UBCD4Win and Internet safety - no firewall, Hacker risk when booted from UBCD4win? Options

[snoopy]

Dear All,


This may well be a very stupid question, but we are all told about the importance of being protected by a firewall when connected to the Internet.

I searched the FAQ and the forums. I didn't find any matches and I must know the answer.

Well I was trying the latest UBCD4Win v2.55 and Drivers 1.6 build and I fired-up OB1 browser which immediately connected to google, from where I was able to search. Now my connection is broadband and I certainly don't remember this happening with UBCD4Win ver 2.5.

Well seeing as my firewall [ZoneAlarm] registers large numbers of probing attacks every day [as indeed I presume do almost everyone else's, except those with a H/W F/W], how safe is it to be connected to the .net while using the UBCD4win [no H/W F/W]?

I know they can't hack the CD, but is there a danger to my PC or the data on the HDD?

Does the UBCD4win not respond to probing attacks, so that the probers are unaware of the PC [stealth mode] or does it behave like I believe some versions of Windows i.e. XP SP1 by shouting 'Yoo-Hoo everybody, there's a PC over here for you to hack'!

It has occurred to me that this may well be a Bart PE question, but I couldn't find any answers in the forums there either.

This something I would really like to know, especially as I use a cable TV connection and cannot just switch off a hardware firewall. I have to negotiate turning-off the set-top box with my children.

Yours very nervously,
Snoopy.

[pcuser]

There is no firewall built into UBCD4WIN. If you don't have a hardware firewall then you could just unplug your internet connection from the back of your computer when it's not needed.

BTW. Have you looked into purchasing/building a router?

Tom

[BrancoBlace]

Snoopy,
this is a legit concern when under a normal windows environment.. but while booted under The Project it isnt necessary (as far as i know).

the reason behind this is becuase your OS when booted under The Project is loaded into a virtual RAM drive which emulates the windows hive directory so well it even fools some apps (see: Ad-Aware, Spybot). Thus the virus or potential hacker will see this drive as your root drive, load itself on to it and infect your RAM... the kicker is, when you restart your comp the RAM is erased and you boot under your normal HD.

Plus, i believe there are resource issues (i.e. enough RAM left to run the firewall after RAMdisk makes its partitions and you open an app. or two) that would restrict Steel from putting on in.

if you're still concerned about security just take pcuser's advice. I am personally behind a router's HW firewall and it keeps my mind at ease when i test/ use the project.

Branco

[SteelTrepid]

Very valid question and great answers. I have thought about including a software firewall with the project. Maybe we need to start a poll about this?? Does anyone else think that a software firewall needs to be included for some people? I would also think that we would have to test it quite a bit to make sure there weren't any big performance issues with running different software firewalls.

[stidyup]

GhostFirewall

This one is free and is very small. I can't see the point in bloating the project by putting zone alarm etc.... A firewall needs to be small and compact for the CD.

[baronvonfoxbat7734]

Personally I see no need to have a FW in the CD. I use it on our corp network here even during virus storms. I have always been under the impression that no matter what infects the machine whilkst the CD is running that it gets removed on the next reboot. Also, I have always used it behind or corp and home routers. So I have always had that level of security. Doesn't the XP FW start with UBCD4Win? I have never botherd to check... I would think that it would... anyways...

Also... With UBCD, there is no default shares. You have to tell it to share something. Plus, does anyone really know what the admin password is? I found it once a while back but can't remember where. So to a h4x0r, your machine will come up as a WinXPSP2 box with no FW. So anything he tries will not get anything done as there is no shares and anything he can put on your system will be gone or neutralized next boot. Worst case is if the systems gets infected and if the virus is written with substandard code hard referencing c:\ as sysroot versus the common %systemroot% (c:\windows by default) or %systemdrive% (c:\ by default) then if it is written with the variables for the folders then it gets written to the RAM drive and erased next boot. It put on c:\ hard code then only the file is there on a boot and nothing else. So I think looking at it this way, there is no reason for concern with not having a FW on the CD. For normal OS usage, yes, by all means, secure yourself with layers of security. Always have an Administrator password that is longer than 8 characters that has a Cap, a lower, a number, and a special character, puot your self behind a router, have a antivirus, and perform weekly or daily virus and spyware scans. On the CD though... It is a recovery tool. I personally wouldn't worry to much about security of it. If you are scared about that then what you can do is not enable the network on boot. That will prevent your machine from being seen period. Even better than having a router, firewall, and anything else combined.

To sum up... I don't think we need a FW in the CD as that will bloat it that much more with no REAL benefit...

My 2 scents... :wacko: :lol: :blink: :D

[lawson23]

Doesn't the XP FW start with UBCD4Win?

No ICF does not start with UBCD4win.

