(e-mail address removed) ( Steve H) wrote in
Rem
I'm suprised you are not familar with leak tests. Since Steve Gibson's
famous original leak tests, dozens of such tests have sprung out, each
using ingenious methods to bypass outward bound filtering.
In general no, MD 5 signatures only work, if some software renamed itself
to have the same name as a trusted app, but it would then have a different
MD5 hash. This was the original crude method used by the original leak test
by Steve Gibson.
But nowdays leak tests don't use such methods.
Process/DLL injection, misuse of hardcorded rules,"piggybacking" on trusted
apps, exploiting weaknesses in the filtering by a lower level transmission
etc are some of the methods used these days.
Read the leakpaper document here
http://www.firewallleaktester.com/docs/leaktest.pdf
They don't need to change your firewall rules, they exploit weakness built
in the firewall.
That sounds rather worrying - but then if a rogue app could do that in
such a way as to bypass Kerio, wouldn't it work for all other software
firewall solutions?
Correct. There is no known firewall that can block all publicly known leak
tets, though some are better. And no, not using Internet explorer (a
commonly targetted trusted app) doesn't count as a workaround, since the
leak test could target anything.
A lot of experts are of the opinon that (perhaps short of a process
sandbox) once a malware gets in, it's game over. The poor firewall is often
placed in the impossible position of figuring out where the request for an
outbound connection finally orginates from, and this is impossible since
it's not really it's job to know such things unless it is the OS!
The only somewhat sure way of defeating leak tests is not only to control
processes that connect outwards (as firewalls do) but also a means of
controlling ALL processes as they start. Some firewalls like Kerio 4
already have this built in.
Or you could use a seperate solution like system safe monitor (overly
complicated), or Processguard (the free version - allows you to protect one
process will be shutdown but allows you to lock processes from starting
except those whitelisted). These applications will prompt you whenever a
process starts, or when one tries to start another.
For your kids computer, you might run it , make it recognise all the
legimate processes, then lock it. That way , the leak test or something
similar won't even get to run, and that stops it cold.
I use one of the Sponge rulesets as my starting point, and I guess I
hope that's sufficient to keep any of the nasties out.
But it's unlikely to stop leak tests, unless you know for sure the ip
address that it will be transmitting out to.
It certainly
does away with the vast majority of casual scan alerts.
Trouble is, I've tried the competition and despite the relatively
steep learning curve with Kerio, it really does seem to be the one
that works for me...unless it really does have some major holes!
It does have some holes, like the problem with dealing with fragmented
packets, but in terms of leak tests, I can assure you if you are worried
about those, you will probably drive yourself nuts since no firewall gets
them all.
