new leaktest : WallBreaker

[gkweb]

Hi

I just released my own leaktest, available on the site.
It works on Windows 9x/Millenium/2000/XP and seems not to be blocked by any firewall (following the "how to do test" of the results page).

=> http://www.firewallleaktester.fr.st

The only known way for now is SSM (while the issue is probably investigated).

Happy testing.
regards,

gkweb.

[Phant0m]

Nice Leak-test, however it failed to bypass Look ‘n’ Stop’s Application Filtering Layer… ;)

[gkweb]

no...

Look'n'Stop doesn't see WallBreaker.exe, just explorer.exe, iexplore.exe, or svchost.exe.

regards,

gkweb.

[Phant0m]

Once again i'm telling you what i see and what i see is Look 'n' Stop stealthing me at Application Filtering Layer from that utility hjacking attempts...

[Phant0m]

Yes Look ‘n’ Stop doesn’t see Wallbreaker.exe Launching another Application that will connect, however Look ‘n’ Stop is protecting me at Application Filtering Layer.

My Windows Explorer is configured to Launch only and no connection rights to the Internet, from the beginning Windows Explorer has always been DENIED from connecting rights as it’s obviously a security hazard… ;D

[gkweb]

i tested it on two comp : Win XP and Win 2000 all last update with LnS 2.04p2 with the lastest driver on both, if the configuration is not locked (which could prevent explorer.exe or svchost.exe to do anything) even at highest settings LnS failed, now it's me that said to you what i see ;)

(may be you blocked a windows app ?)

regards,

gkweb.

EDIT : oups you just posted ;D

yes, best guidance like block explorer.exe is a must to do, but not while testing leaktests ;)

[Phant0m]

LOL when it comes to Leak-testing nothing new anyone can tell me… ;)

[Dan Perez]

Hi gkweb,

Nice tester app you got there. It certainly defeated my KAH 1.5!

This is precisely why I distrust Personal Firewalls by themselves. Using PE I could tell that something was going out to France (I know, the test is entirely safe!) even though it recorded the originating app as iexplore. Still this would be enough to tip that something was up.

I wonder, have you tried it against Tiny 4.5? If I were to rely on a PF exclusive to anything else it would be that one (Not that I have tried all the ones out there!)

Thx,

Dan

[FluxGFX]

Phant0m``

I tried the Leaktest from gkweb..... now since explorer.exe is blocked by default.... it still bypasses... my LnS.... any idea ?

[Phant0m]

Yes most likely your Internet Explorer was currently running in the background of the time you executed that test…

Under few circumstances Look ‘n’ Stop will fail the test, and this is just another example why dealing with Leak-testing you must consider all factors.. ;)

[gkweb]

What OS have you ? windows handles differently what WB do, even between 2000 and XP.

But at least on Win XP, to block explorer.exe prevent the test to work.

@Dan Perrez
I just tried application filtering of TPF 4.5, not sandboxe feature.

regards,

gkweb.

[JimIT]

Current ZA+ defeats this .exe by unchecking one box:

Program Control-->
highlight Windows Explorer-->
Options-->
Security-->
Uncheck Advanced Program Control: "This program may use other programs to access the internet" box.

Whew!
;)

[FluxGFX]

-{ Quote: " quoting: gkweb link=board=23;threadid=10426;start=0#msg67670 date=1055899078]
What OS have you ? windows handles differently what WB do, even between 2000 and XP.

But at least on Win XP, to block explorer.exe prevent the test to work.

@Dan Perrez
I just tried application filtering of TPF 4.5, not sandboxe feature.

regards,

gkweb.
" }-

I'm running WinXP Pro Sp1
LnS 2.04p2
And even with explorer.exe block in Application Filtering and Internet Explorer closed and running the test is still screws up.

