Another Vulnerability Demonstrator

Discussion in 'other firewalls' started by jvmorris, Jul 6, 2003.

Thread Status:
Not open for further replies.
  1. jvmorris

    jvmorris Registered Member

    Joined:
    Feb 9, 2002
    Posts:
    618
    This is probably of interest to gkweb in particular, but the rest of you may also find it rather educational.

    You can find it at http://www.dslreports.com/forum/remark,7321041~root=security,1~mode=flat . I think it's been beat on for several weeks by several people before publication. And it includes the source code, for those who might otherwise worry. The author is reputable and is known to WildCatBoy.

    For those who may be concerned about the publication of this vulnerability, I believe that almost all of the software firewall vendors were informed of it over the course of the last month.

    URL tags added to the link - paul
     
  2. jvmorris

    jvmorris Registered Member

    Joined:
    Feb 9, 2002
    Posts:
    618
    CAVEAT

    I should have put the following caveat in my original posting. To quote from the my initial response to the announcement of gkweb's Firewall Leak Tester Site when it was first broached at DSLR Security Forum (see http://www.dslreports.com/forum/remark,7150363~root=security,1~mode=open ):
    and, more recently from the thread on MBTEST at grc.security.software
    In other words, none of these leaktesters should be run out of idle curiosity.



    url tags added to the link - Jan
     
  3. jvmorris

    jvmorris Registered Member

    Joined:
    Feb 9, 2002
    Posts:
    618
    Not a Leaktester, but ...

    In a display of unusual omniscience :eek: , I was lucky enough to title this thread "Another Vulnerability Demonstrator", rather than a "New Leaktest Demonstration".

    So, therefore, I think I can get away with now drawing attention to jdong's thread at DSLR Security Forum on Software Firewall Termination (see http://www.dslreports.com/forum/remark,7342925~root=security,1~mode=flat;start=0 ).

    As gkweb has noted in that thread (and jdong has agreed), this is not technically a leaktest demonstration, but rather an investigation of whether (and how) various software firewalls can be terminated. It's still evolving and jdong is putting out new versions of his demonstrator further down in the thread. (Same CAVEAT as in my preceding post applies here, also.)

    And, once again, we're seeing the same problem that gkweb has confronted repeatedly: People are all too frequently reporting results without indicating which version/build/update of the software firewall they're running, what OS they're running on, how they've got the software firewall configured, and what (if anything) else they're running concurrently. Still, it's a potentially interesting read.
     
  4. JayK

    JayK Poster

    Joined:
    Dec 27, 2002
    Posts:
    619
    Damn, those guys at broadband forums are really technical huh?
     
Thread Status:
Not open for further replies.