RE: How to easily bypass a firewall...

["Sir Humpsalot" <sirhumpsalot97 () hotmail com>]

> > At 03:49 PM 7/28/2003 -0500, you wrote:
> > >5. Firewall dialog box uses random numbers / letters represented by
> > >graphics that the user has to enter in a password field if
> > the password
> > >is not correct sound alarm, halt system.
> >
> > know of anything that does this?
> >
> Would it matter?  The scenario that was proposed is that there's a
> trojan on the box, and it can attempt certain methods of
> programmatically disabling the firewall.  If there's a trojan on the
> box, what does it matter?  *Anything* on the box can be disabled at that
> point.
>
> If I break in to a Linux box, for example, all I have to do, once I have
> root, is type:
> % /etc/rc.d/init.d/ipchains stop
>
> If it's a Windows box, I just kill the service:
> C:\ sc stop {firewall servicename}
>
> Or install the pstools to do it.
>
> The point is, once the box is owned, nothing else matters.

What you're doing requires admin/root privileges.

You don't need to be an admin to enable the trojan Internet access. Most/all 
windows firewalls (eg. Sygate and if I remember correctly, at least one of 
Norton and ZoneAlarm) allow limited users to decide if an app should have 
access to the Internet. That is, they don't care if you're an admin or a 
user. Thus a trojan doesn't need to be running as an admin; a limited user 
is enough to access the Internet. Just click YES when they ask the user if 
he/she wants to allow the program Internet access...

_________________________________________________________________
The new MSN 8: smart spam protection and 2 months FREE*  
http://join.msn.com/?page=features/junkmail

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html