Will have to find a way to stop that somehow ;) will get back to ya later on if I do ;)

[JimIT]

-{ Quote: " quoting: JimIT link=board=23;threadid=10426;start=0#msg67671 date=1055899472]
Current ZA+ defeats this .exe by unchecking one box:

Program Control-->
highlight Windows Explorer-->
Options-->
Security-->
Uncheck Advanced Program Control: "This program may use other programs to access the internet" box.

Whew!
;)
" }-

Doh!

Not so fast, Jim...a "cannot find server" message isn't good!

Hmm. Maybe there's an end-around somewhere! :)

[Phant0m]

Hey FluxGFX

There are two Flags you set for each Application in the Application Filtering List, is Explorer.exe (Windows Explorer) configured to Deny Connecting rights to the Internet?

I’m running Microsoft Windows XP Pro with Service Pack 1 Installed and all the SP2 hotfixes… and using Look ‘n’ Stop v2.04p2 with most recent Application Filtering Driver.

[FluxGFX]

-{ Quote: " quoting: Phant0m`` link=board=23;threadid=10426;start=0#msg67676 date=1055900275]
Hey FluxGFX

There are two Flags you set for each Application in the Application Filtering List, is Explorer.exe (Windows Explorer) configured to Deny Connecting rights to the Internet?

I’m running Microsoft Windows XP Pro with Service Pack 1 Installed and all the SP2 hotfixes… and using Look ‘n’ Stop v2.04p2 with most recent Application Filtering Driver.

" }-

I have set the two flags and added every explorer.exe on the system to be blocked and still... not working for me, but I'm not giving up, I'm sure there's a why to disable explorer.exe from accessing the net from within windows.

[Phant0m]

OHHH i C

[FluxGFX]

-{ Quote: " quoting: Phant0m`` link=board=23;threadid=10426;start=15#msg67678 date=1055900838]
OHHH i C
" }-

Phant0m``
Honey you see what ? ;)

[Phant0m]

Try removing all the Explorers and executing the Wallbreaker and then click DENY to Explorer.exe Launching Internet Explorer…

Also try terminating everything in the background except for Look ‘n’ Stop and then run Wallbreaker…

[gkweb]

########### READ THIS #############

I suggest to everyone to read the "how to do tests" on the website results page.
Blocking a windows component to pass successfully a leaktest is not seen as a good results because the purpose is to test your firewall, his application filtering layer strength, so, you have to allow explorer.exe and iexplore to access the Internet.

For instance, With Look'n'Stop 2.04p2 with iexplore.exe and explorer.exe fully trusted, the leaktest "Tooleaky" is catched red handed by LnS with a beautiful warning "Tooleaky.exe try to launch iexplore.exe", even with the two app trusted, because he is not vulnerable to "Tooleaky".
The same way to test your firewall have to be followed to test it.

After that, to enhanced your protection and to cover firewall leaks, you can follow best guidance behaviour such as blocking explorer.exe to access the internet, add SSM, give filter rules per application, etc... but this "users enhancement" prevent to see if the firewall can handle or not the leaktest, in our example with WallBreaker, the firewall just see explorer.exe, and if you did tell it to block it, it blocks explorer.exe without have seen wallbreaker.exe

Keep in mind that all technique showned by all leaktest can in theory be applied to any trusted application on your system... and in this case, the only last shield is the firewall application filtering which should see that a malicious program launched an authorized one, if not, the test is failed.

Don't be confusing between that your firewall can really _see_ and between that it can really _do_
(it can block explorer.exe, but can't see wallbreaker.exe).

regards,

gkweb.

########### READ THIS #############

[FluxGFX]

Phant0n``

Well I did remove all the explorer and closed everything and tried again with no succesfull results.

gkweb,

Would have a suggestion in mind that would help stoping wallbreaker ?

[gkweb]

May be you didn't flushed IE cache ?

