RE: Bug in Norton FireWall 2003

> From: Boy Bear [mailto:eyal067@walla.co.il]
> Sent: Saturday, August 09, 2003 4:12 AM
>
>
> The Bug factor so lamb Firewall "ignored" from Trojan.

Ah, machine translation.

A cursory glance through the VB source [see original message] suggests that the proposed exploit is to have a trojan recognize the firewall pop-up asking if the trojan should be permitted network access, and spoofing the user input to grant it. Simple enough.

There appears to be a bug in the included source:

> Private Sub wHideShow(HideShow As Boolean)

Presumably one of "SW_SHOW" should be "SW_HIDE". Since wHideShow is never used by the program, and "HideShow" is not exactly a meaningful parameter name, it's hard to guess which. Then again, since wHideShow is never used, it doesn't really matter.

I suppose a simple defense for "personal firewall" vendors against this sort of thing would be to use hard-to-guess window titles for their popups...

-- 
Michael Wojcik
Principal Software Systems Developer, Micro Focus