In many ways I say it would be nice to have the firewall for the protection. Is it needed or really a concern? NO. Just like we don't run live AV protection with the CD. As everyone here has commented that 80% of the malicious stuff would be lost on reboot and the other would be of no use because of no reference to run the file. The only issue I could possibly see is if someone gets an infection and that infection is hard coded for C: only. Forcing the infection to the C drive. Then the infection looks to C: put a run command in the Start Menu of all users. As the only possible way for an issue.

Yes the above is possible but very unlikely. Would it be nice to protect against this yes. But a firewall isn't your only protection needed then.

What I would like to see instead of a firewall is a tool (app) that would inform the user of all writes being made to the C: drive or drives you define and ask permission before performing these writes.

This would also be great for Steel's Forensic approach. Now does a tool or plugin already exist for this? I don't know of one but it sure would be sweet!

[baronvonfoxbat7734]

That is a excellent thought!! I wish I thought of that idea. Noiw as for the plugin... That s the $64K question.... One thing I would have to include in that idea though is not notice per write, per app would be more managable. If I do a recovery using a data recovery proggie... thousands of do I want this to... -=shudder=- anyways... I am sure that you mean for the app level and not per write.

(I have a tendancie to be a tad literal at times and take writing at face value... a deffect of mine...)

[lawson23]

per write

This is really what I meant.

Of course the app could have options. Like show which app is writing and a global settings to enable certain apps. Enable all writes, Disable all writes and Prompt for all writes. But at the base level I would like to be able to watch PER WRITE.

Of course now I'm designing something instead of looking at what is created already. (possibly nothing)

[stidyup]

Ghost firewall is only about 300kb, so it's not going to bloat the project too much :)

[lawson23]

Ghost firewall is only about 300kb, so it's not going to bloat the project too much

Thats great do you have a plugin for this?

[snoopy]

Many thanks everybody for your suggestions, I feel a lot happier now and I can explore the CD and familiarise myself with it so that when a problem arises, I will feel confident enough to use it properly.

I have been considering a H/W firewall, but have been so busy lately that I haven't had a chance to work my way through the specs.

The UBCD4Win is a wonderful bit of kit to have to hand, a bit like a fire extinguisher, great to have just in case!

Once again many thanks,
Especially to Steeltrepid and everyone else who has contributed to the Project.

Yours rather less nervously,
Snoopy

[dirkgently42]

:)
If you have an old box in the closet/attic/garage; install SmoothWall, m0n0wall, or IPCop for maximum security.
It's better than spending money on a new router. They're cheap, but it's a good practice to repurpose old hardware instead of sending it to the landfill.

It's my opinion that you can't afford not to have a hardware router/firewall between you and the internet.
A router gives you much more flexibility and peace of mind.

Software firewalls can be disabled by malware!
Example 1: Trendmicro
Leo Laporte says, "Software firewalls are easily disabled by malware."
Bagle-AU disables XP firewall
Zotob takes out XP firewall

old article from pcpitstop; relavant info:

Another Smoking Gun
Right now some of you are saying that we must be too paranoid, but here's proof that they really are out to get us--and you. This links to a posting from a Usenet group showing hackers how to block a list of antivirus help sites, including ours:
http://pcpitstop.com/tinylink.asp?attack1
This code is already part of some viruses and spyware. Many recent viruses, worms, and spyware also detect and disable antivirus, anti-spyware, or firewall software they find on a PC, so don't assume your PC can't become infected just because you have virus and spyware scanners installed. Treat every email attachment and downloaded file with care.

So, if you are connected to the net with only a software firewall, you may be very vulnerable and must be extremely cautious.

Just a few references concerning firewalls:
SmoothWall Express
...more on SmoothWall express
m0n0wall
IPCop

... one runs from CD, the other from a floppy
Sentry Firewall
FREESCO

other links:
Home PC Firewall Guide
Personal Firewall Reviews
Application Firewall
Wired Router Reviews
gov. security forum
Firewall (networking)
:)

This post has been edited by dirkgently42: Sep 28 2005, 09:20 PM

[stidyup]

I've not got a plugin for it, but I'm certain it only needs a simply plugin to work.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GhostWall"="\"C:\\program files\\ghostwall\\ghostwall.exe\" -minimize"

However this reg key will need adding or edit the autorun.cmd file and the command to start the firewall it will look something like this "program files\ghostwall\ghostwall.exe" -minimize and put it in the autorun plugin folder.

I'm not certain how you would get it to load but I can't see it being that hard.

[baronvonfoxbat7734]

Dirk beet me to it but was going to say if you wanted a Router without buying one and you have an old junker somewhere, nothing special just have 2 NIC's in it. Download the UBCD itself and on it is a one disk router software. I think it is the FREESCO but not sure. If your new "router" locxks up or needs a reset, just boot the CD back up and voila your router is back up! just a sugestion.