Amiga.org
The "Not Quite Amiga but still computer related category" => Alternative Operating Systems => Topic started by: blobrana on February 18, 2004, 02:26:15 AM
-
Hum, i can`t really post this on the front page, but it may be of use to those WinUAE users ;)
M$ advises IE Explorer 5.x or IE 4.X users to upgrade immediately...Due to that source leaked.
Microsoft is advising customers to move onto IE6 Service Pack 1 and more recent patches ...
Did`t take them long , did it ...
(the hackers)
-
TBH, those who use IE deserve to get stitched up ;-).
I mean, tabbed browsing and automatic popup blocker is reason enough to use Mozilla/Netscape etc
-
Right, Right, IE is horrible compaired to netscape.
In defense of MS$ you know they get picked on a lot.
If the hackers poured an equal effort into destroying debian Linux you would have a "very un-secure" operating system in debian linux.
Well, one thing I can't statnd (about netscape) is when you right click on a tab to close it, Close Other Tabs is right next to Close Tab, and I always end up picking the wrong one and all my tabs disapear.
Really, when I am doing research, I use Lynx.. I know it sounds backwards, but I find that the high contrast of a tty term is great when you have to read a lot.
-
So as you navigate to the alternative web-browser site...
...remember to disable code execution features of your old browsers, immediately!
[It`s a world full of hurt, out there]
-
and people wonder why i use Opera!
:rtfm:
-
Myself, I think MicroDollar had a play in the release of the code. They stand to benifit the most. There are a lot of users out there who use lesser windows versions. That is a lot of potential money when they upgrade. Leak source code = updating = more money for M$. Not to mention free publicity and a tax right off for the lost property. M$ makes out to well in this situation not to have had a hand in it, not that it could be proven. Remember, newer versions are snitch ware and information is power.
So, update to Linux ! :-P
-
Right, Right, IE is horrible compaired to netscape.
In defense of MS$ you know they get picked on a lot.
If the hackers poured an equal effort into destroying debian Linux you would have a "very un-secure" operating system in debian linux.
Time to think up a new argument mate, two reasons: this one is poor and old :-)
Every major OS gets just as much attention as MS products do. If you don't believe me, subscribe to bugtraq (a security vulnerability mailing list). There's also NT-Bugtraq for more Windows-specific stuff, though it gets discussed on both lists.
There are more virus writers gunning for MS products, though for two reasons. A) its popularity, but also B) because it's so damn easy. You can run a truck through the security policy of Outlook/Express. If a double filename extension doesn't do it, just add another one on the end, for example. Then there's its MIME handling, there will be a number of vulns after the first along that line, because one subsystem handles the sanity-checking of the MIME type while another handles attachments based on name. B'duh.
Actually, if you wanted to compare vuln for vuln with many Linux distros and Windows, you'll find the figures quite comparable. Windows would be a pretty damn secure OS all round if IE, OE, MSNM, WMP and SMB (filesharing services) were removed on a default setup. They are what makes it such an obvious target, and quite frankly, who needs them. Certainly not everyone. People who don't run these components on Windows as their default apps (or use SMB) only have to worry about one in 10, maybe 15 Windows vulnerabilities.
And instead of using Netscape, use what is currently in development (Netscape has been discontinued), which recent versions of Netscape was based on: Mozilla (http://www.mozilla.org/), Mozilla Firefox (http://www.mozilla.org/products/firefox), and Mozilla Thunderbird (http://www.mozilla.org/products/thunderbird).
-
Myself, I think MicroDollar had a play in the release of the code.
I think so as well. This is what I posted about it yesterday on another forum:
Hmm, let me see, do we have all the bases covered:
* The code is really old (NT4 SP3 and Win2k SP1)
* MS wasn't hacked
* a box running something MS'y wasn't hacked
I say it's a stage-managed job from beginning to end. To look like those damn linux commie terrorist firesharing hackers wanted to get hold of some code, just like they did with SCO.
This post was constructed using elements of sarcasm.
:-)
-
blobrana wrote:
Hum, i can`t really post this on the front page, but it may be of use to those WinUAE users ;)
M$ advises IE Explorer 5.x or IE 4.X users to upgrade immediately...Due to that source leaked.
Microsoft is advising customers to move onto IE6 Service Pack 1 and more recent patches ...
Did`t take them long , did it ...
(the hackers)
The only place you will find WinUAE users is in the UNITED ARAB EMIRATES!!! :lol:
-
@sumner7
Hum,
Have you tried installing WinUAE on a PC?
