Win 2k server og ZoneAlarm Pro

Jeg vil gerne lytte med

Jeg bøvlede en del med at ZoneAlarm ikke kunne lide nogle af de plugins jeg havde i IIS serveren. Blandt andet php4. Det var dog fordi php4 var sat til at køre som et cgi program, og det reagerede ZoneAlarm på hver gang den skulle parse et php script.

Men generelt har jeg haft bøvl med ZoneAlarm alle de gange jeg har prøvet det, så nu er jeg skiftet til BlackICE Defender. ZoneAlarm skulle ellers være et af de bedste firewall programmer, men hvad hjælper det når man hele tiden kører surt med programmet.

Jeg syntes dog ikke at det her ligefrem er en skrækhistorie, men jeg vil da gerne lige høre hvad det er for nogen du kan fortælle.

Jeg køre zonealram på min pc og har ingen problemer.Har lidt problemer hvis jeg køre på højeste sikkerhed. Men ved normal har jeg ikke noget problem

Min ven Kjalle &jeg, afholdte en lille nuker/hacker kamp over netværket, det viste sig at slvom jeg havde min BlackIce på paranoid settings =o) .. Og min zonealarm (dog en ældre vers.) på højeste sikkerheds niveau .. Kom Kjalle igennem på port 113 *snøft* .. Hmmm... Ved ikke hvad det har med dette at gøre men syntes i skulle vide det =o)
Men jeg har aldrig haft problemer hverken med BlackIce el. zonealarm, jeg kørte med win2k prof. ...



*** Corperati

ness & coperati det lyder ikke som om i bruger W2k Server som spørgsmålet gik på. Pro har ingen problemer med ZA.

chruker - Når ZA reagerede på PHP, kunne du så ikke bare sætte den til at huske PHP som et ok \"program\" ?

run >> Jo, det kunne jeg godt men hver gang php.exe blev startet for at parse et script så troede ZA at der var et nyt program :-(

En PF (personal firewall) på en server? yipes! Desuden vedr. Zonealarm - se følgende:

Date: 12.20.2000

Name: Multiple Vulnerabilities in ZoneAlarm
Application: ZoneAlarm 2.1.44
Platforms: Windows 9x, ME, NT, 2000

Severity: ZoneAlarm does not detect several types of common Nmap scans.
It is also possible for a remote attacker, under certain circumstances, to gain complete access to the file system and disable ZoneAlarm.

Author: The WolfPak, alerts@wolfpak.dynip.com

ZoneAlarm (www.zonelabs.com) is marketed as a personal firewall and threat detection/prevention tool. It is directed at the Windows-based home user with a constant connection to the Internet with a DSL or Cable modem service.

Unfortunately, ZoneAlarm does not allow its users to maintain a true understanding of their threat level and exposure. Attackers scanning a system employing ZoneAlarm will go unnoticed when using the common Nmap scan types ACK, FIN, Xmas, Window & Null. While these scans do not return lists of open ports to the attacker, the ZoneAlarm user is not aware of the probe or the possibility of attacks being directed against them.

In addition, a window of opportunity exists during the boot process, which allows a remote attacker access to shared resources available on the ZoneAlarm protected device. If file sharing is enabled via Windows Networking and proper Access Controls (ACL) are not utilized, complete access to all shared resources can be obtained through simple NetBIOS
drive mapping (tools such as Legion have proven the existence and viability of this threat). Attackers gaining access to the install location of ZoneAlarm (C:\\Program Files\\Zone Labs\\ZoneAlarm by default) using such a share, it is possible for the attacker to disable ZoneAlarm by deleting or renaming either the executable or its associated DLL files.

In an NTFS partition, the entire directory, and all associated files, are installed with \'Everyone:Full Control\' as permissions. The registry keys created by ZoneAlarm (HKLM\\Software\\Zone Labs) also have weak permissions, being set at \'Everyone:Special Access\', including SetValue, CreateSubkey & Delete. Note that users do receive a pop-up dialog window asking for the location of the deleted or renamed file, however, the message is
sufficiently ambiguous to confuse most basic users into just clicking CANCEL.

Once ZoneAlarm is disabled, complete unmitigated access to the file system is obtained. Data may be removed, copied, modified, deleted or otherwise manipulated. From this point, normal remote code execution attacks can be utilized to further compromise the system.

According to the manufacturer, \"More than 8 million PC users have downloaded ZoneAlarm\", making it a very popular target indeed. Zone Labs has been advised of these vulnerabilities and no patch or work around has been provided.

ZoneAlarm is copyright Zone Labs, Inc.
WolfPak Homepage: wolfpak.dynip.com

;-Bug

ZoneAlarm Pro er lidt bedre sikret, men mange af de argumenter Wolfpak kommer med skræmmer mig nu ikke.

1. Personligt kan jeg godt leve med ikke at vide at jeg bliver scannet. Det sker alligevel så tit, og hvis scanneren ikke kan se mine porte er jeg happy.

2. jeg har disabled NetBios så der kan jeg ikke rammes.

3. Basic user getting confused - Tja det må vi jo så prøve at undgå.

Sammenlignet med mange andre firewalls klarer ZA sig nu rimeligt godt, men selvfølgelig er der en forskel på et produkt til $30-40 og så andre firewalls til et par tusind.