Dear All,
This may well be a very stupid question, but we are all told about the importance of being protected by a firewall when connected to the Internet.
I searched the FAQ and the forums. I didn't find any matches and I must know the answer.
Well I was trying the latest UBCD4Win v2.55 and Drivers 1.6 build and I fired-up OB1 browser which immediately connected to google, from where I was able to search. Now my connection is broadband and I certainly don't remember this happening with UBCD4Win ver 2.5.
Well seeing as my firewall [ZoneAlarm] registers large numbers of probing attacks every day [as indeed I presume do almost everyone else's, except those with a H/W F/W], how safe is it to be connected to the .net while using the UBCD4win [no H/W F/W]?
I know they can't hack the CD, but is there a danger to my PC or the data on the HDD?
Does the UBCD4win not respond to probing attacks, so that the probers are unaware of the PC [stealth mode] or does it behave like I believe some versions of Windows i.e. XP SP1 by shouting 'Yoo-Hoo everybody, there's a PC over here for you to hack'!
It has occurred to me that this may well be a Bart PE question, but I couldn't find any answers in the forums there either.
This something I would really like to know, especially as I use a cable TV connection and cannot just switch off a hardware firewall. I have to negotiate turning-off the set-top box with my children.
Yours very nervously,
Snoopy.
Full Version: UBCD4Win and Internet safety - no firewall
There is no firewall built into UBCD4WIN. If you don't have a hardware firewall then you could just unplug your internet connection from the back of your computer when it's not needed.
BTW. Have you looked into purchasing/building a router?
Tom
BTW. Have you looked into purchasing/building a router?
Tom
Snoopy,
this is a legit concern when under a normal windows environment.. but while booted under The Project it isnt necessary (as far as i know).
the reason behind this is becuase your OS when booted under The Project is loaded into a virtual RAM drive which emulates the windows hive directory so well it even fools some apps (see: Ad-Aware, Spybot). Thus the virus or potential hacker will see this drive as your root drive, load itself on to it and infect your RAM... the kicker is, when you restart your comp the RAM is erased and you boot under your normal HD.
Plus, i believe there are resource issues (i.e. enough RAM left to run the firewall after RAMdisk makes its partitions and you open an app. or two) that would restrict Steel from putting on in.
if you're still concerned about security just take pcuser's advice. I am personally behind a router's HW firewall and it keeps my mind at ease when i test/ use the project.
Branco
this is a legit concern when under a normal windows environment.. but while booted under The Project it isnt necessary (as far as i know).
the reason behind this is becuase your OS when booted under The Project is loaded into a virtual RAM drive which emulates the windows hive directory so well it even fools some apps (see: Ad-Aware, Spybot). Thus the virus or potential hacker will see this drive as your root drive, load itself on to it and infect your RAM... the kicker is, when you restart your comp the RAM is erased and you boot under your normal HD.
Plus, i believe there are resource issues (i.e. enough RAM left to run the firewall after RAMdisk makes its partitions and you open an app. or two) that would restrict Steel from putting on in.
if you're still concerned about security just take pcuser's advice. I am personally behind a router's HW firewall and it keeps my mind at ease when i test/ use the project.
Branco
Very valid question and great answers. I have thought about including a software firewall with the project. Maybe we need to start a poll about this?? Does anyone else think that a software firewall needs to be included for some people? I would also think that we would have to test it quite a bit to make sure there weren't any big performance issues with running different software firewalls.
GhostFirewall
This one is free and is very small. I can't see the point in bloating the project by putting zone alarm etc.... A firewall needs to be small and compact for the CD.
This one is free and is very small. I can't see the point in bloating the project by putting zone alarm etc.... A firewall needs to be small and compact for the CD.
Personally I see no need to have a FW in the CD. I use it on our corp network here even during virus storms. I have always been under the impression that no matter what infects the machine whilkst the CD is running that it gets removed on the next reboot. Also, I have always used it behind or corp and home routers. So I have always had that level of security. Doesn't the XP FW start with UBCD4Win? I have never botherd to check... I would think that it would... anyways...
