Atelier Web Firewall Tester

[RL]

Here's another firewall test:

http://www.atelierweb.com/awft/download.htm

[ZZZ7]

FIREWALL =10 TO ZIP

with SYGATE

[Straight Shooter]

Has anyone tested this with ZAPRO 3.5?

I absolutely won't install this program in my computer.. (It might have spyware, who knows...) If anyone else did, please let us know what your results were..

[Paul Wilders]

Straight Shooter,

-{ Quote: "...(It might have spyware, who knows...)" }-

Be assured: nothing of the kind ;).

regards,

paul

[Luthorcrow]

ZZZ7,

Good to hear, I am also using Sygate Pro 1150 and scored FW=3 AW=7. The only Sygate blocked for me was the DLL. I don't suppose you would be willing to share point in the right direction of what you have done different with your set-up. I am assuming the crux would be in the advanced rules? Obviously I must be being more premissive than needed of my browser.

[eyespy]

Went through my ZAP 3.5 only when I was already online and had already allowed IE 6 to access the net !! >:(

regards,
bill :o

[Straight Shooter]

:o ??? :-[

My Zapro 3.5 scored 2 for the firewall and 8 for the Atelier...

Not good news!

Is this the kind of program that every firewall will fail..
I tried this test under the Dlink router and then I tried it with the router.. Same results both times..

I also have a license for Agnitum Outpost Pro. Did anyone else try with Outpost?

For me, Test 1 gave me an Alert Advisor, to which I answered "No"..

Test 2 and 3 were outright failures...

[ZZZ7]

-{ Quote: " quoting: Luthorcrow link=board=23;threadid=5287;start=0#34483 date=1039076584]
ZZZ7,

Good to hear, I am also using Sygate Pro 1150 and scored FW=3 AW=7. The only Sygate blocked for me was the DLL. I don't suppose you would be willing to share point in the right direction of what you have done different with your set-up. I am assuming the crux would be in the advanced rules? Obviously I must be being more premissive than needed of my browser.
" }-
===================================

http://home.bellsouth.net/p/PWP-helpbyking

[eyespy]

Interesting replies here !!

http://forums.sygatetech.com/showthread.php?s=8c9c5386fadbd1931f6cc92d737cd72e&threadid=3970

regards,
bill

[Straight Shooter]

I think eyespy found a place in the sygate forums that makes sense..

Also, this "firewall tester" costs $34.95 after you use it four
(4) times... after you find out you've wasted your money...


I tried EVERYTHING to get ZAPRO to get this to pass until I started realizing there might be something wrong with the test!!

I think the folks who developed this program should tell us how to pass our firewalls with this "new test"

If ALL the firewalls fail, are we then ALL damned?

[eyespy]

Ok...
this proggie tunnels through IE and maybe Netscape. Actually it seems more like a shortcut to a URL that leads you to the script you see when you connect to Atelier's website...only when you allow IE to access the net. If I launch.... say Yahoo from my favorites when IE6 is set to ask for permission when connecting (using ZAP 3.5), I will get a prompt from ZAP "do yo want to allow IE6 to access the internet?", even though I'm trying to reach Yahoo....ya' with me ??
Could a program of this nature actually be a "Security Threat" ?
I'm not convinced yet !

Regards,
bill ;)

[root]

I am really surprised that Atelier would put out such a program, especially for money.
There is nothing new about piggybacking on the browser. It is a built in security problem, thank you Bill Gate$$$$$ Another reason not to use IE.
The first line of defense is the brain. If you do not click on things you should not click on, you will not be having problems from programs that do not belong on your computer.

[Luthorcrow]

Root, thanks for hitting it on the head. But wouldn't this be a flaw of any browser if someone made their tunneling app specific to function with Opera or Mozilla or whatever?

Eyespy, I saw Pak's reply to my post, but man, I was feeling folish think there would be some crpytic guru stuff. His 10 score was based on that keeps all apps on "Ask" permission. Which for my test works fine as long as you don' t have IE open as with ZA 3.5 tests.

ZZZ7, I am assuming that was the same config you were using to pass this test as well? Thanks for the link but I have been to King's site. It's under construction right now so there is no current content but even when there was it was very basic.

