"I would love know which keylogger he was using too... If it called back on it's own port it should have been blocked. If it called back using a port like 80 or 21 then the firewall should be running stateful application-level proxies, which would easily be able to detect that the packet is not a real packet. The only thing I could see is if it established a valid SSL tunnel back to the host, a firewall is unable to see what is in a SSL encrypted tunnel, so as long as it is a valid tunnel it is let through. But jeeze, that is a pretty specific requirement for a keylogger, I doubt your average script kiddie would have any clue how a keylogger works at all!"
While you bring to light a very good point, Stateful application-level proxies are generally not turned on by default. I have no doubt thier network personal did this, however there are ways to get around this, and I can easily attest to spoofing myself onto other ports to play a game while at work, when I clearly set up the PIX to block that traffic.
The second you plug in, your are no longer secure, When you build the network, the routers, the firewalls and switches, you learn exactly where your holes will be, some can be stopped, some can't. Your network security goes from 100% to 50% that secondd you plug in.
|
2004-03-10, 11:20 AM
Threaded Mode