You can get free program here:
http://www.winuae.net/ (http://www.winuae.net/)
(updated next week, WinUAE 0.8.25 )
Disclaimer:
Don`t blame me.
[Das bot]
-
And i may as well post this link to sort the massive gaping hole in zonealarm (a "highly critical" security hole that allows system access to remote users)...
Details here, and ways around it...
http://www.prognosisx.com/cgi-bin/cgi-script/csNews/csNews.cgi?database=JanDD%2edb&command=viewone&id=79&op=t]http://www.prognosisx.com/cgi-bin/cgi-script/csNews/csNews.cgi?database=JanDD%2edb&command=viewone&id=79&op=t
IS this doggy? i don`t know...
[And this will be my last posting on this
-
ZoneAlarm is a gaping security hole.
-
Doh!
[trust you to spot that glaring mistake]
-
mikeymike wrote:
ZoneAlarm is a gaping security hole.
What do you mean? I use ZoneAlarm.
-
mikeymike wrote:
ZoneAlarm is a gaping security hole.
huh?!? Why do you say that?!?
- Mike
-
Because he's right. Unless you buy the pro version, which is slightly better. But then again, software firewalls will always be inferior to hardware firewalls. If your only option is software, however, I suggest Tiny personal firewall.
IE? Who uses that anymore? :laugh:
Go download FireFox. Now. (http://www.mozilla.org/products/firefox/)
EDIT: looks like Tiny took the free version off their website, and googling for it didn't produce anything. If anybody wants to try it out, PM me. The installer is about 2 megs.
-
@blobrana
Why post something you can't read without having the password (without mentioning that fact)? Howsabout you just tell us what the hole is. :-(
-
Because he's right. Unless you buy the pro version, which is slightly better. But then again, software firewalls will always be inferior to hardware firewalls. If your only option is software, however, I suggest Tiny personal firewall.
No offense, but I was hoping for a more technical response then that.
And as for hardware/software firewalls, they're all the same really. I mean, my router has a "hardware" firewall, but really all it is is a tiny computer with firewall software on it's firmware. It's still software, it's just burned onto an EPROM. What's the diff?!? And "hardware" firewalls like the ones found on routers will not be able to stop spyware from phoning home on randomly selected ports. In fact, this is the main reason I run ZA Pro as I'm already behind my router's firewall and I use ZA to stop any unwanted outgoing traffic.
Now, unless you can point some technical flaws in ZA that could allow hackers in through some back door, then I don't see where you're comming from.
- Mike
-
I agree with Glaucus. Point me to something specifically wrong with Zone Alarm from a home user's perspective. I mean, it is true that ZA is only as good as you configure it. This is true of ANY firewall, though. (Allowing all ports or all applications that ask for internet access to HAVE internet access isn't really very secure.)
What ZA does (restrict programs, and notify programs attempting outward access) it seems to do very well. Unless there's something we're missing here?
The truth is, I, myself, run Kerio Personal Firewall (aka Tiny Personal Firewall) because I like the fine-grained control over port ranges, etc... But for your average user (my mom, cousin, aunt, etc.) I've always recommended ZoneAlarm. As long as you give it some sane settings, it seems to be quite secure...?
-
sumner7 wrote:
blobrana wrote:
Hum, i can`t really post this on the front page, but it may be of use to those WinUAE users ;)
M$ advises IE Explorer 5.x or IE 4.X users to upgrade immediately...Due to that source leaked.
Microsoft is advising customers to move onto IE6 Service Pack 1 and more recent patches ...
Did`t take them long , did it ...
(the hackers)
The only place you will find WinUAE users is in the UNITED ARAB EMIRATES!!! :lol:
Although I use WinUAE everyday, I don't remember being in the UNITED ARAB EMIRATES !!! :huh:
-
c'mon.... humor, people!!! searches for UAE files often return results for United Arab Emirates, instead of our files for our favorite Universal Amiga Emulator. ;-)
-
Zone alarm pro:
Unexplained 100% CPU usage.
Kills all network traffic when disabled.
Not able to be uninstalled cleanly.
There's a few for you all. ;) Mind you, they may have fixed that by now, but I havn't touched ZA for a long time.
Have a look at Agnitum outpost pro instead. :)
-
Unexplained 100% CPU usage.
Not seen this, personally, but have heard of it occasionally happening. Of course, Win32 apps do this all the time. Surely it happens less often than say... EXPLORER.EXE?
Kills all network traffic when disabled.