Also... With UBCD, there is no default shares. You have to tell it to share something. Plus, does anyone really know what the admin password is? I found it once a while back but can't remember where. So to a h4x0r, your machine will come up as a WinXPSP2 box with no FW. So anything he tries will not get anything done as there is no shares and anything he can put on your system will be gone or neutralized next boot. Worst case is if the systems gets infected and if the virus is written with substandard code hard referencing c:\ as sysroot versus the common %systemroot% (c:\windows by default) or %systemdrive% (c:\ by default) then if it is written with the variables for the folders then it gets written to the RAM drive and erased next boot. It put on c:\ hard code then only the file is there on a boot and nothing else. So I think looking at it this way, there is no reason for concern with not having a FW on the CD. For normal OS usage, yes, by all means, secure yourself with layers of security. Always have an Administrator password that is longer than 8 characters that has a Cap, a lower, a number, and a special character, puot your self behind a router, have a antivirus, and perform weekly or daily virus and spyware scans. On the CD though... It is a recovery tool. I personally wouldn't worry to much about security of it. If you are scared about that then what you can do is not enable the network on boot. That will prevent your machine from being seen period. Even better than having a router, firewall, and anything else combined.
To sum up... I don't think we need a FW in the CD as that will bloat it that much more with no REAL benefit...
My 2 scents...
Also... With UBCD, there is no default shares. You have to tell it to share something. Plus, does anyone really know what the admin password is? I found it once a while back but can't remember where. So to a h4x0r, your machine will come up as a WinXPSP2 box with no FW. So anything he tries will not get anything done as there is no shares and anything he can put on your system will be gone or neutralized next boot. Worst case is if the systems gets infected and if the virus is written with substandard code hard referencing c:\ as sysroot versus the common %systemroot% (c:\windows by default) or %systemdrive% (c:\ by default) then if it is written with the variables for the folders then it gets written to the RAM drive and erased next boot. It put on c:\ hard code then only the file is there on a boot and nothing else. So I think looking at it this way, there is no reason for concern with not having a FW on the CD. For normal OS usage, yes, by all means, secure yourself with layers of security. Always have an Administrator password that is longer than 8 characters that has a Cap, a lower, a number, and a special character, puot your self behind a router, have a antivirus, and perform weekly or daily virus and spyware scans. On the CD though... It is a recovery tool. I personally wouldn't worry to much about security of it. If you are scared about that then what you can do is not enable the network on boot. That will prevent your machine from being seen period. Even better than having a router, firewall, and anything else combined.
To sum up... I don't think we need a FW in the CD as that will bloat it that much more with no REAL benefit...
My 2 scents...
QUOTE
Doesn't the XP FW start with UBCD4Win?
No ICF does not start with UBCD4win.
In many ways I say it would be nice to have the firewall for the protection. Is it needed or really a concern? NO. Just like we don't run live AV protection with the CD. As everyone here has commented that 80% of the malicious stuff would be lost on reboot and the other would be of no use because of no reference to run the file. The only issue I could possibly see is if someone gets an infection and that infection is hard coded for C: only. Forcing the infection to the C drive. Then the infection looks to C: put a run command in the Start Menu of all users. As the only possible way for an issue.
Yes the above is possible but very unlikely. Would it be nice to protect against this yes. But a firewall isn't your only protection needed then.
What I would like to see instead of a firewall is a tool (app) that would inform the user of all writes being made to the C: drive or drives you define and ask permission before performing these writes.
This would also be great for Steel's Forensic approach. Now does a tool or plugin already exist for this? I don't know of one but it sure would be sweet!
That is a excellent thought!! I wish I thought of that idea. Noiw as for the plugin... That s the $64K question.... One thing I would have to include in that idea though is not notice per write, per app would be more managable. If I do a recovery using a data recovery proggie... thousands of do I want this to... -=shudder=- anyways... I am sure that you mean for the app level and not per write.