I assume folks like to keep their FW rules secret juding by the lack of websites and content on the matter for personal FW. Outside of a few forums and PCFlank (which seem way to permissive) I haven't found at lot of good links.

[eyespy]

-{ Quote: " quoting: root link=board=23;threadid=5287;start=0#34590 date=1039144647]
The first line of defense is the brain. If you do not click on things you should not click on, you will not be having problems from programs that do not belong on your computer.
" }-

Root,
are you SCOLDING me ?? ;D
I have to click....can't....help......myself.....must click on where...it says....don't click ....LOL !!

JK of course !!

regards,
bill ;D

[Paul Wilders]

..and there's this nifty little freeware app System Safety Monitor: anyone will get a perfect score when using it in regard to this tester - and all others, for that matter ;).

We'll put the latest version (it's a Beta, but no problems so far) up for download on our downloads page (http://www.wilders.org/downloads.htm) next update.

regards.

paul

[root]

Thanks, Paul. I have been hesitant to put this on my machine because I use RegRun Gold, and have excellent security software installed, I believe. :)
However, it seems SSM has a couple of functions that prevent this type of exploit, that RRG does not have, so I guess I will add it as a compliment to RRG.
I am going to suggest to Dmitry that he consider adding such a function to RRG.
Paranoia, the great Destroya. He he. ;D ;D

Man that SSM is a slow download site. Be nice when you get it on your server. :)

[Paul Wilders]

hey root,

-{ Quote: "I use RegRun Gold, and have excellent security software installed, I believe." }-

I second that one ;)

-{ Quote: "I am going to suggest to Dmitry that he consider adding such a function to RRG." }-

Dmitry is always open for good suggestions!

-{ Quote: "Paranoia, the great Destroya. He he." }-

Grin...

-{ Quote: "Man that SSM is a slow download site. Be nice when you get it on your server." }-

Quite true (and that's an understatement..). I guess we will have it up for download within approx. 4 hours ;).

regards.

paul

[Feivel]

KPF will not let this "test" through. One thing escapes me, what firewall o security software is this company selling?

[Paul Wilders]

Hi Feivel,

What Kerio version are you referring to? In case of v2x, IMHO it will only pass the test in case every app (browser included) has to ask permission to..etc.

As for the software selling: have a look at their home page (http://www.atelierweb.com/index.htm).

regards.

paul

[Feivel]

Paul,

I run KPF beta 5 along with TPF 3 (just the sandbox). The software they sell doesn't seem to mesh with their "firewall test." Since they are attempting to show holes in firewalls, I would think they either sell or will soon sell a firewall. Not only that but I bet theirs would pass :)

[Paul Wilders]

Feivel,

That explains a lot, doesn't it? ;) KPF 5 Beta, plus sandboxing - no way your system can be compromised by this.

(Guess you did expect this reply) ;).

That said: those not running a sandbox: a different story.

regards.

paul

[Feivel]

Paul,

The sandbox gives me an alert but I do allow the test to run. KPF stops the test cold though.

[SpaceCowboy]

i use Kerio 2.1.4 along with Adsubtract PRO. everything runs through adsubtract and the firewall gets a perfect 10 when i run this test with no warning boxes. a good, tight, properly configured ruleset helps.
anybody that uses proxomitron and runs everything through it should get the same score.

[Paul Wilders]

Spaceboy,

-{ Quote: "a good, tight, properly configured ruleset helps." }-

Don't hesitate to post a screen shot! ;).

regards.

paul

[SpaceCowboy]

the rule that stops this test is the
"crazybrowser restrict to adsubtract" rule

[SpaceCowboy]

here is what is logged when i run the test

[root]

I have SSM on and running. So far looks like an interesting program if I am using it right. I assume you want to check watch app activity and trust the running processes it asks you about.
I guess I'll have to do a little reading. ;D

[Feivel]

From what I recall about SSM, it is a good program (back in a very early release). There were a few bugs reported over at the DSLR forum but overall consensus was that it was a decent program. If you need help, IM Vampirefo over at DSLR.