Uhm.... is that not the point? If a renegade app could just kill ZA and then connect, ZA wouldn't be a very effective firewall, would it? Stopping all traffic while disabled is the proper behavior, is it not?
Not able to be uninstalled cleanly.
Not encountered this problem, either, but it's really more of a Windows issue than a ZA issue. Windows too easily loses track of it's DLLs and settings. For example, I just had an issue with a certain popular video editing program's uninstaller.... The program had installed some new codecs. Uninstalling the app broke not only the program's codecs, but also my standard Windows ones. It wouldn't surprise me if ZA tramples a few DLLs associated with TCP/IP, such that it breaks a few things on it's uninstall. I blame Windows for making it so damn easy for apps to do this.... I'd be surprised if Agnitum outpost pro uninstalls cleanly, as well... ;-)
Really, the comments posted so far are problems common to all Windows apps. IF you know of a SPECIFIC SECURITY problem, please let me know, as most of my family runs this.
But, really, the ones posted above don't have much more weight than complaints about the ugly-ass brown interface....
-
@weirdami
Er, too slow....
Why post something you can't read without having the password (without mentioning that fact)? Howsabout you just tell us what the hole is.
Sry, about that, the site was open when i posted... But it was a bit dodgy, in that you could patch/upgrade to the higher version without paying the subscription...A bit of a gray area...(er, or piracy...)
URL name reduced in size by mikeymike (http://www.prognosisx.com/cgi-bin/cgi-script/csNews/csNews.cgi?database=JanDD%2edb&command=viewone&id=79&op=t)
- URL name edited by mikeymike, was causing page width to go bonkers -
Will explain the `broken` bits...
Disclaimer:
I know what i`m doing...
-
Glaucus wrote:
mikeymike wrote:
ZoneAlarm is a gaping security hole.
huh?!? Why do you say that?!?
It has been victim to some of the most trivial and obvious exploits (that even I could exploit, and I have no programming skills or s'kiddie tools).
Perhaps you ought to read up on your preferred security tool before putting your trust in it. www.securityfocus.com might be a good first stop, though googling for zonealarm vulnerabilities might also help.
It is a poor product.
My favourite of the vulnerabilities I read about it was one that, if an attacker attacked the system 'more than 200 times' (which is just a simple single port scan), zonealarm would crash, and the vulnerability allowed insertion of code into the memory space, which means an attacker could run any program they wanted.
Ok, so no program is perfect, but this is silly. It's like the zillion vulnerabilities in Outlook/Express regarding file extensions, adding double of triple extensions on the end of attachments, and they'd walk straight past attachment security. A firewall should be able to handle a port scan. It is not a firewall otherwise. It's a great big sign saying "NEWBIE HERE! TAKE OVER MY SYSTEM!".
Although the most amusing app for even the least knowledgable 'hacker' is Miribalis ICQ. I must have remotely crashed that app about 20 times using different methods, sometimes trashing its local ICQ database in the process. (I did this in a test environment btw - my job required testing Internet-talking apps a good deal more than others).
The only Windows firewall I've tried that seems to be half-decent, while not carrying along the kitchen sink is 8Signs Firewall. Although I haven't finished testing it yet.
-
The only Windows firewall I've tried that seems to be half-decent, while not carrying along the kitchen sink is 8Signs Firewall. Although I haven't finished testing it yet.
So have you tested sygate pro or personal if so how good did you find it. :-)
-
Glaucus wrote:
Because he's right. Unless you buy the pro version, which is slightly better. But then again, software firewalls will always be inferior to hardware firewalls. If your only option is software, however, I suggest Tiny personal firewall.
No offense, but I was hoping for a more technical response then that.
And as for hardware/software firewalls, they're all the same really. I mean, my router has a "hardware" firewall, but really all it is is a tiny computer with firewall software on it's firmware. It's still software, it's just burned onto an EPROM. What's the diff?!? Now, unless you can point some technical flaws in ZA that could allow hackers in through some back door, then I don't see where you're comming from.
- Mike
no1 knows specific ones apart from people who've studied the code and hackers. although i made my own trojan just to test which is the best firewall, and in my study's...
/me hides and uses a remote microphone
...i found that windows xp built in firewall, and hardware firewalls turn out the best.
hardware firewalls are the same, however you have to pay "bare" amounts for them, therefore the software that is changed into hardware must be refined. it also allows greater control, irrelevant of OS, which means windows can't escape it :-)
GreggBz wrote:
Right, Right, IE is horrible compaired to netscape.
In defense of MS$ you know they get picked on a lot.
