A Naive User's Guide to Running Windows More Securely
Linked by Alcibiades on Wed 4th Jan 2006 18:04 UTC
Windows Like a lot of people who have worked in the business, I find myself in conversations about computer security with people who are having problems or know people who have problems. I wrote this to save me from explaining the same thing over and over again to different people, and to save them the trouble of having to make notes as we talked. It was meant to be something you could give to a 'naive user' and have them be able to read and follow it more or less unaided, and while not being a complete guide, at least be something that made them more secure than before they got it.
E-mail Print r 0   · Read More · 40 Comment(s) http://osne.ws/a61
Thread beginning with comment 81778
To read all comments associated with this story, please click here.
Zonealarm
by yawntoo on Wed 4th Jan 2006 20:42 UTC
yawntoo
Member since:
2006-01-04

Application firewalls like zonealarm are not as useful as they once were. These products can only ask you whether or not you want to allow a particular application, as identified by the process image name, to access the internet.

Lots of newer spyware will not run in thier own process space. Instead a newer spyware application will install its bots and internet connection threads in an existing process.

Here is an example:
A spyware application, lets call it nasty.exe, starts up and drops a file containing its spyware code onto the disk. Lets say this file is called spy.dll. Next nasty.exe opens a handle to a well known process that people expect to access the internet, like iexplore.exe. Nasty.exe uses a standard process injection technique (you don't need to be administrator to do this) to get the running copy of iexplore to load spy.dll into a new thread. Now the spyware code is running as a new thread in iexplore.exe.

In this scenario, zonealarm is totally useless. All access to the internet from the spyware code will look like it comes from iexplore.exe, which has proabably been set to OK by the user.

This sort of anti-detection is rather easy to do, and becomming quite common. The more common this gets, the less useful products like zonealarm become.

At this point, I don't even bother with them.

Reply Score: 4

RE: Zonealarm
by ma_d on Thu 5th Jan 2006 00:52 in reply to "Zonealarm"
ma_d Member since:
2005-06-29

Are you serious? You can actually cause other processes, than your own, to load libraries?

Is this possible on other systems?
Do you have any good reading material on this?

Reply Parent Score: 1

RE[2]: Zonealarm
by yawntoo on Thu 5th Jan 2006 15:53 in reply to "RE: Zonealarm"
yawntoo Member since:
2006-01-04

Yes you can do this, however you need to have permission to access the other process in this way.

On Windows, the way you do this is to:
1) Open a handle to the target process
2) Allocate memory in the other process space
3) Write the path to your DLL into that memory space
4) Create a thread in the target process space with the thread proc set to LoadLibrary and the parameter set to the memory address you allocated in step 2.
5) Your dll code is now running in the other process...

This is a very well known DLL process injection attack. The OS APIs used for this attack exist to allow debuggers to function (among other things). This is just an example of how powerful tools can be used for good and for bad.

A few things to keep in mind with this attack:
1) You can be attacked in this way even if you are not running as administrator. The attack can simply choose to inject into a process that your user account owns.... like iexplore.exe.
2) You cannot inject into a process if you don't have permission to open the process and create remote threads. This would prevent even the administrator from attacking processes owned by the system without doing a bit more work.

I haven't really looked into this style of attack on Mac OS X, or variants of Linux, however I wouldn't be surprised to find that a similar attack is possible. For Mac OS previous to OS X and Windows 9x/ME/3.x would probably be rather easy to attack. IIRC they lacked protected memory so any process could access another process's memory space.

There are plenty of sources on the net that describe this sort of thing. See www.rootkit.com for some examples.

Edited 2006-01-05 15:55

Reply Parent Score: 1

Read more of this thread... >
RE: Zonealarm
by elsewhere on Thu 5th Jan 2006 20:31 in reply to "Zonealarm"
elsewhere Member since:
2005-07-13

In this scenario, zonealarm is totally useless. All access to the internet from the spyware code will look like it comes from iexplore.exe, which has proabably been set to OK by the user.

I've been running ZA for ages. It monitors for processes attempting network access via another process, I get warnings all the time for routine Windows operations. It detects via signature when trusted or known applications are modified (legitimately or maliciously). It will even monitor application actions after a new install in a learning-mode to determine some sort of rudimentary baseline reference for how the applications interact.

Sure, it's not infallible, but I wouldn't write off the relevance of personal firewalls, particularly for newer users. The popup windows may be confusing to some, but at least they force the users to think about what is running on their system. They're no different than A/V filters, not an overall solution but simply a piece of one.

Reply Parent Score: 1