Trojans and Firewalls

Discussion in 'malware problems & news' started by Buster, Aug 23, 2003.

Thread Status:
Not open for further replies.
  1. Buster

    Buster Registered Member

    Joined:
    Jun 12, 2003
    Posts:
    65
    Location:
    Oz
    Hi,

    This is possibly a stupid question, but here goes -

    I am running Zone Alarm Pro v4 with a SonicWall SOHO3 firewall with latest security updates. Is it possible for my system to be infected with a trojan?

    Thanks in advance.


    Buster
     
  2. Dan Perez

    Dan Perez Retired Moderator

    Joined:
    May 18, 2003
    Posts:
    1,495
    Location:
    Sunny San Diego
    Hi Buster,

    No it is not a stupid question at all as many peple have some misconceptions regarding this. The main avenue for infiltration by a trojan is downloading and installing/running a program that you thought was something harmless and was in fact malware.

    So, since the download of the trojan file was user-initiated the firewalls (personal or hardware) will not stop the copying locally of the trojan and would not stop the installation.

    However, depending on the abilities of the trojan and of the software firewall, the firewall may successfully intercept the attempt by the trojan to do some activities such as grab hold of a port to listen on for an outside host to communicate with it, or if it attempts to overwrite certain system files with it's preferred versions.

    I don't know enough about ZAP4 to tell you how much protection it might offer but I feel that whatever the protection of a Software Firewall, even those with advanced sandbox type protection, IMO they do not supplant the need for a dedicated Anti-Trojan application. They definitely supplement the protection but they do not render an Anti-Trojan superfluous.

    Hope this helps,

    Dan
     
  3. Buster

    Buster Registered Member

    Joined:
    Jun 12, 2003
    Posts:
    65
    Location:
    Oz
    Hi Dan,

    Appreciate your prompt reply. Every bit of info I collect is always a help.

    Further opinions always welcome.

    Thanks again.

    Regards

    Buster
     
  4. Acadia

    Acadia Registered Member

    Joined:
    Sep 8, 2002
    Posts:
    4,048
    Location:
    SouthCentral PA
    Never a stupid question when it comes to pc security. It's those that think they've finally got themselves completely covered and start patting themselves on the back, that will get hit. ALWAYS DOUBT your setup, keep looking for more. I agree with Dan about using a dedicated Trojan detector. AV are getting better at catching Trojans but they still fall behind a true Trojan software. If a Trojan somehow gets past your firewall and AV, either through the inability of those programs to detect it, or though user error, the AT would hopefully nad it. As Paul says, use layered protection, and I consider the AT the last line of defense. Good luck.

    Acadia.
     
  5. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Well the first line of defence too :D
     
  6. the Tester

    the Tester Registered Member

    Joined:
    Jul 28, 2002
    Posts:
    2,854
    Location:
    The Gateway to the Blue Hills,WI.
    I agree with Dan.

    In my opinion,an anti-trojan program is a must for trojan protection.

    A good firewall is a neccessity,but I wouldn't count on a firewall alone for all trojan defense of my system.

    Acadia brings up a good point..
    Look for improvements for your security.
    And remember that updating your security programs is very important also.
     
  7. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Also remember that without the latest security patches for your operating system & even with a firewall your system can be compromised.
     
Loading...
Thread Status:
Not open for further replies.