Subject: RE: [hackers-il] Worselling a PC

From: Chen Shapira <[email-masked]>
Date: Sun, 4 Nov 2001 18:01:33 +0200

> Any suggestions how to protect others from anything my PC 
> could do under
> viral influence? (Besides a firewall, which needs another PC.)

I've heard good things about a "personal firewall" called ZoneAlarm.
It has a free version, and a "pro" version, both are claimed to be very
effective.
They can be installed on the PC you work on, thats why they are "personal"
firewall.

There are many more personal firewalls if you want to shop around.
I've heard the blackIce is non-effective when it comes to blocking network
traffic, which makes it a very poor firewall.

Thanks,
Chen.

---

From: Tzafrir Cohen <[email-masked]>
Date: Sun, 4 Nov 2001 18:25:22 +0200 (IST)

On Sun, 4 Nov 2001, Chen Shapira wrote:

> It has a free version, and a "pro"version, both are claimed to be very
> effective.

[ I wonder which will be the first worm that will try to turn off such
firewalls. There is already onevirus that tries to block access to all the
web sites of anti-virus vendors, and many virii choose not to run if they
detect an anti-virus installed ]

> There are many more personal firewalls if you want to shop around.

That's nice, but I don't believe that it is effective enough.

How can that personal firewall stop a mass-mailer? After all, it is a
legitimate mail client.

How can a simple firewall stop a backdoor client that connects to a
[not so] well known server through http traffic (and thus possibly over an
http proxy) to a server to recieve instructions? Such backdoor have been
implemented, IIRC.

A personal firewall will indeed easily help you avoid most backdoors (e.g:
those that listen on a local port), and may be able to identify some cases
of malicious use. But it is not a magic bullet.

(disclaimer: I don't know any f those softwares personally. I only guess
what they can and cannot do)

-- 
Tzafrir Cohen
mailto:[email-masked]
http://www.technion.ac.il/~tzafrir