If the hackers poured an equal effort into destroying debian Linux you would have a "very un-secure" operating system in debian linux.
oh please. they NEED linux to hack in the first place!
everyone knows that ip changers, trojans, remote access, DoS attacks, etc only work properly in linux. and not feeble attempts made in *chuckle* visual basic :-)
-
Zone Alarm is the bee's knees. There just happens to have been some small thing found wrong with it that has been corrected. "Small" because, as that prognosisx page says, it's only a problem for people who are using it in a manner not recommended by Zone Labs.
When all those other firewalls that some of you are pushing finally get enough exposure to cause people to start thinking it worthwhile to look for security holes, you'll be on the other side of this. Let's keep the bashing to M$ products, shall we. :-)
Anyway, the hole has been fixed. Why even bring it up?
-
I am no fan of windows or microBrog. but I have to have windows 2000 to run AE and get online. a friend of mine (basically an IT guy) suggested using zonealarm and I've had version 3.1.395 all this past year. I have it set up to allow NOTHING to go in or out without my permission.
That is easily done in the GUI.
I never use Outlook or any other mail program. And I use Opera.
I have never had a virus, and I am paranoid about installing ANYTHING on my system.
I also use SpyBot (http://www.safer-networking.org/). I used it to remove about 14 cookies (which were not dangerous, just dumb) and have not had any new ones since.
If one is careful, then one is as safe as possible. needless to say i never open mail attachments. they stay on the servers and get deleted there.
thanks for the link, mike. :-)
-
Anyway, the hole has been fixed. Why even bring it up?
/me shakes his head...
Right. Go to www.securityfocus.com and search for the number of issues about ZoneAlarm in the past.
And AFAIK no other firewall has been quite so lame as to not withstand a portscan. It's like the first thing anyone would do to try and get into your system. Consider also that firewalls have been around a lot longer than ZoneAlarm, it's not like ZA is doing anything cutting-edge. If they can't even cater for something so basic as that, then the rest of their code is likely to be very scary indeed.
ZoneAlarm was not anywhere the first on the market. There are tonnes of other firewalls available out there, hardware or software ones, which have been around longer than ZA. None have vulnerabilities as embarrassing as ZA's.
Ask anyone who knows anything about computer systems security whether they think ZA is any good, and they'll laugh. Like this: :roflmao:
Your system's first line of defence needs to be a good one. The worst thing that can happen is for the first line of defence to be the cause of a system compromise.
-
Right. Go to www.securityfocus.com and search for the number of issues about ZoneAlarm in the past.
Thanks for bringing some sanity to this, mikeymike.
Ok, there are a few things with ZoneAlarm, but looking over the securityfocus reports, I saw 4 actual reports on ZA in the past 10 months. (As far back as I felt like clicking)
I still don't see why ZA isn't secure for a basic home user, though.
1 was the SMTP exploit. No home user should be running SMTP. And if you're advanced enough you know how to securely configure SMTP, why the heck are you running a basic home-user firewall?
1 exploit wasn't remotely accessible. Gee, if I can walk up to the home computer, I can probably do a lot more harm than bypassing the firewall.
So, honestly, two legitimate exploits in 10 months. I wouldn't say ZoneAlarm looks much worse than Symantec Internet Security, or most any other PERSONAL firewall. My argument is that they ALL offer a good base of protection if properly maintained and configured. But, of course, don't get any false sense of confidence that ANY software is invulnerable. Even the best written software is going to get hit now and then. (Witness recent SSH exploits surfacing.)
The lesson should be that NO product is perfect. Make sure it's configured properly, and keep up to date with the patches and be wary of anything that seems amiss with a system. This should be done no matter what software or OS you have. :-)
Ask anyone who knows anything about computer systems security whether they think ZA is any good, and they'll laugh.
Odd... most sysadmins I know still recommend it. It's a simple and basically secure package at a very reasonable price.
-
Right. Go to www.securityfocus.com and search for the number of issues about ZoneAlarm in the past.
I did, and found some vulnerabilites, but same goes for all other firewalls. Haven't found a perfect one yet. The important thing to note is that these bugs are fixed, and some vulnerabilities (http://www.spywareinfo.com/articles/zonelabs/exploit_hoax.php) aren't even real vulerabilites (http://www.securityfocus.com/archive/1/332276).
This article (http://netsecurity.about.com/cs/firewalls/a/aa071303.htm) defends ZA, and the author still considers it to be one of the best firewalls on the market. A far cry from your "poor product" statement. After reading bit of SecurityFocus I'm still convinced that ZA is better then BlackIce and Norton's personal firewall. ZA is the only firewall I know of that can prevent spyware and bots from accessing the net, and that's pretty significant if you ask me.