(I have a tendancie to be a tad literal at times and take writing at face value... a deffect of mine...)
(I have a tendancie to be a tad literal at times and take writing at face value... a deffect of mine...)
QUOTE
per write
This is really what I meant.
Of course the app could have options. Like show which app is writing and a global settings to enable certain apps. Enable all writes, Disable all writes and Prompt for all writes. But at the base level I would like to be able to watch PER WRITE.
Of course now I'm designing something instead of looking at what is created already. (possibly nothing)
Ghost firewall is only about 300kb, so it's not going to bloat the project too much 
QUOTE
Ghost firewall is only about 300kb, so it's not going to bloat the project too much
Thats great do you have a plugin for this?
Many thanks everybody for your suggestions, I feel a lot happier now and I can explore the CD and familiarise myself with it so that when a problem arises, I will feel confident enough to use it properly.
I have been considering a H/W firewall, but have been so busy lately that I haven't had a chance to work my way through the specs.
The UBCD4Win is a wonderful bit of kit to have to hand, a bit like a fire extinguisher, great to have just in case!
Once again many thanks,
Especially to Steeltrepid and everyone else who has contributed to the Project.
Yours rather less nervously,
Snoopy
I have been considering a H/W firewall, but have been so busy lately that I haven't had a chance to work my way through the specs.
The UBCD4Win is a wonderful bit of kit to have to hand, a bit like a fire extinguisher, great to have just in case!
Once again many thanks,
Especially to Steeltrepid and everyone else who has contributed to the Project.
Yours rather less nervously,
Snoopy
If you have an old box in the closet/attic/garage; install SmoothWall, m0n0wall, or IPCop for maximum security.
It's better than spending money on a new router. They're cheap, but it's a good practice to repurpose old hardware instead of sending it to the landfill.
It's my opinion that you can't afford not to have a hardware router/firewall between you and the internet.
A router gives you much more flexibility and peace of mind.
Software firewalls can be disabled by malware!
Example 1: Trendmicro
Leo Laporte says, "Software firewalls are easily disabled by malware."
Bagle-AU disables XP firewall
Zotob takes out XP firewall
old article from pcpitstop; relavant info:
QUOTE(from pcpitstop)
Another Smoking Gun
Right now some of you are saying that we must be too paranoid, but here's proof that they really are out to get us--and you. This links to a posting from a Usenet group showing hackers how to block a list of antivirus help sites, including ours:
http://pcpitstop.com/tinylink.asp?attack1
This code is already part of some viruses and spyware. Many recent viruses, worms, and spyware also detect and disable antivirus, anti-spyware, or firewall software they find on a PC, so don't assume your PC can't become infected just because you have virus and spyware scanners installed. Treat every email attachment and downloaded file with care.
So, if you are connected to the net with only a software firewall, you may be very vulnerable and must be extremely cautious.Right now some of you are saying that we must be too paranoid, but here's proof that they really are out to get us--and you. This links to a posting from a Usenet group showing hackers how to block a list of antivirus help sites, including ours:
http://pcpitstop.com/tinylink.asp?attack1
This code is already part of some viruses and spyware. Many recent viruses, worms, and spyware also detect and disable antivirus, anti-spyware, or firewall software they find on a PC, so don't assume your PC can't become infected just because you have virus and spyware scanners installed. Treat every email attachment and downloaded file with care.
Just a few references concerning firewalls:
SmoothWall Express
...more on SmoothWall express
m0n0wall
IPCop
... one runs from CD, the other from a floppy
Sentry Firewall
FREESCO
other links:
Home PC Firewall Guide
Personal Firewall Reviews
Application Firewall
Wired Router Reviews
gov. security forum
Firewall (networking)
I've not got a plugin for it, but I'm certain it only needs a simply plugin to work.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GhostWall"="\"C:\\program files\\ghostwall\\ghostwall.exe\" -minimize"
However this reg key will need adding or edit the autorun.cmd file and the command to start the firewall it will look something like this "program files\ghostwall\ghostwall.exe" -minimize and put it in the autorun plugin folder.
