Will Your Firewall Stop This?

Quote:

---

Originally posted by Samurai@11 January 2004 - 07:16
Out-Bound Protection eh? Ok, when I've run that file that was downloaded and gone through the whole process, not once does it even enter my list of applications using the Internet.

I already know it's using IE after a couple of tests, but we can't just disallow using IE because of this fact.

---

Thats because it hijacks any process running on your computer at the time and if youve already told Internet explorer it can access the net then this test will"hijack" that process and access the net because youve previously told it(IE ) that its allowed to...Internet explorer isnt gonna tell you its been hijacked and your firewall is just doing what youve told it too previously

And if Internet Explorer isnt running at the time of the test watch how many other processes it hijacks

i passed (i think) the program came up with a error so i terminated it :D

:lol: :lol: :lol:

i keep getting this error so i guess i pass <_<

http://server5.uploadit.org/files2/1...1111111111.GIF

If ya firewall didnt stop it you didnt pass, as it tests your firewalls outbound security..it doesnt test for errors...lmao

i failed pcaudit and firehole with ZA Pro&#33; what can i do to make ZA more secure without switching firewalls?

EIDT: i think i know why i failed firehole... i checked do not show alert again when IE6 opens up. but i still dont know y i failed puaudit&#33;

Quote:

---

Originally posted by Samurai@10 January 2004 - 17:17
Well we haven&#39;t heard from anyone using Zone Alarm & Pro users so maybe that&#39;s one. Possibly BlackIce is another.

---

zone alarm pro failed me :(

what&#39;s it mean if the IP they say you&#39;re on isn&#39;t the IP you&#39;re on?

Did ya wall pass or fail?

I tried with my online banking and i tried a txt document from "My Documents" and either way the test first tried to hijack my browser, then when that failed proceeded to attempt to hijack every running process on my computer in an effort to connect to the net
this test is designed to test your firewalls outbound security and as you can see from the thread theres some pretty shocking results B)

OK here are my test results.

Oldish version of Kerio (the one similar to the old Tiny): Failed
Sygate Pro: Failed
Zone Alarm: pass&#33;

I have to make an admission here, DVD_PIRATE did PM me and tell me that Zone Alarm would pass :)

The reason some of you have failed the test with ZA is because you havent enabled component control.

Go into ZA options and click on Program Control. Set the slider to high or click custom and tick both boxes.

Then click on the programs tab in the top right and see which programs are allowed access to the net. Right click on each of these programs and select options. Make sure "Authenticate components" is ticked.

Now run the test again. You will get loads of warnings, say no/deny all of them.

If everything went according to plan you will have passed the test&#33; :01:

We should all be thanking DVD_PIRATE for this info, we&#39;ve all been sitting behind our firewalls feeling safe when they&#39;ve been abouit as much use a chocolate fireguard&#33; I&#39;m certainly feeling very grateful anyway :)

Quote:

---

Originally posted by DarthInsinuate
what&#39;s it mean if the IP they say you&#39;re on isn&#39;t the IP you&#39;re on?

---

It means that your connection is going through a proxy server, this might be set in the Internet Options in Internet Explorer or it could be your ISP putting all your connections through their own proxy server.afaik they usually do this for dialup users to speed up their net access.

Thank you for the very thorough and informative post..
congratulations..
remember people I only told him it (Zone Alarm) would pass, so full credit to Leftism for figuring it out

Now if only someone would turn up with the other 2 firewalls that I know have passed I&#39;ll be a happy camper... :P

what are the other two

YES&#33;&#33; im safe woth ZA now. thanks&#33;

The ZA way seemed to work for me as well, but it&#39;s too bothersome... i mean, i&#39;d hate to have to allow/block programs again and again each time they try to access the internet (that&#39;s how it works with the high security setting)... i feel unsafe :(

well its safer than having a trojan like this access the net..id rather take the time and energy to make a couple of extra clicks with my mouse than be to lazy and lose out big time in the long run...
might as well uninstall it..if you cant let it do its job , then its pointless having it

A lot of people are missing the point here...if youve allowed say for instance internet Explorer access to the net and some trojan youve got hijacks IE, then your firewall is gonna let it out because youve allowed IE access to the net..
basically you just got OWNED if that happens

FAILED
Sygate Personal Firewall version 5.5 build 2516
:o :frusty: :frusty: :frusty: :frusty:

Quote:

---

Originally posted by cpumaster1@11 January 2004 - 10:37
what are the other two

---

CPUMaster...Its me "Skank"..what firewall are you using?

