PDA

View Full Version : Process launching monitor

plx
August 8th, 2009, 08:34 AM
Why ESS does not monitor such activity as process launching? so this firewall can be easily passed for example with writing some data to html file in the form and sending it via JS. That seems to me very strange - maybe i couldn't find such an option?
Marcos
August 8th, 2009, 08:49 AM
The firewall controls inbound and outbound network connections. It is the role of the real-time scanner to check if files perform malicious actions or not.
plx
August 8th, 2009, 09:08 AM
OK. What do you think about such option in real-time scanner? :)

By the way, "The firewall controls inbound and outbound network connections": a creation of an htm file with a content like

...
<body onload="f.submit();">
<form id="f">
<input type=text value="private gathered information">
</form>
...

is a way to bypass a firewall with use of browser launch. So, such detection must be the work of firewall too.
plx
August 15th, 2009, 05:56 AM
m? doesn't really anybody want to talk on this subject? :)
Marcos
August 15th, 2009, 07:03 AM
If the html file was malicious it would/could be detected by the real-time scanner and other protection modules (ie. on-demand/startup/web/email scanners). It's not a role of firewall to detect suspicious html files.
plx
September 15th, 2009, 01:46 PM
-{ Quote: "If the html file was malicious it would/could be detected by the real-time scanner and other protection modules (ie. on-demand/startup/web/email scanners). It's not a role of firewall to detect suspicious html files." }-
Then what the role of firewall is? :)
Marcos
September 15th, 2009, 02:22 PM
Firewall inspects packets at NDIS layer. Basically its role is to control communication at the lowest level.