I'm not certain how you would get it to load but I can't see it being that hard.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GhostWall"="\"C:\\program files\\ghostwall\\ghostwall.exe\" -minimize"
However this reg key will need adding or edit the autorun.cmd file and the command to start the firewall it will look something like this "program files\ghostwall\ghostwall.exe" -minimize and put it in the autorun plugin folder.
I'm not certain how you would get it to load but I can't see it being that hard.
Dirk beet me to it but was going to say if you wanted a Router without buying one and you have an old junker somewhere, nothing special just have 2 NIC's in it. Download the UBCD itself and on it is a one disk router software. I think it is the FREESCO but not sure. If your new "router" locxks up or needs a reset, just boot the CD back up and voila your router is back up! just a sugestion.
as for the file monitor mentioned above. There is already a clamav plugin for pe and with that you could use this:
http://sourceforge.net/project/shownotes.p...lease_id=359753
it does file monitoring and such. with on write access to both the registry and also to the hard drive. And if you have clamav installed it will actively monitor using clamav definition files.
Just a thought. I'm getting ready to try and put this stuff on my cd since all the other virus scanners have very restrictive license policies that make it really illegal to use them in my shop.
I have talked to many others also like lavasoft, webroot, acronis, esafe, etc. So if anybody would like to know their responce let me know.
http://sourceforge.net/project/shownotes.p...lease_id=359753
it does file monitoring and such. with on write access to both the registry and also to the hard drive. And if you have clamav installed it will actively monitor using clamav definition files.
Just a thought. I'm getting ready to try and put this stuff on my cd since all the other virus scanners have very restrictive license policies that make it really illegal to use them in my shop.
I have talked to many others also like lavasoft, webroot, acronis, esafe, etc. So if anybody would like to know their responce let me know.
QUOTE
file monitor
Yes Clamav could work for AV type things. I'm more thinking though complete write protection. This would be great for all sorts of things. It would also make users feel 100% safe when booting this project on someones else's PC knowing nothing will be written/modified to the HD without authorization.
I have been trying to look at the forensic sites for a utility but unable to find anything yet.
Yeah, the forensics stuff is going to be fun. I'm trying to organize my to-do list and prioritize everything. Other issues with the project have more priority, I feel since I have 20 more days until the presentation I have plenty of time to do more work for it. Hopefully there are some easy solutions out there, if not hopefully I can figure out a few things on my own.
um did you look at winpooch as I suggested. It is primarily exactly what you were asking about. If you have clamav installed it just so happens that it can also use clamav. Check it out I think you find it is more or less what you are looking for. Well if I understand correctly.
Sorry,
I didn't know you were pointing to a different app because the name winpooch wasn't mentioned in the orginal article. I thought this was a link to clamav.
YEs this looks like it maybe exactly what I'm discussing. I will get more into it real soon because this will be sweet if it works as they are suggesting.
I didn't know you were pointing to a different app because the name winpooch wasn't mentioned in the orginal article. I thought this was a link to clamav.
YEs this looks like it maybe exactly what I'm discussing. I will get more into it real soon because this will be sweet if it works as they are suggesting.
in next PE-Builder version 3.1.5 bart integrated a firewall / paketfilter.
this version is availiable in german computer magazin ct.
for firewall info see this:
http://samlin2004.myweb.hinet.net/docs/Fir..._on_windows.htm
inf file for firewall:
Joshua
this version is availiable in german computer magazin ct.