Passed









After chosing "Block All"
:D

Norton internet security 2003, failed, failed, failed http://www.mcbriens.net/liam/img/smilies/fingerleft.gifhttp://www.mcbriens.net/liam/img/smilies/swearani.gif

Sorry for going slightly OT but does anyone know if the same principle would work with linux? I mean DLL&#39;s are the same as shared libraries right? Can you load/unload shared libraries at runtime with linux?

I suspect this issue is really more of a problem with the windows architecture but it would be &#39;interesting&#39; if this attack worked with linux as well.

Who wants to check there anti-virus/anti-trojan scanners?...go to this thread if ya not afraid...lol

http://klboard.ath.cx/index.php?showtopic=93194&hl=

here come some more failures...lol

as for linux Im not sure but id say no off the top off my head , but then again..ill give it a test this evening on a linux comp

Should I get Zonealarm Pro from Kazaa and what is the latest version? I can&#39;t get on their website. Same reason as I posted before about being unable to go on the symantec website.

Zone Alarm Pro 4.5.538 with Web Filtering is the latest..download the trial and ill pm u a key if ya want

well D, the &#39;other&#39; f/w failed :(
f*cker was a b*tch to configure, musta done somethin wrong :unsure:
plus, no matter how many rules i created, port **** was still open :blink:
tried blockin UDP, TCP, ICU, FBI, CIA........... :lol: :P
just d/l&#39;ed ZA pro and Sygate pro :lol:
i&#39;m gonna get a freakin f/w to pass :P :lol:

the ICU,FBI,CIA is BS of course :P
but seriously, tried every protocol, in & out, unknown, you name it :blink:
this shits givin me a headache :lol: :lol: :lol:

I am currently removing Norton Personal Firewall 2004 Pro, Gonna get what you suggested.

Can you send me the installation file for the firewall? All the ones that I am downloading are corrupt.

Here is an ed2k link for the latest version with a working keygen.

ZoneAlarm.Pro.with.Web.Filtering.v4.5.538-ROR.ShareReactor.zip

and just in case the board doesnt like ed2k links..

Quote:

---

ed2k://|file|ZoneAlarm.Pro.with.Web.Filtering.v4.5.538-ROR.ShareReactor.zip|5100676|af7ef45e287871221cd5c52a2af489ab|/

---

Sorry theres no sig2dat link but most people seem to be using either overnet, emule or edonkey these days. (Only took a few minutes for me with overnetlite)

Please understand people that i cant configure your firewalls for you so there may be walls that will stop this if the F/walls configured properly..
No Im not a Zone Alarm premoter,just a user...lol
hope this was a learning experience for everyone who tried this..
it sure was entertaining for me.. :D

this thing is slow, is going at a rate of 3.3kb/s

Well, I failed with Sygate. :(

:lol: :lol: :lol: :lol: :lol: :lol:

NOOBS&#33;&#33;

Trojans don&#39;t ask you to click buttons so they can take a screen shot while connected to a trusted zone and send it back to a trusted site. No they don&#39;t&#33;

Just because it said "next" doesn&#39;t mean it&#39;s not an "OK" button.

You failed the test, not your firewall.

Hijacked? Hijacked what?

Hijacked your brains :lol: :lol: :lol:


I bet every one of you also has NetBIOS over TCP/IP installed too. "file and printer sharing". This isn&#39;t for "filesharing" with peer to peer programs, this is for allowing others access to your files and printer with no program and very little authorization needed. WISE UP.

If you can&#39;t figure out how to disable this crap, then at least check your firewall settings for it.