[FluxGFX]

Trust me I did ;)

[Phant0m]

Hey gkweb

I’m only here to state a fact that Look ‘n’ Stop has the capabilities of protecting, I never said Look ‘n’ Stop has the capabilities of detecting this Leaktest or not. ;)

[gkweb]

it's not for you, it's for the user who said passed the leaktest with ZA on checking "block explorer.exe"

;)

@GFX
it's unbelievable :o

regards,

gkweb.

[FluxGFX]

-{ Quote: " quoting: Phant0m`` link=board=23;threadid=10426;start=15#msg67686 date=1055901574]
Hey gkweb

I’m only here to state a fact that Look ‘n’ Stop has the capabilities of protecting, I never said Look ‘n’ Stop has the capabilities of detecting this Leaktest or not. ;)
" }-

True,
but I still need to find a way to protect against that and or being able to stop malicious codes that could do that type of thing ;)

[gkweb]

I confirm that phant0m said, on my comp, with explorer.exe blocked it prevent the leaktest to do his job and to see if the firewall will see and catch it or not.

it's weird that WB still go trought even with explorer.exe blocked :o

do you connect trought a proxy ?

regards,

gkweb.

[FluxGFX]

-{ Quote: " quoting: gkweb link=board=23;threadid=10426;start=15#msg67689 date=1055901854]
I confirm that phant0m said, on my comp, with explorer.exe blocked it prevent the leaktest to do his job and to see if the firewall will see and catch it or not.

it's weird that WB still go trought even with explorer.exe blocked :o

regards,

gkweb.
" }-

Doing what Phant0m``suggested in removing all the explorer.exe blocked in my list, when I launch Wallbreaker.exe LnS doesn't even pop up telling me that Explorer.exe is attempting to connect to the internet, wich I find weird in it's self.

[Phant0m]

Hey FluxGFX

I’m clueless for the moment, if you exited out of all 3rd party processes except for Look ‘n’ Stop and then executed that Wallbreaker on Windows XP Pro with Service Pack 1 installed and all the SP2 hotfixes with Look ‘n’ Stop v2.04p2 using most recent Application Filtering driver (LNSFW1.SYS), and Explorer.exe being set with the Deny Flag for Connecting rights….

[Phant0m]

Hey FluxGFX

Can you confirm that Application Filtering Layer is fully functional?

[FluxGFX]

-{ Quote: " quoting: Phant0m`` link=board=23;threadid=10426;start=15#msg67692 date=1055902112]
Hey FluxGFX

I’m clueless for the moment, if you exited out of all 3rd party processes except for Look ‘n’ Stop and then executed that Wallbreaker on Windows XP Pro with Service Pack 1 installed and all the SP2 hotfixes with Look ‘n’ Stop v2.04p2 using most recent Application Filtering driver (LNSFW1.SYS), and Explorer.exe being set with the Deny Flag for Connecting rights….

" }-

I have LnS v2.04p2 but was thinking that it might be LNSFW1.SYS that's not right ?

[FluxGFX]

-{ Quote: " quoting: Phant0m`` link=board=23;threadid=10426;start=15#msg67693 date=1055902252]
Hey FluxGFX

Can you confirm that Application Filtering Layer is fully functional?
" }-

Sure here's a test where Media Player is trying to access the web.

[gkweb]

i didn't try with old driver... it would be surprising but why not.

last driver to put on c:\windows\system32\driver

http://looknstop.soft4ever.com/Beta/Oops/LNSFW1.SYS

gkweb.

[FluxGFX]

-{ Quote: " quoting: gkweb link=board=23;threadid=10426;start=30#msg67697 date=1055902520]
i didn't try with old driver... it would be surprising but why not.

last driver to put on c:\windows\system32\driver

http://looknstop.soft4ever.com/Beta/Oops/LNSFW1.SYS

gkweb.

" }-

Done will reboot BRB

[Douglas]

-{ Quote: " quoting: Phant0m`` link=board=23;threadid=10426;start=0#msg67654 date=1055895755]
Yes Look ‘n’ Stop doesn’t see Wallbreaker.exe Launching another Application that will connect, however Look ‘n’ Stop is protecting me at Application Filtering Layer.