for firewall info see this:
http://samlin2004.myweb.hinet.net/docs/Fir..._on_windows.htm
inf file for firewall:
QUOTE
; PE Builder v3 plug-in INF file
; created by Bart
; 07/2005 mofifications for CT Magazin by Markus Debus - www.pecd.net - [email protected]
[Version]
Signature= "$Windows NT$"
[PEBuilder]
Name="APP: WIPFW Firewall"
Enable=1
[SourceDisksFiles]
files\autorun9wipf.cmd=2,,1
files\wip_fw.sys=4,,1
files\wipfw.exe=2,,1
files\wipfw.cmd=2,,1
files\wipfwoff.cmd=2,,1
files\wipfw.conf=2,,1
files\wipfwoff.conf=2,,1
files\protocol=17,,1 ; directory-id 17 is system32\drivers\etc
; Deps
ipfltdrv.sys=4
[Software.AddReg]
; Add to start menu
0x2,"Sherpya\XPEinit\StartMenu","Netzwerk\Paketfilter wipfw\Einschalten","%SystemRoot%\system32\wipfw.cmd||%SystemRoot%\system32\wipfw.exe"
0x2,"Sherpya\XPEinit\StartMenu","Netzwerk\Paketfilter wipfw\Ausschalten","%SystemRoot%\system32\wipfwoff.cmd||%SystemRoot%\system32\wipfw.exe"
0x2,"Sherpya\XPEinit\StartUp","WIPF Paketfilter","%SystemRoot%\system32\wipfw.cmd||%SystemRoot%\system32\wipfw.exe"
[SetupReg.AddReg]
[SetupReg.AddReg]
; Deps
[SetupReg.AddReg]
0x1,"ControlSet001\Services\IpFilterDriver","DisplayName","IP Filter"
0x1,"ControlSet001\Services\IpFilterDriver","Description","IP Filter"
0x7,"ControlSet001\Services\IpFilterDriver","DependOnGroup",
0x7,"ControlSet001\Services\IpFilterDriver","DependOnService","Tcpip"
0x4,"ControlSet001\Services\IpFilterDriver","ErrorControl",0x1
0x2,"ControlSet001\Services\IpFilterDriver","ImagePath","System32\drivers\ipfltdrv.sys"
0x4,"ControlSet001\Services\IpFilterDriver","Type",0x1
0x4,"ControlSet001\Services\IpFilterDriver","Start",0x3
[Append]
nu2menu.xml, wipfw_nu2menu.xml
; created by Bart
; 07/2005 mofifications for CT Magazin by Markus Debus - www.pecd.net - [email protected]
[Version]
Signature= "$Windows NT$"
[PEBuilder]
Name="APP: WIPFW Firewall"
Enable=1
[SourceDisksFiles]
files\autorun9wipf.cmd=2,,1
files\wip_fw.sys=4,,1
files\wipfw.exe=2,,1
files\wipfw.cmd=2,,1
files\wipfwoff.cmd=2,,1
files\wipfw.conf=2,,1
files\wipfwoff.conf=2,,1
files\protocol=17,,1 ; directory-id 17 is system32\drivers\etc
; Deps
ipfltdrv.sys=4
[Software.AddReg]
; Add to start menu
0x2,"Sherpya\XPEinit\StartMenu","Netzwerk\Paketfilter wipfw\Einschalten","%SystemRoot%\system32\wipfw.cmd||%SystemRoot%\system32\wipfw.exe"
0x2,"Sherpya\XPEinit\StartMenu","Netzwerk\Paketfilter wipfw\Ausschalten","%SystemRoot%\system32\wipfwoff.cmd||%SystemRoot%\system32\wipfw.exe"
0x2,"Sherpya\XPEinit\StartUp","WIPF Paketfilter","%SystemRoot%\system32\wipfw.cmd||%SystemRoot%\system32\wipfw.exe"
[SetupReg.AddReg]
[SetupReg.AddReg]
; Deps
[SetupReg.AddReg]
0x1,"ControlSet001\Services\IpFilterDriver","DisplayName","IP Filter"
0x1,"ControlSet001\Services\IpFilterDriver","Description","IP Filter"
0x7,"ControlSet001\Services\IpFilterDriver","DependOnGroup",
0x7,"ControlSet001\Services\IpFilterDriver","DependOnService","Tcpip"
0x4,"ControlSet001\Services\IpFilterDriver","ErrorControl",0x1
0x2,"ControlSet001\Services\IpFilterDriver","ImagePath","System32\drivers\ipfltdrv.sys"
0x4,"ControlSet001\Services\IpFilterDriver","Type",0x1
0x4,"ControlSet001\Services\IpFilterDriver","Start",0x3
[Append]