Quote:

---

Sygate: By default, Sygate allows other PCs on a Windows network to browse--but not access--your files and printers. To enable sharing, right-click the firewall&#39;s system tray icon and choose Options,Network Neighborhood. From the drop-down list, select the network interface you use to connect to the Windows network, check Allow others to share my files and printer(s), and click OK. Sygate&#39;s default setting allows only PCs on the local network to browse and access your files and printers (choose the Security tab to view this and other settings).

---

If you have multiple network adaptors or VMware or VPC installed with virtual connections, then uncheck them too. You have to do it for each device.

I&#39;d recommend computer courses for anyone who didn&#39;t figure this out. Sans institute is a good place to start. Lot&#39;s of free articles and webcasts and some very good courses.

Or stay stupid and run off and look for some other software to make up for the damage caused by your abuse of illegal substances <_<


:P

Quote:

---

Originally posted by KrackHead2k@11 January 2004 - 13:32
Well, I failed with Sygate. :(

---

Dont feel left out mate cause your not alone on that :P

@ balamm..noob ya self..a failures a failure...
if it was a real trojan then just about everyone was fucked...lol

Bring your self over to the virus thread and lets see what else you got please..id like ya opinion on it..cough cough

Quote:

---

Originally posted by balamm+--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (balamm)</td></tr><tr><td id='QUOTE'>
Trojans don&#39;t ask you to click buttons so they can take a screen shot while connected to a trusted zone and send it back to a trusted site. No they don&#39;t&#33; [/b]

---

Your right they dont. Whats your point?

Quote:

---

Originally posted by balamm+--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (balamm)</td></tr><tr><td id='QUOTE'>
Just because it said "next" doesn&#39;t mean it&#39;s not an "OK" button.

You failed the test, not your firewall. [/b]

---

eh?

edit: Ah I see. You think that the only way a trojan could achieve this is by getting the user to click buttons? No my friend. The loading and unloading of DLL&#39;s happens without user interaction all the time.

Quote:

---

Originally posted by balamm

Hijacked? Hijacked what?

Hijacked your brains

---

right... <_<

The DLL hijacked a trusted application and the vast majority of firewalls dont notice regardless of their configuration. Do you even know what a DLL is??

Quote:

---

I bet every one of you also has NetBIOS over TCP/IP installed too. "file and printer sharing". This isn&#39;t for "filesharing" with peer to peer programs, this is for allowing others access to your files and printer with no program and very little authorization needed. WISE UP.

---

No I dont have it enabled. But thats got nothing to do with this at all. Whos the NOOB now?

<!--QuoteBegin-balamm@

If you can&#39;t figure out how to disable this crap, then at least check your firewall settings for it. [/quote]

I disabled it and my firewall still failed the test. Whats your point?

<!--QuoteBegin-balamm
Or stay stupid and run off and look for some other software to make up for the damage caused by your abuse of illegal substances [/quote]

I see your wit is matched only by your logic <_<

btw I&#39;m a 2nd year computer science student with a lot of experience in network programming. Nothing you&#39;ve said is even related to this topic of DLL hijacking. It is you who needs to be educated not us :)

I hate know it alls ...lol :D

@Balamm...whoever said it was a trojan?
Have a look at the name on the thread...lol

Basically this tests your firewalls outgoing connections, and i know your firewall failed..that mustve been a blow to the old ego :helpsmile:
Please research a little more before misinforming people..you dont know it all so dont pretend to..
noob? u the only noob here mate... B)

I failed, maybe thats because I dont have a firewall. Comeone someone hack me, and get pass my NAT :P

Zone Alarm all the way, secure and tight

what about xp&#39;s?

Quote:

---

what about xp&#39;s?

---

XP&#39;s firewall? Worse than useless :)

It only blocks incoming packets not outgoing. :lol: :lol: :lol:

Apparently they&#39;re going to release a new implementation of it in service pack 2, but I recommend you stick to one that isnt vulnerable to this DLL hijacking attack.

I recommend Zone Alarm, but make sure you follow the instruction in this thread and enable component control.

That component control makes or breaks Zone Alarm...
Good post on how to get around it with Z/A leftism


heres some comments from elsewhere that give you a REAL explanation of whats going on, not just some halfwits pathetic excuse for why his/her firewall failed.

