Operation Manual

Appendix C: Penetration Techniques

Here the point is program interactivity through the SendMessage, PostMessage API, and so

on. This technique is sometimes used for legitimate inter-process interactivity, but can

likewise be used for nefarious purposes by perpetrators.

Outpost Firewall Pro controls such attempts.

Active Desktop modification

Installing the specific HTML file for Active Desktop, malicious processes can transfer

private data on behalf of Windows Explorer. The example of using this technique is

Breakout leaktest (

http://www.firewallleaktester.com/leaktest16.htm).

Outpost Firewall Pro controls such attempts to steal data by bamboozling the firewall.

DNS query submission

DNS Client service contains potential vulnerability called DNS tunneling. The main point

is that malicious code can transfer and receive any information using correct DNS packets

to the correctly configured operating DNS server. The example of using this technique is

DNSTester leaktest (http://www.klake.org/~jt/dnshell/).

Outpost Firewall Pro performs double verification of access to the DNS Client service,

providing a more secure system. This enables control access to DNS API even with the

DNS Client service on, benefiting users who, out of compatibility concerns, cannot disable

this service themselves. This functionality allows assigning permissions to a specific

process for using the DNS Client service.

Application launch with URL

Malicious processes can launch the default web browser with a pre-configured web address

in a hidden window, making the firewall believe a legitimate action is taking place.

Firewalls that explicitly trust an application without looking beyond on who actually

launched it in the first place and what additional connection parameters are supplied are

unable to challenge the technique, meaning sensitive data could leave the computer past

them. The examples of using this technique are Tooleaky and Ghost leak tests

(

http://www.firewallleak tester.com/leak test2.htm, http://www.firewallleak tester.com/leak

test13.htm).

Outpost Firewall Pro watches every program started on a computer and controls who has

the permission to start a program with a target URL and will prompt a user if such activity

should be permitted for a particular program.

Application launch with command line parameters

Several firewalls are exposed to a vulnerability of a predatory code launching the default

web browser with command-line parameters, allowing to circumvent the existing

protection because the firewall is made to believe the legitimate application is performing