[Paul Wilders]

..and in the meanwhile, the latest SSM Beta2 can be grabbed from our downloads page (http://www.wilders.org/downloads.htm) - scroll down to somewhere at the bottom ;).

regards.

paul

[JacK]

-{ Quote: " quoting: Forum Admin link=board=23;threadid=5287;start=15#34766 date=1039258744]
..and in the meanwhile, the latest SSM Beta2 can be grabbed from our downloads page (http://www.wilders.org/downloads.htm) - scroll down to somewhere at the bottom ;).

regards.

paul
" }-
Hi Paul and everybody,

There is a new v (not yet ready for public d/l : ssm191uo) which prevents AWFT tests. As for now, there is still a little problem preventing to run 16-bit apps. If you want runnning a 16-bit app, just disable SSM.
Max Burmistrov is working on it.
If you want , I may put this version somewhere for wilders' members.

About AWFT :

Test #1
The problem is that application tries to run your default browser, and this lets it to gain total control on started process. More - this is not illegal or suspicious operation. The only thing to check : if application wants
to start hidden process, and ask user to create a special rule, wich will let suck behaviour.

Test #2
In this test, AWFT is creating a remote thread in your default browser. Current SSM version ( ssm191uo) successfully intercepted this operation.

Test #3
In this test, AWFT is creating a remote thread in Explorer.exe. Current SSM version ( ssm191uo) successfully intercepted this operation.

Best regards,

[Paul Wilders]

Jack,

Nice explanation! Running the (now available) Beta2, I'll get a perfect score...

-{ Quote: "If you want , I may put this version somewhere for wilders' members." }-

In case Max doesn't object, we could put it up for download. If so, please email the app ;).

regards.

paul

[JacK]

-{ Quote: " quoting: Forum Admin link=board=23;threadid=5287;start=30#34779 date=1039264017]
-{ Quote: "If you want , I may put this version somewhere for wilders' members." }-

In case Max doesn't object, we could put it up for download. If so, please email the app ;).

regards.

paul


" }-

Hi Paul,

I just dropped him a PM, as soon as I get an answer, I shall post it to you.

Best regards,

JacK

[Paul Wilders]

-{ Quote: "Hi Paul,

I just dropped him a PM, as soon as I get an answer, I shall post it to you." }-

Much obliged - as ever ;).

regards.

paul

[root]

Hey Jack, the 1.9.1 version is available for download now and I installed it. It is now catching calls from one program to use another. Unfortunately, when I say always allow, my desktop reloads and most of the apps are gone from the systray.
Couple of other bugs too, but I'm back to 1.8.9 until he gets another version out.
FYI I use 2K SP3.

[JacK]

-{ Quote: " quoting: root link=board=23;threadid=5287;start=30#34824 date=1039283128]
Hey Jack, the 1.9.1 version is available for download now and I installed it. It is now catching calls from one program to use another. Unfortunately, when I say always allow, my desktop reloads and most of the apps are gone from the systray.
Couple of other bugs too, but I'm back to 1.8.9 until he gets another version out.
FYI I use 2K SP3.
" }-
Hi Root,

This v 1.9.1 beta2 is available from septembre 26 and I am using it from the very begining without any problem (WinXP Pro SP1).

May I suggest you to post your problem to :
bugsbunny@e-mail.ru (Max Burmistrov)

It's not a known issue with SSM.

Best regards,

[root]

I'll try it again, before I do that.
Thanks.

[root]

Well, I tried it again, and it is crashing me big time.
Will send an email to bugsbunny. ;D

[root]

I'm impressed! A couple of emails, and Max sent me a new dll and the problem is fixed.
Looks to be a great program that soon may be a must have. ;)

[JacK]

-{ Quote: " quoting: root link=board=23;threadid=5287;start=30#34964 date=1039359289]
I'm impressed! A couple of emails, and Max sent me a new dll and the problem is fixed.
Looks to be a great program that soon may be a must have. ;)
" }-

Hi root,

AFM, it's already a must :)

I sent this afternoon the new release which is not yet available on Max's site. I think Paul shall offer it to d:l shortly

Caution : does not allow 16-bit apps to run, disable SSM when you want to run a 16*bit progy.

Rgds,

[Paul Wilders]

JacK,

-{ Quote: "I sent this afternoon the new release which is not yet available on Max's site. I think Paul shall offer it to d:l shortly" }-

Thanks! It'll be up for download next site update ;).

regards.

paul

[eyespy]

One quick question to add....

Did any ZAP 3.5 users try this test with the following option checked.....? I didn't at the time ! :P

regards,
bill :)