View previous topic :: View next topic |
Author |
Message |
JoanMercer Guest
|
Posted: Tue Jan 04, 2005 3:14 pm Post subject: Reality check... |
|
|
Reality check: This is *hardly* a newsworthy "vulnerability".
The possibility of a trojan disabling your firewall by (SHOCK HORROR!) asking a personal firewall to let it connect out is by no means a new idea, and has been patently obvious since the first personal firewalls were released.
This "vulnerability" will probably affect almost *all* personal firewalls (i.e. firewall software running on the same system as it's protecting), and in practice, I suspect that there's probably not a massive amount that will be done to plug this fact for awhile yet; although sandboxing would help (prevent trojans from running or accessing any kind of resource).
Both of the solutions suggested will be of debatable use:
Add a password entry dialog? All an attacking application need do is spoof it - better yet, monitor the keyboard and all windows displayed, then capture the user's password the next time it's entered...
(Perhaps we'll see another "vulnerability" by Ferruh re password sniffers in the near future!)
Defaulting to rejecting connections by default? If attacking software can allow itself to connect out, it probably won't have too hard a time changing the default...
(Note: This post is not intended as a flame, but come *on* people!) |
|
Back to top |
|
|
grantassassinW Contributor
Joined: 13 Nov 2019 Posts: 1
|
Posted: Wed Nov 13, 2019 2:52 pm Post subject: Re: Reality check... |
|
|
JoanMercer wrote: | Reality check: This is *hardly* a newsworthy "vulnerability".
The possibility of a trojan disabling your firewall by (SHOCK HORROR!) asking a personal firewall to let it connect out is by no means a new idea, and has been patently obvious since the first personal firewalls were released.
This "vulnerability" will probably affect almost *all* personal firewalls (i.e. firewall software running on the same system as it's protecting), and in practice, I buy essays cheap and find arguments that there's probably not a massive amount that will be done to plug this fact for awhile yet; although sandboxing would help (prevent trojans from running or accessing any kind of resource).
Both of the solutions suggested will be of debatable use:
Add a password entry dialog? All an attacking application need do is spoof it - better yet, monitor the keyboard and all windows displayed, then capture the user's password the next time it's entered...
(Perhaps we'll see another "vulnerability" by Ferruh re password sniffers in the near future!)
Defaulting to rejecting connections by default? If attacking software can allow itself to connect out, it probably won't have too hard a time changing the default...
(Note: This post is not intended as a flame, but come *on* people!) |
Hello,
BugSec Group and Cynet integrated DNS Defender with the machine readable threat intelligence in 2015. Any updates since then or movements to avoid this? In September (2019) there was a security alert: Fortinet Firewall SSL VPN Vulnerability. |
|
Back to top |
|
|
Roomania Contributor
Joined: 31 Dec 2019 Posts: 1
|
Posted: Tue Dec 31, 2019 1:45 pm Post subject: Wow |
|
|
Good thing a found this topic, I always feared that If I'm going to buy essay in UK someone would hack me, thank you for sharing! |
|
Back to top |
|
|
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
Powered by phpBB © 2001, 2666 phpBB Group
|
|