Blocking Adobe Reader or BITS?

But we are referring to an special case where communication to the Windows BITS likely not using Network environment, not until BITS processes things. Frederic would likely have to implement HIPs-like capability .. to monitor applications trying to work with Windows BITS.

You can still control the actual SVCHOST connections, like doing what I’ve said previously.

.. I also think Frederic should implement way to control a list of parent processes that is allowed to use trusted applications making the connections.

 

sure, but on specific command the firewall should have blocked the (any) communication with the outside world for that app and it didn't. In any case, hopefully LNS will be enhanced further

 

But it is not that application making the internet connection, it is setting a job for BITS. You would need to get an HIPs that will intercept the internal comms and/or watch the BITS service/reg start entry.

I am not actually sure as to how many firewalls/HIPS will actually intercept this, but it as been a known issue for a few years.


- Stem

 

What is the job of the firewall? I think it is to block an application, should the user decide, from communicating with the outside world. Don't care how, even if the app somehow tries to send a messenger pigeon...shoot it. I beleive LNS can be made to do so and indeed there are few FW that can do it (obviously not shoot the poor pigeons ).

 

Packet filtering.


- Stem

 

In it the true sense of the word yes but the firewalls of today, for better or for worse, do more than just that.

 

Frederic can we get some input from you on how to control BITS with Look'n'Stop?

TIA,

TH