AplusWebMaster
Topic Starter
FYI…
- http://www.securityfocus.com/infocus/1839
2005-06-08
"The concept of a firewall still brings to mind the picture of an impenetrable brick wall, the unsurpassable magic protector of all that is good. The bold statements made by today's security vendors only emphasize this, with claims of complete and automatic security, with a wall able to block all perils dead in their tracks using logic that perhaps didn't exist two years ago. But what if in reality the wall of the firewall is made of straw?… Only a few of these problems are adequately addressed in today's firewalls. The truth is there are simply too many ways for malicious code to disguise itself in order to fool a software firewall's process filtering, ranging from the simple to the very complex. An illegitimate process could patch another legitimate process in memory. It could take advantage of a legitimate program's behaviour, for example by launching a browser with a command line telling it to load a given malicious page. Even in the advent of the process filter scanning for parent-child relationships, multiple levels of indirection could be used (the illegal process could launch cmd.exe with a command line telling it to launch another cmd.exe, which will then launch the browser with the intended page). Or the rogue application could adopt aggressive tactics against the firewall, disabling it altogether, faking mouse clicks to click through the alerts…"
(Use the URL link above for the full article)
- http://www.securityfocus.com/infocus/1839
2005-06-08
"The concept of a firewall still brings to mind the picture of an impenetrable brick wall, the unsurpassable magic protector of all that is good. The bold statements made by today's security vendors only emphasize this, with claims of complete and automatic security, with a wall able to block all perils dead in their tracks using logic that perhaps didn't exist two years ago. But what if in reality the wall of the firewall is made of straw?… Only a few of these problems are adequately addressed in today's firewalls. The truth is there are simply too many ways for malicious code to disguise itself in order to fool a software firewall's process filtering, ranging from the simple to the very complex. An illegitimate process could patch another legitimate process in memory. It could take advantage of a legitimate program's behaviour, for example by launching a browser with a command line telling it to load a given malicious page. Even in the advent of the process filter scanning for parent-child relationships, multiple levels of indirection could be used (the illegal process could launch cmd.exe with a command line telling it to launch another cmd.exe, which will then launch the browser with the intended page). Or the rogue application could adopt aggressive tactics against the firewall, disabling it altogether, faking mouse clicks to click through the alerts…"
(Use the URL link above for the full article)