msan_msw
06-10-02, 12:43 AM
HeHeHe :D I get the "Langa List" ( http://www.langa.com/ ), a ~weekly informative email that covers a wide variety of tech news and other goodies for millions of folks around the globe. Some of you may get it as well. Anyway, remember the Backstealth and Firehole discussion around ZoneAlarm and Tiny Personal Firewall? I submitted a "user" question to Fred and it actually made the LangaList :) I thought he'd be able to give some insight to the discussion and more importantly spread the news.... Anyway, I thought it was cool I got mentioned <g>!
1) Firewall "Flaws"
Fred: Today a friend of mine showed me a few free utilities
that show a flaw in most firewalls that allow for outbound
traffic without user consent. What is your take on these types
of security issues and should we as consumers be worried?
Backstealth:
http://piorio.supereva.it/backstealth.htm?p
Firehole:
http://keir.net/firehole.html
Take care and thank you for your LangaList! --- Michael Sanders
------------------------------------------------------
We should *always* be worried about security, Michael. <g> That's
because the only way to be truly secure is to disconnect your PC from
all outside data and phone lines, build an opaque Faraday cage around
the system (to block all snoopable forms of electromagnetic radiation),
and to control access to the system so that only you can get at it.
Heck, not even that's 100% secure: Remember the scene in Mission
Impossible when Tom Cruise was dangling from the ceiling, trying to hack
into a computer? That computer was disconnected from the outside world,
and in a controlled-access, EM-Proof environment, and he still got in. <g>
OK, that's Hollywood, but even in reality there is no 100% security
solution for computers--- or for anything. For example, any car can be
stolen. But if you take reasonable precautions--- parking the car in a
well-lit, visible location; locking the car; taking the keys; perhaps
using a built-in or aftermarket theft-deterrent system--- you'll make
your car a less-attractive theft target than others. Thieves will
usually opt for easier targets, so the odds tilt in your favor. Your car
still could be stolen by a determined and clever thief, but chances are,
it won't be.
It's the same with computers: All firewalls--- *all firewalls*--- can be
compromised. In fact, any computer security measure you can think of can
ultimately be compromised in some way. "Backstealth" and "Firehole"
simply illustrate a couple ways some firewalls can be worked around.
But--- despite what the sites claim--- that doesn't mean that firewalls
are useless. Quite the contrary. Firewalls are one of several reasonable
precautions you still *always* should take to tilt the odds in your
favor. (See "How Much Protection Is Enough?
http://www.informationweek.com/840/langa.htm ) Combined, a reasonable
series of precautions will make your system a less-vulnerable/less-
attractive target than others, and improve your odds of not being
hacked, cracked, or attacked.
But security is such an important topic, let's not stop there: The next
few items in this issue are reader-updates and pointers on various
security topics and sites:
Click to email this item to a friend
http://www.langa.com/sendit.htm
The issue isn't currently on his site (it's still 06/06/02) but you can see the issue in its entirety within the next few days I'm sure :)
1) Firewall "Flaws"
Fred: Today a friend of mine showed me a few free utilities
that show a flaw in most firewalls that allow for outbound
traffic without user consent. What is your take on these types
of security issues and should we as consumers be worried?
Backstealth:
http://piorio.supereva.it/backstealth.htm?p
Firehole:
http://keir.net/firehole.html
Take care and thank you for your LangaList! --- Michael Sanders
------------------------------------------------------
We should *always* be worried about security, Michael. <g> That's
because the only way to be truly secure is to disconnect your PC from
all outside data and phone lines, build an opaque Faraday cage around
the system (to block all snoopable forms of electromagnetic radiation),
and to control access to the system so that only you can get at it.
Heck, not even that's 100% secure: Remember the scene in Mission
Impossible when Tom Cruise was dangling from the ceiling, trying to hack
into a computer? That computer was disconnected from the outside world,
and in a controlled-access, EM-Proof environment, and he still got in. <g>
OK, that's Hollywood, but even in reality there is no 100% security
solution for computers--- or for anything. For example, any car can be
stolen. But if you take reasonable precautions--- parking the car in a
well-lit, visible location; locking the car; taking the keys; perhaps
using a built-in or aftermarket theft-deterrent system--- you'll make
your car a less-attractive theft target than others. Thieves will
usually opt for easier targets, so the odds tilt in your favor. Your car
still could be stolen by a determined and clever thief, but chances are,
it won't be.
It's the same with computers: All firewalls--- *all firewalls*--- can be
compromised. In fact, any computer security measure you can think of can
ultimately be compromised in some way. "Backstealth" and "Firehole"
simply illustrate a couple ways some firewalls can be worked around.
But--- despite what the sites claim--- that doesn't mean that firewalls
are useless. Quite the contrary. Firewalls are one of several reasonable
precautions you still *always* should take to tilt the odds in your
favor. (See "How Much Protection Is Enough?
http://www.informationweek.com/840/langa.htm ) Combined, a reasonable
series of precautions will make your system a less-vulnerable/less-
attractive target than others, and improve your odds of not being
hacked, cracked, or attacked.
But security is such an important topic, let's not stop there: The next
few items in this issue are reader-updates and pointers on various
security topics and sites:
Click to email this item to a friend
http://www.langa.com/sendit.htm
The issue isn't currently on his site (it's still 06/06/02) but you can see the issue in its entirety within the next few days I'm sure :)