The Coalition against Personal Firewalls

Nail. Head. You got it!

Notan

No, what it means is that it only works on computers that were already vulnerable and where the user has not followed microsofts instructions on how to secure the browsers.

All the POC code does is show that the user is already vulnerable, and that they may have improperly configured their PFW as it didn't work on any of the computers I tried it on.

So, passing his POC or failing it, doesn't appear to mean jack.

"Volker Birk" wrote

great!! I downloaded it, but I couldn't use it because : it's a Trojan. named : TR/Click.Small.IP

Tried your other programs :

is the Trojan : TR/Agent.OC.1

is the Trojan : TR/Agent.OC

That's why you don't like active firewalls?

Nobody else virusscanner had a comment?

Those are not trojans but proofs of concept. A trojan horse is by definition software that has hidden functionality supposed to harm the user. The PoCs do exactly what they claim: they bypass personal firewalls. It's absolutely ridiculous of AV vendors to classify a PoC as malware, much less as a trojan horse.

Besides, nobody here argued against AV software as it may *prevent* malware from running, which is a good thing to do. Personal firewalls OTOH try to prevent malware from communicating outbound *while* it is already running. The latter simply doesn't work if the malware makes any evasion attempts.

cu

No, it hasn't had to do with vulnerabilities. There are multiple built in mechanism in the Windows OS for inter process communications and so for remote control applications: Windows Messaging (the only thing, what breakout.c uses), DCOM, ...

here are some more examples: windows

Tell it Mr. Birk. He'd write a special version of the PoC for you ;-)

Wolfgang

Which AV Utility told you this?

Avira -Antivir PersonalEdition Classic

It is _not_ a Trojan. Unfortunately it is misinterpreted by some Virus scanners as attack code. Why manufacturers of Virus Scanners detect absolutely harmless PoC code as malware is open to your interpretation.

Hint: these manufacturers usually are manufacturers of "Personal Firewalls", too. Honi soit qui mal y pense.

It's not a Trojan, too.

It's not a Trojan, too.

No. You have the source code. Just read it and compile your own version. If you're using Microsoft's tool chain, you'll see, that exactly this binary is generated.

Please ask your provider of your Virus Scanner, why they're doing such misinterpretation. I'm looking forward to this explanation.

Yours, VB.

Throw it away and buy something else. Or at least complain.

Yours, VB.

Volker Birk" wrote

No. It's your software, so ask them yourself. I'm tired asking Antivir to undertake action for false positives. They don't answer my emails with false positive info; they did not answer a well-known freeware software writer having problems with an ongoing false positive Antivir alert.

It's not only your PoC software giving problems. My old virus demo's like cascade, jeruzalem or drip are also marked for permanent deletion. And more and more old serious programs are marked as potential danger.

These are some of the reasons why I no longer use virus scanners on any of my own PCs. Other reasons include interference with video capture/recording and inability to find viruses until it's too late.

It's much better to configure your network/system/procedures so that viruses cannot do any damage, even if an inexperienced user gets one.

Jason

I'm not a user of their software, and my software does not make such problems, but the the Virus Scanner software itself.

If they don't offer valuable service, maybe you could consider using another Virus Scanner (or rethink, if you need one at all).

Yours, VB.

...

AOL^W ACK.

Wolfgang

SO, you say that the PFW vendors don't really protect you, and then when they do what they should, stop your POC sample, you say you don't know why they detect it.

Sounds like you need to make a POC app that really works.

No, it's not rediculous to classify them as malware, since this is a useful heuristic way to recognize a zero day virus. By it's capabilities, rather than some string of text. The fact that it's payload is harmless is beside the point from the AV point of view, the fact that it does stuff that would normally only be done by malware is the important part. In fact building heuristic AV definitions and IPS signatures from PoC's is a responsible and proactive way to provide additional protection against zero-day attacks.

-Russ.

The assumption that the PoCs do stuff only malware would normally do is wrong.

cu

When the PoC is breaking/bypassing your firewall and connecting out, it sounds quite correct to me, to identify it as a potentially malicious bit of code heuristically.

Other PoC's may be fully harmless, of course.

-Russ.

Please have a look at what the code actually does (i.e. read the source), before judging it.

cu

I've looked at the source, and I think it's great that it's detected as malware by av products and PFW products. Wasn't VB touting how his POC code will bypass all PFW solutions? Didn't I already say it didn't work on the machines I've tested it on? Why would you want something that proves PFW's don't work to NOT be detected as malware?

It seems to me that if the PFW/AV solutions are doing their job, that the POC would be detected and blocked. While that may not have been VB's intent, it shows that PFW/AV vendors are learning about new/different vectors and properly detecting them.