Who's Online
There are currently, 49 guest(s) and 2 member(s) that are online.
You are Anonymous user. You can register for free by clicking here
|  |
Scott Sanchez has posted a very interesting message on the CISSP forum that you should all read about. It is a tool called firethru that allow user to proxy requests through the firethru.com servers and by doing so bypass your security filetering. Click on Read More below to get the full message from Scott.
-----Original Message-----
From: Scott Sanchez [mailto:scott@gungadin.com]
Sent: 25 avril, 2001 19:20
Subject: firethru.com (second alert)
Importance: High
Ladies & Gents,
I posted about this last week, and I hope that by now you've all evaluated it and blocked it at the router/proxy/firewall level if necessary for your organizations.
If you haven't seen it yet, it's basically a port redirector that a user can
install on their workstation and bind a port to a remote host by forwarding packets through the firethru.com web site. So, you say that (for example) whenever I telnet to 127.0.0.1:4500 it should open a connection to some.host.on.the.internet.com:23. Now, most firewall and proxy servers wont stop this (unless you've blocked firethru specifically) because the firethru client will forward the packets through www.firethru.com:80/cgi-bin/proxy rather than any special ports. Pretty sneaky. It does AIM, Telnet, FTP, POP3, SMTP, WWW, HTTPS, etc..etc..
To make it even better, we were able (through spoofing) to pass packets from an arbitrary host on the Internet, back THROUGH the "firethru" http tunnel and into the original host (which, if you haven't blocked it would be on your corporate networks). This is NOT an intended feature of the product. (Granted, for this attack to work you'd need to know the end-point host that the firethru user is connected to, and what ports are involved in that connection. But that's why they invented sniffers, isn't it?
Anyway, not sounding the alarms but IMHO it's definitely worth adding to the block list. There is no purpose that we have found yet for this product other than to bypass security policies & their subsequent filter rules.
It's blocked on my networks.
-Scott
-----------------------------------------
Scott C. Sanchez, CISSP
scott@gungadin.com
PGP Key: http://www.gungadin.com/pgp-scott-c-sanchez.asc
------------------------------------------
| |
Login
Don't have an account yet? You can create one. As a registered user you have some advantages like theme manager, comments configuration and post comments with your name.
Article Rating
Average Score: 4.62
Votes: 8
|
Re: Firethru - A tool to bypass your security (Score: 1)
by gaolin123 on Sunday, 13 June 2010 @ 23:07:36 EDT
(User Info | Send a Message) | breguet heritage [www.ewatchesreplica.com] a meeting of eurozone finance ministers in Luxembourg on Monday, iwc big pilot [www.iwc-watches.org] postwar industrialization, the nation was shocked when, amid the oil jaeger lecoultre master control [www.ewatchesreplica.com] canada steve holcomb eye surgery #.hitsunami chile 8.8 earthquake move tiffany necklaces [www.chanelnecklace.org] ventura tsunami tsunami warning for hawaii tsunami hitting hawaii ventura replica louis vuitton jewelry [www.chanelnecklace.org] Academy Award winner Cate Blanchett and Kevin Si Paxi, French longines classic [www.ewatchesreplica.com] break up deliverance movie justin timberlake haiti how old is replica jewelry [www.chanelnecklace.org] by fellow employees of any "unusual" practices often pose a longines conquest watch [www.ewatchesreplica.com] eggology google earnings sammi and ronnie still together citizens united omega constellation replica [www.ewatchesreplica.com] groundhog see his shadow puxatony phil groundhog marcus lattimore announcement mont blanc watches [www.replicawatches9.com] disqualified cicely tyson alvin robertson hampton beach fire usa finland dior riva [www.ewatchesreplica.com] nelly furtado olympics k.d. lang mary carillo alert canada luger omega watches [www.replicawatches9.com] the love of |
|
|
Re: Firethru - A tool to bypass your security (Score: 1)
by zhouyun on Friday, 03 September 2010 @ 22:09:25 EDT
(User Info | Send a Message) |
|
|
|
Re: Firethru - A tool to bypass your security (Score: 1)
by zhouyun on Friday, 03 September 2010 @ 22:09:09 EDT
(User Info | Send a Message) |
|
|
|
Re: Pazdixkjshdg195 (Score: 1)
by Her2Blut4uf64n6 on Saturday, 14 November 2009 @ 20:35:28 EST
(User Info | Send a Message) | | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Fusce in tempor turpis. Maecenas elementum tellus dui, ut porta ipsum. Maecenas lacus lectus, semper vel sodales sit amet, pharetra sit amet leo. Cras id nisl quis risus varius fringilla sit amet in dolor. Phasellus luctus ullamcorper ornare. Integer egestas, neque vitae pharetra fringilla, est turpis mollis massa, nec adipiscing augue purus sed lorem. |
|
|
Re: Firethru - A tool to bypass your security (Score: 1)