My Windows Explorer is configured to Launch only and no connection rights to the Internet, from the beginning Windows Explorer has always been DENIED from connecting rights as it’s obviously a security hazard… ;D
" }-

Exactly the same here, running Win98SE.
LooknStop blocked it.

Regards,
Douglas

edit: I apologize. I only read the 1st page, not realizing there were 2 more pages, with this blocking issue addressed.

[FluxGFX]

After installing the new driver, rebooting and cleaning internet cache and all that.

Tried wallbreaker with no results ;(

[Phant0m]

Hey FluxGFX

Go-to http://etree.org/md5com.html and Download MD5sum.exe: http://etree.org/cgi-bin/counter.cgi/software/md5sum.exe into C:\ drive and access Command Prompt and type; CD ..
Then type; md5sum.exe %SYSTEMROOT%\SYSTEM32\drivers\LNSFW1.sys

Assuming you renamed current Application Filtering Driver from LNSFW1.sys to _?_ make modifications the filename and Enter it then paste the results…

[FluxGFX]

C:\WINDOWS\system32\drivers>md5sum lnsfw1.sys
eb936729238004c016a4c77fc316907e *lnsfw1.sys

C:\WINDOWS\system32\drivers>

[Phant0m]

Hey FluxGFX

Yea you have the most recent Application Filtering Driver release...

[Phant0m]

Once again you using Windows XP Pro with Service Pack 1 Installed, you using Look ‘n’ Stop v2.04p2 with most recent Application Filtering driver and Windows Explorer (Explorer.exe) are configured with the Deny Flag for Connecting rights. Everything for 3rd party Processes except for Look ‘n’ Stop has been Terminated, no running instances of Internet Explorer and you execute the Wallbreaker and Look ‘n’ Stop still doesn’t give you protection capabilities?

So when you execute Wallbreaker Internet Explorer becomes Executed and you get a page loading of http://perso.wanadoo.fr/*

:/

[FluxGFX]

-{ Quote: " quoting: Phant0m`` link=board=23;threadid=10426;start=30#msg67718 date=1055905177]
Once again you using Windows XP Pro with Service Pack 1 Installed, you using Look ‘n’ Stop v2.04p2 with most recent Application Filtering driver and Windows Explorer (Explorer.exe) are configured with the Deny Flag for Connecting rights. Everything for 3rd party Processes except for Look ‘n’ Stop has been Terminated, no running instances of Internet Explorer and you execute the Wallbreaker and Look ‘n’ Stop still doesn’t give you protection capabilities?

So when you execute Wallbreaker Internet Explorer becomes Executed and you get a page loading of http://perso.wanadoo.fr/*

:/

" }-

You got that right

[Phant0m]

LOL then I don’t have the foggiest idea what’s wrong…
Have you tried cleaning the Application Filtering List totally and then quickly executing Wallbreaker? ???

[FluxGFX]

LOL yes and now it says Internet Explorer.exe is attempting to connect to the internet if I say yes then I get the page on wanadoo.fr saying that wallbreaker got true ( apparently it doesnt see explorer.exe )

[Phant0m]

You using WindowBlinds?

[Phant0m]

ahhhhhh yea now i believe whats going on...

[FluxGFX]

No I don't use windows blind

[Phant0m]

You haven’t enabled the ActivatedSoon Flag yet have you?

Apply http://www.Phant0m-looknstop.com/phant0m/ActivatedSoonEnable.reg then re-boot.

To undo ActivatedSoon Flag, apply http://www.phant0m-looknstop.com/phant0m/ActivatedSoonDisable.reg

[FluxGFX]

-{ Quote: " quoting: Phant0m`` link=board=23;threadid=10426;start=45#msg67737 date=1055906455]
You haven’t enabled the ActivatedSoon Flag yet have you?

