[Full-Disclosure] Bypassing Black Ice PC protection?

From: Curt Wilson (netw3_securityat_private)
Date: Mon Mar 10 2003 - 01:14:06 PST

  • Next message: Alex Lambert: "Re: new ddos client?"

    -----BEGIN PGP SIGNED MESSAGE-----
    
    
    Recently seen: what appears to be an attacker bypassing Black Ice PC protection through unknown methods.
    
    Windows 2000 pro, all service packs/hotfixes, legit install of Serv-U FTP server.
    
    Black Ice PC Protection,
    Product version 3.6.cbd
    blackice.exe version 3.6.32
    blackd.exe version 3.6.32
    blackdll.dll version 3.6.28
    BlackDrv.sys version 3.6.28
    iss-pam1.dll version 3.6.06
    
    From Serv-u FTP log file:
    
    [5] Sat 08Mar03 19:09:07 - (000008) Connected to 80.117.235.141 (Local address 192.xxx.x.x)
    [5] Sat 08Mar03 19:09:07 - Connection denied to IP-number 80.117.235.141
    
    host141-235.pool80117.interbusiness.it
    
    Black Ice is set to PARANOID and set to block all FTP access except specified IP ranges. This IP 80.117.235.141 is NOT included.
    
    Black Ice did generate an alert to indicate a block, 4 seconds earlier:
    
    Time, Event, Intruder, Count
    3/8/2003 7:09:03 PM, TCP_Probe_Ftp, 80.117.235.141, 1
    
    From attack-list.csv:
    
    Severity timestamp (GMT)issueId issueName intruderIp victimIp parameters count responseLevel intruderPort VictimPort packetFlags
    
    4 2003-03-09 01:09:03 2003004 TCP_Probe_Ftp 80.117.235.141 192.168.x.x port=21&reason=Firewalled 1 A 3392 21 0x22d06
    
    What did the attacker do 4 seconds later to bypass Black Ice? I don't see how Serv-U should have known about this persons IP if Black Ice was doing it's job. I see these FTP probes all the time but this is the first one that's actually appeared in my FTP server log. Unfortunately, I don't have the log*.enc file for more in-depth analysis.
    
    Any ideas, or inside information about a Black Ice bypass technique?
    
    Curt R. Wilson
    GSEC, GCFW, GEEK(!)
    Netw3 Security
    www.netw3.com
    -----BEGIN PGP SIGNATURE-----
    Version: Hush 2.2 (Java)
    Note: This signature can be verified at https://www.hushtools.com/verify
    
    wmMEARECACMFAj5sVo0cHG5ldHczX3NlY3VyaXR5QGh1c2htYWlsLmNvbQAKCRBGd/Yw
    aRH3KyBUAKCvs/rNMD/tz3ADUjoj3lEBovjLpwCcDalmOhw+ZC592NE2C0KjHR5QMyg=
    =UUnM
    -----END PGP SIGNATURE-----
    
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html
    



    This archive was generated by hypermail 2b30 : Mon Mar 10 2003 - 02:39:17 PST