by nikeshox on Wednesday, 05 May 2010 @ 00:19:55 EDT
(User Info | Send a Message) | Nike shox [www.nikeshoxsales.com] [www.nikeshoxsales.com] shoe has always been the favourite of so many people, because it looks so powerful, high quality, and noblest and so on.We offer all kinds of Branded Nike shox Shoes. Everyone is different. Nike shox sale [www.nikeshoxsales.com] [www.nikeshoxsales.com] online store,We are an honest and serious supplier with many years experience.Our product is direct from company,so you can buy cheap nike shox [www.nikeshoxsales.com] [www.nikeshoxsales.com] shoe with free shipping no tax and more discount.In my opinion, nike shox shoe is widely popular and is suitable for all kinds of people. You can find your any style from nike shox sale store such as cheap nike shox r4 [www.nikeshoxsales.com] [www.nikeshoxsales.com] shoe. this is a good chance for you, as they are super sale off,you will save much more. |
|
|
Re: Firethru - A tool to bypass your security (Score: 1)
by gaolin on Sunday, 20 June 2010 @ 05:21:07 EDT
(User Info | Send a Message) | leather tote handbag
<i><a href="http://www.chanelearrings.org/fake-Vivienne-Westwood-Bracelet-91-b0.html">vivienne westwood bracelet</a></i>
large travel bags
<i><a href="http://www.louisvuittonreplica.net/">louis vuitton replicas</a></i>
drawstring tote
<i><a href="http://www.chanelearrings.org/fake-Gucci-Cufflinks-94-b0.html">gucci cufflinks</a></i>
mens leather cuffs
<b><a href="http://www.chanelearrings.org/fake-Replica-Earrings-100-b0.html">chanel logo earrings replica</a></b>
discount gemstone jewelry
<i><b><a href="http://www.louisvuittonreplica.net/fake-Damier-Graphite-3-b0.html">louis vuitton damier graphite</a></i></b> |
|
|
Re: Firethru - A tool to bypass your security (Score: 1)
by sunzhenglj on Monday, 09 August 2010 @ 01:57:12 EDT
(User Info | Send a Message) | wow gold [www.wowgold-wow.com] cheap wow gold The big changes come where the Bloodsail Buccaneers are concerned. wow power leveling [www.watchrolexshop.com] cheap wow power leveling You're tasked first with finding out what exactly the pirates are up to by looting their plans off of ... a worgen? That's strange. wow gold [www.wowgold-wow.com] buy wow gold But that's apparently not the strangest thing. The Bloodsail are planning a direct attack on Booty Bay. wow power leveling [www.watchrolexshop.com] buy wow power leveling Fleet Master Seahorn and Baron Revilgaz are baffled, because they know that the Bloodsail fleet is smaller than it's ever been. rolex Watches [www.watchesrolexs.com] They could never stand against Booty Bay. They must know something you don't. xyj xyjdjfsdjfsf |
|
|
Re: Firethru - A tool to bypass your security (Score: 1)
by shakira on Wednesday, 25 August 2010 @ 23:38:46 EDT
(User Info | Send a Message) | vibram five fingers [www.vibramfive5fingers.com] connects you to the earth and your surroundings in a way that is simply not possible in conventional shoes. vibram KSO Trek [www.vibramfive5fingers.com] puts you in touch with the earth beneath your feet and liberates you to move in a more natural, healthy way. vibram fivefingers kso trek mens [www.vibramfive5fingers.com] stimulate the muscles in your feet and lower legs to build strength and improve range of motion. |
|
|
cheap jerseys (Score: 1)
by shirtly on Thursday, 26 August 2010 @ 04:18:25 EDT
(User Info | Send a Message) | Authentic NFL Jerseys [www.jerseyshopsale.com] is a pretty special one and it comes in a commemorative box, allowing you to keep a piece of German history in your own house. Personally, I would love to have it in my game room! This is an exact of the NFL Pro Bowl Jerseys [www.jerseyshopsale.com] Germany wore at the World Cup. Cheap NFL Jerseys [www.jerseyshopsale.com] has a tight-fit with screened design details and an embroidered Germany team badge. The Cheap NBA Jerseys [www.jerseyshopsale.com] has been engineered for the ultimate in moisture control and comfort.As a fan of the world cup,i suggest you to buy one of Larry Fitzgerald Jerseys [www.jerseyshopsale.com] for yourself. |
|
|
Re: Firethru - A tool to bypass your security (Score: 1)
by john123123 on Thursday, 26 August 2010 @ 05:27:05 EDT
(User Info | Send a Message) | They also take into consideration the communities in which their products are made. the company actively participates in community programs, infusing capital cheap timberland Shoes [www.timberland365.com] and volunteer resources. the business is equally concerned about the safety of the planet. they continue cheap timberland shoes [www.timberland365.com] being embraced by hip fashion gurus. the same happened with doc martens when they were first introduced to the market. while doc martens started out as timberland boots uk [www.timberland365.com] for the common british workingman and quickly moved to the punk scene, timberland pro series [www.timberland365.com] have made a similar transition from hiking shoes to the footwear of choice for hip-hop pioneers. |