Quote1
The browser is not the only way pcAudit tries to get out to the internet. My understanding is that it scans all the active processes in your computer, trying to find one which has the ability to connect to the internet. This could be your instant msg, your antivirus live update, your webcam, etc.
Then pcAudit piggybacks on the component to sneak out of your computer.

Sygate Personal Pro 5.5.2513: FAILED
Sygate has intercepted some outbound attempts that I answered "Block". However at the end pcAudit could connect to its home, probably through a component that I previously enabled access to the Internet. I&#39;ve made several tests, shutting down some more resident programs. Each time Sygate fails. It would be ironical if pcAudit could use Sygate itself to get to the Internet.

ZoneAlarmPro 4.5.538: PASSED
ZAP asked permission at every outbound attempt. Some of them I don&#39;t even know that could connect to the Internet like CTHelper (SB Live), LVCom Server (Logitech Webcam). I told ZAP to block all of them. At the end, pcAudit is stuck.


Quote2
In my understanding this is a test to simulate a hacker attack into your system, so instead of pursuing for another firewall for the 100th time I just installed this app: CODE
http://maxcomputing.narod.ru/ssme.html?lang=en

and enable the "Watch App Activity" in it. It catches the dll injection that pcaudit tries to do in your browser. If you try to run pcaudit it will crach and leave a log file. You won´t see the pcaudit screen saying that your firewall passed, but as its simulates a hackers attack, the fact that it can´t even run, I think is even better.

And in the pestpatrol website says that it catches pcaudit, but since I don´t have it I don´t know if this information is correct.
End Quote 2

It failed because I allowed it to fail. ;)

If you&#39;re stupid enough to accept this "package" and run it, then don&#39;t blame it on your firewall.

@leftism, It might not be too late to ask for a partial refund. 2 years and still haven&#39;t picked up any common sense.... that&#39;s a real problem.

According to your logic, every element and every script on a page should be blocked by the firewall... untill you ok it. :lol:

So I sat and watched this program for some time to test your theory that it could do something on it&#39;s own, that a .dll would magically take the initiative.
Nope, nothing.

I had to physically press a button, several in fact, allowing it to do what it was coded to do.

At which point it did what I had allowed it to do. These are the .DLL&#39;s it called -

The new DLLs have been loaded:
C:&#092;WINNT&#092;system32&#092;caboview.dll
C:&#092;WINNT&#092;system32&#092;ws2help.dll
C:&#092;WINNT&#092;system32&#092;ws2_32.dll
C:&#092;WINNT&#092;system32&#092;wsock32.dll
C:&#092;Program Files&#092;TechSmith&#092;SnagIt 7&#092;msvcr71.dll
C:&#092;WINNT&#092;system32&#092;umdmxfrm.dll
C:&#092;WINNT&#092;system32&#092;serwvdrv.dll
C:&#092;WINNT&#092;system32&#092;msvcrt.dll
C:&#092;WINNT&#092;system32&#092;ADVAPI32.DLL
C:&#092;WINNT&#092;system32&#092;GDI32.DLL
C:&#092;WINNT&#092;system32&#092;USER32.DLL
C:&#092;WINNT&#092;system32&#092;KERNEL32.DLL

Then, at the continue prompt,

The new DLLs have been loaded:
C:&#092;WINNT&#092;system32&#092;mvbscript.dll
C:&#092;WINNT&#092;system32&#092;msrating.dll

And if you don&#39;t want these things communicating next time you&#39;re stupid enough to press that button, here&#39;s where you configure that.

http://members.shaw.ca/fourum/rules.jpg

All the software you need is right in front of you and you just can&#39;t see it. All you gotta do is use a bit of logic and common sense to figure it out.

It&#39;s easier to make excuses though isn&#39;t it. <_<

youve just proven to the whole board that your the only one thats making excuses.. :D
what a dickhead B)

you dont get the part that its simulating an outgoing attack,from maybe running a key gen to installing some dodgy software...
ever since ive seen you on this board balaam youve got an excuse for everything..
Youve proven to the board without a doubt your a nothing... :lol: