HP SuperStack Firewall Series Instrukcja Użytkownika Pobierz pdf (Strona 177)

Trojan Horse Attacks 177

Port Scanning Port Scanning is the testing of ports to see which are active and which are

disabled. Although ports are scanned as part of normal traffic the

scanning of many ports in a short period of time is a common precursor

to an attack

Firewall Response: None - the Firewall will allow port scanning but

will log all port scans to aid diagnosis. Ports not in use will be disabled by

the Firewall.

IP Spoofing IP Spoofing is a method of masking the identity of an intrusion by making

it appear that the traffic came from a different computer. This is used by

intruders to keep their anonymity and can be used in a Denial of Service

attack.

Firewall Response: The Firewall will drop any spoofed packets log the

event and alert the administrator.

Troja n Hor s e

Attacks

Troja n Hor se attacks rely on a piece of software installed within your

network prior to the attack. Attacks vary in severity and effect from

showing messages on screen or crashing an individual PC to theft of

information and infiltration of the network.

The Firewall blocks attacks in two ways:

■

Known Troj an Ho rse attacks are identified and blocked.

■

Ports not in use are blocked by default.

Troja n Hor se attacks that the firewall is capable of blocking include:

Back Orifice, ini killer, NetBus, NetSpy, Priority, Ripper, Senna Spy, Striker,

and SubSeven.

Using an anti-virus tool and updating the firmware of your Firewall as

soon as a new version is available will significantly increase your chance

of resisting a Trojan Horse attack.

DUA1611-0AAA02.book Page 177 Thursday, August 2, 2001 4:01 PM

1 2 ... 172 173 174 175 176 177 178 179 180 181 182 ... 213 214

Brak uwag

HP SuperStack Firewall Series Instrukcja Użytkownika Strona 177