nu2menu.xml, wipfw_nu2menu.xml
Joshua
3.1.5 I can't wait for an English version, would love to check it out!!!
QUOTE(webmedic @ Sep 29 2005, 01:21 PM)
um did you look at winpooch as I suggested. It is primarily exactly what you were asking about. If you have clamav installed it just so happens that it can also use clamav. Check it out I think you find it is more or less what you are looking for. Well if I understand correctly.
No sorry I really had intentions to put winpooch in there. Oh well I hope it does what you are looking for.
I Go the Ghostwall firewall plugin to work, and added the fire*.fir in SYSTEM32, but when startibng the plugin i get the error " unable to load firewall friver " anyone know what is this about and how to rectify it. Regards./SAF
I am intrested in getting Ghostwall to work, I made a real simple plugin, but I am not that adept at plugins yet and anything needing reg entries etc. is beyond me. I too got the driver error you did.
Would you mind posting your code for the ini so we can hopefully get this Ghostwall going.
Thanks!
I Go the Ghostwall firewall plugin to work, and added the fire*.fir in SYSTEM32, but when startibng the plugin i get the error " unable to load firewall friver " anyone know what is this about and how to rectify it. Regards./SAF
Would you mind posting your code for the ini so we can hopefully get this Ghostwall going.
Thanks!
QUOTE(safger @ Oct 16 2005, 02:43 AM)
I Go the Ghostwall firewall plugin to work, and added the fire*.fir in SYSTEM32, but when startibng the plugin i get the error " unable to load firewall friver " anyone know what is this about and how to rectify it. Regards./SAF
This could possibly be something that we could work on. However, with beta versions of PE Builder including something similar and really the personal feeling that it isn't necessary....it might not happen. If anyone wants to work on this on their own time that would be nice. But like many others have said and I personally feel.....a firewall isn't necessary in a "preinstall" or temporary environment. Hacking and viruses picked up from surfing and placed in the ramdrive shouldn't be able to infect the HDD connected to the system. Unless of course virus authors started targeting PE CD's?? That would be difficult anyways.
Well I have been using and toying with this for some time and it is working great.
Winpooch as suggested by webmedic.
winpooch plugin
Please have a try and let me know what you think.
Notes:
I have updated the plugin to now include the newest version .5.9
Still only issue:
The CMD window to start Winpooch isn't closing and you get a Starting Winpooch at the bottom of the screen. Doesn't go away until you exit winpooch.
enjoy!
Winpooch as suggested by webmedic.
winpooch plugin
Please have a try and let me know what you think.
Notes:
I have updated the plugin to now include the newest version .5.9
Still only issue:
The CMD window to start Winpooch isn't closing and you get a Starting Winpooch at the bottom of the screen. Doesn't go away until you exit winpooch.
enjoy!
larson I fixed that and posted the updated version here:
ftp://ftp.ibiblio.org/pub/Linux/distribut...inux/PE/extras/
ftp://ftp.ibiblio.org/pub/Linux/distribut...inux/PE/extras/
Yeah, that's something I haven't really had the chance to test and play with yet. I do have the plugin downloaded, but really I thought this was more of a "forensics" type of tool. When more beta testing is done for other stuff in the project I will find time to test this more myself. Also from what I understand this really isn't a "firewall" type of application.
No in my eyes you don't need a firewall in PE. What you need is something to protect the hard drive of the pc you are loading on. A firewall is really not needed because anything that happens to the PE environment is erased once you reboot or shutdown but you still need to protect the harddrive of the machine you are on.
Winpooch does this. Really a firewall is a waste of resources and doesn't protect the harddrive.
Winpooch does this. Really a firewall is a waste of resources and doesn't protect the harddrive.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.