, but changing the '30000' in if ( (GetTickCount() - startCount) > 30000 )
return false; to a higher number should solve the slow connection problem.

Changing const char* baseURL = "http://grc.com/lt/leaktest.htm?"; into another URL should solve the GRC-problem, and the l33t C++-programmers out there can change the IE-routine to an Opera-routine...

There you go, Conf1rm3d_K1ll, problem solved :)

Quote:

---

Originally posted by arkan351
u guys wouldnt have these problems if u werent running windows

---

True, we would have other problems then...
And you wouldn't have a spelling problem if you didn't write. But then again, we enjoy facing problems, not avoiding them...

Quote:

---

Originally posted by S1lv3r
Dunno if this has been posted yet. But thought it was an interesting read.

---

Very interesting indeed. Thanks for the link ;)

Quote:

---

Originally posted by Anirak
Firewalls cause more tourble than they do help

---

And you wouldn't have a spelling problem if you didn't write. But then again, we enjoy facing problems, not avoiding them...
Dang, I'm repeating myself...

Quote:

---

Originally posted by Conf1rm3d_K1ll


I have found a way of stopping too leaky breaching my firewall. What you do is delete the appropriate filter rules that allow IE access to the web and only allow Opera access. After doing this Tiny alerts you of too leakys attempts to access the web (which of course you block) and then gives some lame excuse that my connection is too slow or even down and it can't connect..

---

You're right, Negative. It was just a "quick fix" solution to a rather complex problem!


Perhaps you could suggest an alternative?

Quote:

---

Originally posted by Conf1rm3d_K1ll
You're right, Negative. It was just a "quick fix" solution to a rather complex problem!
Perhaps you could suggest an alternative?

---

OUCH! No, I can't ;)

I'll leave that to the pro's :)

It would be interesting to try what Negative suggests.

Personally I would suggest that concerned users go buy an `el cheapo' pc from the local used computer shop, or drag one out of the spare junk closet.

Then put OpenBSD on that sucker. No keyboard, monitor, or mouse required. Get a couple of NIC's, and a switch. Once OpenBSD is installed build the packages for `ipfilter' , `tripwire', and 'host sentry'.

Now you can set up an internal network behind your ipfilter firewall, set up the firewall to accept ftp connections from inside the firewall only /* firewall admin */ etc. etc.

A host firewall is not the best way to go even if you only use one computer. The insta-firewalls like tpf and zone alarm are cool, but the worst possible thing you can have is a badly configured or incomplete firewall setup. Worse than none at all for sure.

ipfilter is really great, it does not work with any *nix OS's that use glibc, so that rules out Linux except for really old versions.

you can get OpenBSD at http://www.openbsd.org

ipfilter is a default package that comes with OpenBSD, FreeBSD, NetBSD and several others.

Some hints on setting it up can be found at:
http://www.freebsddiary.org
http://coombs.anu.edu.au/~avalon/ip-filter.html

And as always a good place to get the packages mentioned above and others for *nix is http://www.freshmeat.net

It is one of the firewall configs of choice for a good number of High Vis and High Risk sites, should note that ipfilter is hardly ever cracked if set up properly, but any firewall can be bypassed by the truly determined.

Check out sites to see what they run /* will only show what server is, not always indicative of firewall OS */ at http://www.netcraft.com

I think that it is funny that so many security "researchers" find these holes and take the time writing programs that prove the holes exist, but do not find a way to help protect us against these things. Is this really helping us? They expect the makers of the firewalls to do the fixing. If the problem can be fixed why dont they take real initiative after exposing the problem, and help develop the solution and make a bundle of cash at the same time. Whats the point in telling everyone that there is a hole in the boat, and you found it, but you didnt feel like plugging it and preventing the boat from sinking but that is the problem of the boat builder. If this sounds wierd its cuz I just finished a bottle of jack daniels and I think Im a little confused.

From what I have read,both Firehole and Too Leaky are based on the premise of first getting malware on the intended computer and then running said malware......although possibly a new angle,these seem to be not much different than any number of trojan programs out there.I'm not trivialising the problem,just saying that they are a new twist to an old problem.There's always another hole,there's always another piece of malware being written out there.......it all just enforces the importance of properly configured firewalls,up to date antivirus software,people needing to become more aware and better educated about what they may be downloading to their computers or where they surf(probably only wishful thinking on my part...oh,in a perfect world),and the need for some sort of public disclosure(whether it be full disclosure or partial) allowing softwaremakers to properly patch the problems,computer security people and network professionals to be aware there is a problem and try and defend themselves against said problem until a patch is hopefully made available.Again,I'm not saying this isn't an important issue......just the same old problem in a new wrapper,as I'm sure anyone out there involved with computer security for any length of time will agree.

This thing didn't work when I changed the IP address.....

YALTA's enhanced Leak Test were clean that my firewall didn't detect that connection and allowed it (as packets did get through), but the Classic test was lame as no connection was even made (blocked by firewall) but YALTA claimed to got passed it.....

You know people, the real issue in all those "leaking vulnerabilies" is getting malware on your computer first... No matter how much "firewall" vendors (firewall in quotes because the job you are expecting it to do is more IDS than firewall) tries to prevent it, once a malicous program has made it to the other side and has been executed, there is little you can do to be 100% safe... For example, the malware could even carry it's own tcp/ip stack and send directly to the modem or NIC, effectivly bypassing the firewall's filtering...

The point is, you have to be carfull who you let into your house, not lock your doors and hope you locked in the thief/spy...

Ammo

Quote:

---

Originally posted by ammo

You know people, the real issue in all those "leaking vulnerabilies" is getting malware on your computer first... No matter how much "firewall" vendors (firewall in quotes because the job you are expecting it to do is more IDS than firewall) tries to prevent it, once a malicous program has made it to the other side and has been executed, there is little you can do to be 100% safe... For example, the malware could even carry it's own tcp/ip stack and send directly to the modem or NIC, effectivly bypassing the firewall's filtering...





The point is, you have to be carfull who you let into your house, not lock your doors and hope you locked in the thief/spy...





Ammo

---

I couldn't agree more Ammo. It seems to me that a lot of folks tend to think that having these "personal firewalls" will actually prevent malicious code from communicating with the 'net if it gets onto the PC. This is mostly the same fantasy world wherein people believe that opening the attachment that came from their friend about Anna Kournikova is not a Stupid Move(TM).



If the code doesn't get there in the first place, then the "personal firewalls" are really just superfluous.



Oh, and by the way, the person who said that these problems would be nonexistant if you weren't running Windows would technically be correct. All of these incidents are specific to Windows, not any other OS.

Exactly...if people didn't click on random executables and open every attachment that comes along regardless of the source, these problems wouldn't exist. Sure, there's malicious code out there designed to be embedded into web pages and the like, but the vast majority still rely on someone getting and then foolishly running some sort of executable. While these holes do need to be addressed and fixed, it's still the old story of "an ounce of prevention vs. a pound of cure" and all that. All the same, interesting article, and kudos for posting the link.

Quote:

---

Originally posted by ronin13
From what I have read,both Firehole and Too Leaky are based on the premise of first getting malware on the intended computer and then running said malware......although possibly a new angle,these seem to be not much different than any number of trojan programs out there.I'm not trivialising the problem,just saying that they are a new twist to an old problem.

---