Firewall Exploits

[enCode]

Me?! never. Drugs are bad. ;)

Yea, I'd start in on the hard drugs too. :D

I thought you already were on the hard drugs?

[enCode]

Yea, I'd start in on the hard drugs too. :D

so then what was the crack used for???

The crack was used for the rest of SG-1.

[enCode]

so then what was the crack used for???

[astcell]

I thought McGyver took speed to help him sleep at night.

[enCode]

I always thought McGyver and speed were a perfect match :D

[kree]

Anyone who saw Half Baked knows that MacGyver smokes weed, not crack!

True, but as but as they say weed is a transitional drug therefore he is a crackhead!

[bascule]

Ok, McGyver. Put the crack pipe down!

Anyone who saw Half Baked knows that MacGyver smokes weed, not crack!

[enCode]

O.K. i guess what i mean by 'exploit' is gaining control from a remote terminal.
i'm not too worried about DoS
So how would some one render the firewall useless (circumvent)?
although that may be too broad

P.S. thanx for being cool about answering my question though

[skroo]

I'm going to try to answer this somewhat seriously.

So I've been thinking about firewalls and how secure they are. My question is this "how easy is it to exploit a firewall vulnerability (if there is one?)" especially such a common one as ZoneAlarm.

One important thing here is to define what you mean by 'exploit'. Do you want to obtain, say, administrative logons onto the device? Or crash it, or otherwise perform a successful DoS? Or make it pass traffic it shouldn't, or drop traffic it should allow?

ZoneAlarm runs on top of Windows, and is technically more of an Intrusion Prevention System (IPS) than firewall. It's fairly safe to say that any Windows exploits it doesn't know how to protect against will undermine its effectiveness - though the same is going to be true of any similar product that runs on top of a host OS. Again, though, you need to define what you mean by 'exploit' in this context - and there may well be additional internal flaws within ZoneAlarm that could conceivably lead to some form of successful remote exploit.

Not to avoid giving you an answer, but they need to be found before they can be exploited. As an off-the-cuff answer, there are a conceivably lot of places this might be possible within the internal architecture of ZoneAlarm. However, there's no way of giving you a solid answer until something is found and demostrated - it'd all be in the theoretical at this point.

More importantly how is it done and is there any precautionary measures I can take to stop people from doing it???

As for the 'how is it done' part, see above. As for precautionary measures, keep Windows, ZoneAlarm, and your antivirus software patched and up-to-date. Also, don't overlook good administrative practices such as limiting user privilege to the lowest level possible, enforcing storage quotas, defining and enforcing group policy, etc.

[enCode]

Please tell me you are joking and forgot to turn on the <sarcasm> tag.

<sarcasm>(oops)

[spahkle]

Thats really cool but why does it work?
It's a buffer overflow right?

yeah.. brain buffer

[Chris]

Thats really cool but why does it work?
It's a buffer overflow right?

Please tell me you are joking and forgot to turn on the <sarcasm> tag.

[enCode]

Thats really cool but why does it work?
It's a buffer overflow right?