Re: guidance sought
Available news archives: comp.lang.tcl - comp.lang.python - comp.security.firewalls - sci.crypt - comp.lang.php - comp.lang.javascript
Google
 
Web news.hping.org


comp.security.firewalls archive

Re: guidance sought

From: Sebastian Gottschalk <seppi@seppig.de>
Date: Fri Mar 31 2006 - 19:49:20 CEST

ArtDent wrote:

>> And the "other" firewalls won't, too, if the malware is not
>> completely dumb and does not use one of the well-known
>> possibilities to communicate ignoring any "Personal Firewall".
>
> That has changed 'lately'. Quite a few personal firewalls now do
> checksums or some other method to make sure that the program(s) you
> give permissions to acces the net, stays its pristine self.

That's why malware usually changes the software in memory, or only
changes its behaviour.

> Yes, ok, _some_ malware can 'sneak' past _some_ personal firewalls,
> but, having one is USUALLY better than not having one - FOR THE NEWER
> USERS, whom are the ones usually asking the questions about this.

Almost any modern malware does.

But you're suggesting to keep users uneducated and being fed with placebos.
Received on Mon May 1 01:03:38 2006