Apply http://www.Phant0m-looknstop.com/phant0m/ActivatedSoonEnable.reg then re-boot.

To undo ActivatedSoon Flag, apply http://www.phant0m-looknstop.com/phant0m/ActivatedSoonDisable.reg

" }-

Explain me how I did not enable this ? cause I don't remember something like that or is it done by default....

[Phant0m]

Hey FluxGFX

ActivatedSoon Flag is a hidden Feature in Look ‘n’ Stop, only way to Enable it is if you done it manually… ;)

[FluxGFX]

Ok but now it does ask about explorer.exe but if I block it Internet Explorer can't access the net now ;) LOL

[Phant0m]

Only block Windows Explorer (Explorer.exe) from Connecting rights, you should not block it’s Launching rights or you’ll see quite a number of Clients not being capable of connecting to the internet… ;)

[FluxGFX]

When blocking Explorer.exe it stops me from using Internet Explorer because it detects internet explorer has explorer.exe, now running Wallbreaker behind this should be stoped but it is not stoped and LnS sees it has being Internet explorer accesing the net.

[Phant0m]

"Cannot find server"

What's the URL Addy in the location bar of Internet Explorer?

[FluxGFX]

http://www.clubic.com

[FluxGFX]

Right now it sees Internet Explorer has being Explorer.exe and Wallbreaker.exe has being Internet Explorer ...... weird.......

[FluxGFX]

I deactivated the reg file and now everything is working has it should. Internet explorer is seen has being internet explorer and explorer.exe is seen has it is. remains that the wallbreaker.exe sill gets true even thought explorer.exe is blocked ;)

[Phant0m]

Clients are Applications like Internet Explorer, Outlook and so on…
When you Block Windows Explorer (Explorer.exe) from launching rights you’re Clients won’t get Successful Connections…

Everything is normal if you can understand the concept behind this…

[FluxGFX]

Ok but now with the activated reg,

If I block Explorer.exe I have no application able to go Online.... If I unblock then my application can now go back online and it remains that Wallbreaker still goes online.

[Phant0m]

LOL I know! that's is why you don't set Explorer.exe with the Deny Flag for Launching rights, only the Connecting rights...

Are you using "Advanced Mode"?

[FluxGFX]

Sorry for the confusion it's getting late and I'm getting tired ;)
Yes I am ;)

[gkweb]

May be have you DNS client service enabled? in this case WB launches explore but instead of launching directly IE, it launches SVCHOST which after launch IE...
Try to deny SVCHOST.EXE too.

regards,

gkweb.

[Phant0m]

He'll need ActivatedSoon Flag Enabled though....

[Phant0m]

In Addition; Whether or not your DNS Service is Enabled/Disabled it doesn’t have anything to-do with it using Explorer or SVCHOST… ;)

[gkweb]

may be you have to reboot, i don't know, but few persons reported to me that there firewall warned them that SVCHOST.EXE was launching IE ! And the only diffrence between them and me, is the DNS client service disabled.
When explorer want to resolve the url, it uses svchost instead of doing it itself.

May be there is another explanation...

regards,

gkweb.

EDIT : someone said me by mail that it's bypassed SSM ???
it's never been the purpose...
Is someone can give me the link of the last version with last DLL and update ?

[FluxGFX]

-{ Quote: " quoting: gkweb link=board=23;threadid=10426;start=60#msg67823 date=1055935260]
May be have you DNS client service enabled? in this case WB launches explore but instead of launching directly IE, it launches SVCHOST which after launch IE...
Try to deny SVCHOST.EXE too.

regards,

gkweb.
" }-

Even after doing that it still doest change a thing ;)

[FluxGFX]

I've been looking at it all night and logging the process of it.

It looks like it's not even going after explorer.exe it directly launches Internet Explorer....