And AFAIK no other firewall has been quite so lame as to not withstand a portscan.
Now you're really getting silly. My system shows up as stealth, and I've tested it using Gibson Research Center's (http://grc.com/default.htm) Shields Up (https://grc.com/x/ne.dll?bh0bkyd2) security tool. My system passed with flying colours on all tests, and that was before I got the hardware firewall installed. Not bad for a firewall that's so lame it can't withstand a simple portscan! :roll:
ZoneAlarm was not anywhere the first on the market. There are tonnes of other firewalls available out there, hardware or software ones, which have been around longer than ZA. None have vulnerabilities as embarrassing as ZA's.
Perhaps it's because the vulnerabilties you've so far described don't exist?!? Hey, I have no loyalty to ZA, and if you can actually point me to some real hard evidence I'll be more then greatful, but so far you've given me nothing but nonsense.
- Mike
-
GreggBz:
Well, one thing I can't statnd (about netscape) is when you right click on a tab to close it, Close Other Tabs is right next to Close Tab, and I always end up picking the wrong one and all my tabs disapear.
Yeah, I've learned theh ard way to right click and hit 'c' on the keyboard to avoid that, works well. Maybe your missing it when you don't have two hands free?
-
jeffimix wrote:
GreggBz:
Well, one thing I can't statnd (about netscape) is when you right click on a tab to close it, Close Other Tabs is right next to Close Tab, and I always end up picking the wrong one and all my tabs disapear.
Yeah, I've learned theh ard way to right click and hit 'c' on the keyboard to avoid that, works well. Maybe your missing it when you don't have two hands free?
well he would be when he goes to porn :lol:
-
I used ZoneAlarm for a few weeks. It's horrible, I really don't understand how it has gained such support. Even the parts the user gets to see, suck beyond belief. Configuration sucks, it's just really, really poo.
It's crap.
It's just... not very good. At all.
It bites ass.
-
I'd be glad to give you a personal demo of it!
:knuddel:
-
cecilia wrote:
I'd be glad to give you a personal demo of it!
:knuddel:
Ass biting?
:nervous:
-
that_punk_guy wrote:
cecilia wrote:
I'd be glad to give you a personal demo of it!
:knuddel:
Ass biting?
:nervous:
That too!!!
:banana:
-
that_punk_guy wrote:
I used ZoneAlarm for a few weeks. It's horrible, I really don't understand how it has gained such support. Even the parts the user gets to see, suck beyond belief. Configuration sucks, it's just really, really poo.
Hhhmmm. I LIKE ZA's interface! Have you used Norton Personal Firewall? As well as being useless AS a firewall, it's UI is horrific.
I'm a ZA fan, it's done a mighty fine job for me for the past six months or so.
Martyn.
-
The best free Firewall available is Kerio Personal Firewall, it is alot more powerful than ZA and alot more customizable too.
-
NightShade737 wrote:
The best free Firewall available is Kerio Personal Firewall, it is alot more powerful than ZA and alot more customizable too.
Thanks for the heads-up, that looks pretty good on paper, I'll download it and give it a go.
While searching for some info about it, I found this great comparison, maybe some people will find it helpful.
Here (http://www.agnitum.com/php_scripts/compare2.php)
-
@martyn
Who is that woman in your avatar?
-
My misses.
-
She looks quite menacing :-).
-
Martyn wrote:
NightShade737 wrote:
The best free Firewall available is Kerio Personal Firewall, it is alot more powerful than ZA and alot more customizable too.
Thanks for the heads-up, that looks pretty good on paper, I'll download it and give it a go.
While searching for some info about it, I found this great comparison, maybe some people will find it helpful.
Here (http://www.agnitum.com/php_scripts/compare2.php)
Well, it does seem like Kerio is a decent FREE firewall. The comparison chart provided only included the free version of ZA, which is unfortunate as the Pro version has a lot more features then the free version. I also wouldn't take the final score too seriously as the best of the free firewalls seems to be Outpost FREE, yet it failed 3 of the leak tests!
Btw, I'm gonna download those leak tests and try them out. I've already tried the one from grc and my ZA Pro 2.6 passed without problem.
- Mike
-
@odin
She looks quite menacing.
She more than *looks* menacing! But I've changed my avatar to one that looks less menacing!
@Glaucus
Yeah, the 'scores' are completely misleading! The feature comparison's nice tho. I wouldn't mind knowing which leaktest ZA failed.