Operation Manual

Appendix C: Penetration Techniques
98
the legitimate actions. However, in those command-line parameters some piece of private
or critical data may be contained, along with the host name as a target recipient of
thereof. The example of using such technique is Wallbreaker leaktest
(
http://www.firewallleaktester.com/leaktest11.htm).
Outpost Firewall Pro provides the restricted list of processes that are allowed to start
default browser with command line parameters protecting your browser against tampering.
Beyond traditional browsers, command-line launch control applies to all network-enabled
applications which are present in the configuration.
Critical registry entry modification
Malicious processes can modify registry to get network access on behalf of other
application, for example, Windows Explorer. The example of using this technique is
Jumper leaktest (
http://www.firewallleaktester.com/leaktest17.htm).
These attempts are controlled by Outpost Firewall Pro . This proactive capability offers to
select whether you want to allow embedding an object into a certain area of the registry.
OLE application control
A relatively new technique to control applications' activity through the OLE mechanism (a
short form of Object Linking and Embedding command) - a Windows' mechanism which
allows one program to manage the behavior of another program on the computer. It uses
the technique of OLE intercommunication to exchange data and commands between
applications, for example, to manage activity of the Internet Explorer web browser so that
it can send user-specified data to the remote location. The example of using this technique
is PCFlank leaktest (
http://www.pcflank.com/PCFlankLeaktest.exe).
Outpost Firewall Pro detects an OLE communication and prompts a user whether it is
normal for the application to control other application's activity.
Process memory modification
Several Trojan horses and viruses use sophisticated techniques that let them alter the code
of trusted applications running in memory and thereby bypass the system security
perimeter and perform their malicious activities. This is also known as code injection or
copycat vulnerability. The examples of using this technique are Thermite and Copycat
leaktests (
http://www.firewallleaktester.com/leaktest8.htm,
http://www.firewallleaktester.com/leaktest9.htm).
Outpost Firewall Pro enables you to control the functions that can be used to write
malicious code into trusted application address space and so prevent a rogue process from
injecting their code into trusted processes. The entire memory space used by any active
application on a computer is scrutinized by Outpost Firewall Pro (not just that of a
network-enabled application). In case of malware trying to modify any legitimate