[FluxGFX]

Well time to get back to why... this ain't working ;) I'll do more test on my side and see ;)

[gkweb]

/\ WallBreaker V2.0 available /\
-----------------------------------------

Why an other version so soon ?? Because windows is so much leaking ( i said Windows, poor firewall are running on a really buggy support :'() that i found an other trick.

Now you can test your firewall with 2 differents tests.

http://perso.wanadoo.fr/jugesoftware/firewallleaktester/eng/images/wb.jpg


=> http://perso.wanadoo.fr/jugesoftware/firewallleaktester/eng/leaks/WallBreaker.exe

Phant0m, you will love it ! ;D

regards,

gkweb.

[FluxGFX]

In version 1.00 and 2.00 of Wallbreaker I am now able to block Wallbreaker to access Explorer.exe to launch Internet Explorer ( Finally )

[gkweb]

good ;)

and the second test ? it pass trought isn't it ? ;D

[FluxGFX]

gkweb,

The second test fails, but I'm sure there's a way..... how about we give Phant0m`` sometime to figure something out, but has for the first test congrats Phant0m``

[gkweb]

What LnS said to you ?

[FluxGFX]

For the second test LnS didn't even flintch...

[gkweb]

don't worry ! all firewall that i tested (all on the site) didn't say anything, that is very VERY surprising because WB launches directly IE, but with a little trick of course.
I think it's more a Windows bug (again) but the second should be more easier to prevent.

I think that for now SSM is the only way to covered firewall leaks.

regards,

gkweb.

[FluxGFX]

Sorry I might be ignorant... SSM ?

Oh and for the second test I think Phant0m`` figured something out will let him explain.

[Phant0m]

Hey fellas

Like already been mentioned by me and also gkweb Look ‘n’ Stop v2.04p2 with most recent Application Filtering driver doesn’t actually detect this type of method, meaning it doesn’t state “Wallbreaker.exe is Launching ….”, however Look ‘n’ Stop is capable of providing somewhat minimum Level Protection against these types of Leaks if configured up properly (For the meantime while we wait for a fix)…

In addition; Wallbreaker v2.0 second method could be blocked by Loading the following .reg info or by deleting the below informatics in the Registry…

---- Copy & Paste to *.reg file ----
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Applications\iexplore.exe\shell\open\command]
@="\"C:\\PROGRA~1\\INTERN~1\\iexplore.exe\" %1"
----- End of Copy ---

[FluxGFX]

BOUYA ! ;) Way to go ;)

[Phant0m]

;)

[gkweb]

lol it's doesn't change the fact that firewall doesn't say anything on second trivial method !
But Phant0m, your solution is not a real one, because if i wanted i could have a better path checking instead of totally relying on registry, and in this way your solution wouldn't change anything ;)

However it's a nice trick ^^

[FluxGFX]

gkweb,

Well still it's a good simple solution on a short term ;)

And I'm hoping to see something very interesting coming from you.
Your very resourceful ;)

[Phant0m]

Hey gkweb

You only are repeating what I already said…

Anyways same thing can be done to the 1st method as it was done to the 2nd method… ;)

[gkweb]

:)

i will not improve it to defeat such solution, because it doesn't change what the leaktest want to show.

it goes trought, that's all ^^

About SSM it's a System security Monitor which control all app that are launching, that they will connect or not.
This could be usefull even again viruses.

Hmm phant0m, have you the link for lastest version + lastest DLL update ?

regards,

gkweb.

[Phant0m]

Hey gkweb

Yea if I was you I wouldn’t even try either, considering there is many tricks I could and possibly already had done to overcome any improvements you could draw up… ;)

No I don’t use SSM…

Bests Regards…

[JacK]

-{ Quote: " quoting: gkweb link=board=23;threadid=10426;start=75#msg67998 date=1055981656]
Hmm phant0m, have you the link for lastest version + lastest DLL update ?
gkweb.
" }-

Nite,

As you are French speaking full with localization :
Direct d/l : http://tinylink.com/?3z1Qchq4qg

Rgds,