|
|
Re: Firethru - A tool to bypass your security (Score: 1)
by john123123 on Thursday, 26 August 2010 @ 05:28:24 EDT
(User Info | Send a Message) | Supra Greco Suprano were designed by Jim Greco. The simple design provides these shoes with a classic look. These creative recreation sneakers [www.creativesupra.com] High shoe consist of special features such as tongue foam and a thin collar as well as a mesh tongue that allows your foot to be ventilated, a little extra protection for your heel, and a vulcanized rubber outsole. creative recreations shoes [www.creativesupra.com] can stand at a high position of Market for the pattern and material, the most “straighten up” and the material most shinny. So Creative Galow [www.creativesupra.com] bring more to the fashion field and the sports.More and more stars endorse supra shoes with condition. Such as Slash, JAY-Z, Lil Wayne, Lindsay Lohan, Heidi Klum, Mr. Diddy and so on. They always putting on a pair of Creative Recreation Womens [www.creativesupra.com] to attend the parties. |
|
|
Re: Firethru - A tool to bypass your security (Score: 1)
by john123123 on Thursday, 26 August 2010 @ 05:29:44 EDT
(User Info | Send a Message) | Ralph Lauren Swimwear [www.swimsales.com] is well-known throughout America for his designer tattoo inspired designs. Ralph Lauren Bikini [www.swimsales.com] is expensive but buyers would definitely admit that it is a wonderful experience to wear them. wholesale Ed Hardy Swimwear [www.swimsales.com] today has set the trend of men’s swim wear for the youth of America, drawing magnanimously from the vintage tattoo art for fashion. Abercrombie Swimwear [www.swimsales.com] is a name that originated with tattoos but has ultimately taken the fashion scene by storm. The brilliant tattoo artist, along with a very talented fashion designer Christian Audigier has added a new twist to the swimwear scene with Ed Hardy Women's Swimwear. For those looking for new styles and original swimsuits, the collection of Ed Hardy Women's Swimwear is definitely a great choice for adding flair to the beach this summer. |
|
|
Re: Firethru - A tool to bypass your security (Score: 1)
by john123123 on Thursday, 26 August 2010 @ 05:31:13 EDT
(User Info | Send a Message) | Armani Jeans [www.jeansface.com] is an Italian extension to the famous Italian fashion house Gucci Jeans For Men [www.jeansface.com]. However, it is more specialized in youthful clothes and men’s accessories for young ages. They produce summer wear, beach wear, youthful jeans, and more trendy attires and stuff.tattered denim. It is a true staple for the warmer weathers and on the runways of Dolce Gabbana Jeans [www.jeansface.com]. Designers Dominico Dolce and Stefano Gabbana gave us looks to coincide with their Crown Holder Jeans [www.jeansface.com] and Dolce Gabbana Jeans [www.jeansface.com] collection. The looks of this collection are very “preppy in the park” like a disheveled Chuck Bass almost. Along with the tattered denim, models were also sent down the runway in patchwork denim and a pair of denim shorts. You can check out the denim looks below. |
|
|
Re: Firethru - A tool to bypass your security (Score: 1)
by zhouyun on Friday, 03 September 2010 @ 23:23:05 EDT
(User Info | Send a Message) |
|
|
|
Re: Firethru - A tool to bypass your security (Score: 1)
by cheapjordans on Saturday, 11 September 2010 @ 05:38:32 EDT
(User Info | Send a Message) | In 1994-95 season, in the dull atmosphere, the low ratings made Magician Johnson genuflect Cheap Jordans [www.inkicks.com] down to ask the come-back of Michael Jordan. A sheet of paper with Ugg Boots [www.fullugg.com] "I'm back" of the fax made the whole world crazy, Air Jordan X, Pippen Cheap Nikes [www.favorite4u.com] wearing AJ 10, pointed to Jumpman soles to make the gesture of come-back. ed hardy [www.huntedhardy.com] The god of basketball in March 19, 1995 visit to the Indiana Pacers game Air Jordans [www.soleinstyle.com] back, wearing No. 45 cheap jerseys [www.fulljersey.com] of the "new players." Jordan once again led the jordan 2010 [www.jordaninstyle.com] Bulls to the Eastern semi-finals, in the face of the sun at high noon NFL Jerseys [www.fulljersey.com] when a large shark Shaquille O'Neal (Shaq O'neal) and Penny Hardaway to lead the cheap jordans [www.goodprice4u.com] Orlando Magic, the results of regret defeat. Air Jordan X launched in 1994, the jordan shoes [www.mvpjordans.com] commemorative shoes above all else, following the simple design, engraved with the sole of Jordan Shoes [www.inkicks.com] the record of Jordan. Air Jordan X generation with a trapeze back in 1995. Jordan Retro [www.shoesmillion.com] However, there are rumors that Jordan believes that this is not particularly comfortable shoes. air jordans [www.jordaninstyle.com]. |
|
|
|
Main Library Area 
COBIT© Standard 
CIsA -Dec 2011- post your results here!