full-disclosure - Re: Bypassing Personal Firewall (Zone AlarmPro)Using DDE-IPC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1293732094.20051001173320@Sniff-em.com>
Date: Sat Oct  1 16:33:27 2005
From: Thierry at sniff-em.com (Thierry Zoller)
Subject: Re: Bypassing Personal Firewall (Zone
	AlarmPro)Using DDE-IPC

Dear Debasis,
DM> I tested this earlier, SendMessage() / SetDlgItem() / SetWindowText()
DM> doesn't work for the current version of ZA Products (ZA Pro / Internet Sec
DM> Suit).
I am not sure we are speaking about the same attack. When I was
speaking about SendMessage() I was refering to the presentation
at CCC2003, i.e shelling IE simulating a user through SendMessage()
Api.

DM> This helps preventing the most wellknown windows local attack - Shatter
DM> Attack.
AFAIK, it does not, the Shatter Attack doesn't necessarely rely on
SendMessage(), not to mention a driver shouldn't open a window at all
(not react to F1 messages either) <- if you read this and are a vendor
check for this.. gives SYSTEM rights occasionaly. (through
browse -> cmd.exe)

DM> However, I still can see a way out for their latest product... Will be
DM> updated soon.
Looking forward to it :)

-- 
Regards,
Thierry Zoller
mailto:Thierry@...ff-em.com