Zone Labs jumps on new Windows security API, but do we need more?

TalkBack 31 of 79:

Next »

« Previous

• Thread View
• Flat View

easy

you compromise the firewall, from the outside, no need to even attempt it from the inside, just take it out from the outside. Software is software, and can be exploited, and firewall software is no exception. Remember the deal with BlackIce a few months back, where there was a worm that exploited a buffer overflow in the software for the firewall and basically ended up with system level access to the computer, effectively trashing the installation and require the user to reinstall windows to get the PC up and running again? You could do a similar thing causing an overflow which would in turn "crash" the program, preventing it from being able to pop up its warning. Then in the overflow space, you can get code to run which effectively disables the ZoneAlarm drivers, and a quick restart of the net services, and you can probable pull it off without the user even knowing their internet access was cut and reestablished (unless their doing file sharing or similar connection oriented communication).

Firewall software running on a machine, actually creates a security risk that isn't present if the firewall is on a sepearate device (ala router). In that situation, if the firewall is compromised, it pretty much shuts down the device, and you know immediately, because your internet access gets cut off. You don't end up losing your machine if someone performs a buffer overflow on yoru firewall if its not software running on your machine.

Firewall software on your machine however, performs stateful packet inspection on every packet it picks up, where a non-software firewalled machine drops any packet not bound for a port its listening on, you can only overflow the entire stack if you are trying to compromise a port that the PC isn't even listening on. Not true with firewall software, you can compromise traffic on any port, with the right exploit, as the firewall has to inspect each packet, BEFORE it decides if the packet gets forwarded onto the PC's network stacks, effectively, giving an exploit a chance to strike, that would have no chance, if you weren't running the software firewall.

Posted by: tamuhockey   Posted on: 08/09/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now