Printable View
I have just been here http://www.astalavista.net/new/network.php
If you have a look what is here you will proberbly be quite suprised.
I have an up to date version of ZONE ALARM but all this info is still displayed.
Either this is just a clever bit of Java or Zone Alarm isnt doing its job properly.
Can anyone else shed any light on how this is happening and how to stop it happening??
Zone Alarm is probably doing its job as far as it can. The code is just pulling the values from the Browser (IE, Netscape, whatever). As long as you allow the browser to give out info and allow the browser to connect servers, it should give this information. Some browsers, tho', tend to be more verbose than others. The code pulled a lot on me except for hard drive info. I suspect that windows machines and IE combinations give out a little more info.
Haha, It's all IE and cheap Java...your not in any danger...
I though it was!! Yep your right MsMittens i run xp and it shows my whole HDD!
O well nothing to worry about then, cheers folks!
I run XP also, but use Mozilla as as a broweser, andn it doesn't pull anything from my hard drive. Here is a screen shot of what it got.
[edit] And I also use ZoneAlarm for a firewall
Thats because the Java isn't compatible....The java just shows it localy, it's like askind Internet Explorer to make a window and let explorer browse from there.
Yep all the info is in the header information from the Browser.. as well as a quick cookie scan..run something like The Proxomotron.. and it will tell you a different story stop all cookies.. and it will tell you less.
As for the HDD ..hehehe... nice old joke that one... A HTML trick.. At this time I can't find a link nor can I find the Code.. simply they create a table in HTML and tell your computer to display the contents of c:\ .. no transfer of information.. on this particular page the code is referenced fromnot being a HTML guru.. Lammerdisc.htm is on the server and has the code I discussd earlier..Quote:
src="lammerdisc.htm"
Not sure now if Java was used in this HDD trick....
check the Sourcecode for the page...you will learn somethings..
cheers
It's a lame trick. Here's some of the source code for the page.
notice the statement " src="lammerdisc.htm" .Code:<table width="100%" border="0">
<tr>
<td><a name=1>Your hard drive</a></td>
</tr>
</table>
</td>
</tr>
<tr>
<td id=tablec valign=top align=left bgcolor="#E6E6E6">
<table width="90%" border="0" bgcolor="white" align="center">
<tr>
<td><iframe name="lamer" src="lammerdisc.htm" width="100%">Your
browser doesn't support this iframe</iframe></td>
</tr>
</table>
Here's the source of " lammerdisc.htm.
the expression "file:///c:" will display the contents of the C drive in yourCode:<HTML><HEAD>
<META NAME="description" content="Your harddrive lamer">
<META NAME="keywords" content="Your harddrive lamer">
<TITLE>Your harddrive lamer</TITLE>
</HEAD>
<FRAMESET ROWS ="100%" BORDER="0" FRAMEBORDER="0">
<FRAME SRC="file:///c:" SCROLLING="AUTO" NAME="bannerframe" NORESIZE>
</FRAMESET>
<HOFRAMES>Your harddrive</NOFRAMES>
</HTML>
browser, but, AFAIK, does not make the info available to them.
Someone please correct me if i am mistaken.
:cool:
YOUR HARD DRIVE
If you have linux, you don't have a C drive, so it doesn't work.
As a test; I Zone Alarm. My 'Hard Drive' does not display on the page.
Back to Kerio.....My 'Hard Drive' is not displayed.
IE6 blocking it ?
Click here to see your c: Drive
Click here to see your d: Drive
Click here to see your e: Drive
Unless I'm wrong, those link will open Explorer in C: D: and E:
It doesn't work seen to work for me on my Nt 4.0 Machine. Not sure if you need a Iframe for it to work but it's realy to set up with a link to file:///c:/
I also am running XP and do not display anything but zone works great and I wuld recommend ot to anyone specially novices who cannot configure there firewall very well.Have fun and uninstll then reinstall and do everything by default...
OK, so its obviously a very easy "trick" if you know what you are doing but is there a way for a web site to actually view your HDD when you visit thier site and if there is how would a fire wall like ZA stop it, as although it would block your ports you would have already made a connection to the site?
Zone Alarm won't stop it, not even a 10 thousand dollar hardware based firewall would likely stop it. What would stop it is another layer of security like restricting what can be executed in your browser or site filtering software. McAfee active scanner can look for bits of nasty java and active-x code. Hell Xupiter is a prime example. All you had to do was skim across a site and you had the spyware loaded. There are a lot of sploits that can take advantage of unpatched systems as well. Browsing to bad internet sites scares me more than virus infections. I have those locked pretty well but.... Internet Explorer is doorway. This is why content filtering devices are starting to emerge and play a role in the perimeter.
How many of those software updates Microsoft puts out say "exploit through active x that can let a user execute code on your pc and take control" once a week I think... and I still have pig headed IT friends who don't like the autoupdate feature in Windows and they ignore them. :confused:
I suppose one can get all butt puckered up about this but really RoadClosed hits it pretty good however this info is just outbound info the hand shake with another server and such things are need just to connect do a google on hand shakes with computers. Anyway it's ligit outbound traffic from me no magic there and my IP may or may not be proxied and what is displayed may or may not be true because I can pretty much set such things with what I have. What I watch for most is in bound traffic, so what of someone catches my IP is it real or meoriex? Any inbound traffic is simply ignored outside the port I'm on and other scanners may catch any java or javascript things. Like the user that has the cute sig that gets the ip addy and ISP to funny played with things laughed t the names I could have in the sig. :)
well all i can say about this is that hen we were running zone alarm we had no problems with it.
Nightfalls_Girl