RE: HTTP based trojans

Yes, except that in Setiri, for example, the communication adheres to HTTP standards. It's not just a trojan using port 80 to slip through firewalls and IDS systems unnoticed; it actually uses Internet Explorer as a component of itself, so that even local app-aware firewalling like ZoneAlarm, Norton Internet Security or BlackIce won't see anything unusual.

> -----Original Message-----
> From: s.wun [mailto:s.wun@thales-is.com.hk]
> Sent: Wednesday, November 06, 2002 9:13 PM
> To: AQBARROS@BKB.com.br; focus-ids@securityfocus.com
Received on Thu Nov 7 17:30:56 2002