BlackICE PC Protection (ISS) and Norton Anti-Virus
 

Hello,

I have installed Norton Anti-virus 2005 on my PC in July 2005, since that time I have noticed that my firewall BlackIce PC protection is not recording any more "attacks" (TCP or UDP or HTTP scans). I am worried that installing NAV 2005 may have disturbed my security settings and that my firewall is not working properly. How can I assess if the firewall is working properly?

I have read the docs provided with Norton Antivirus and it seems that they have now developed an Internet worm protection. Could it be that this is what is blocking some attacks before the firewall does?

thanks for your answers

Lionel

Re: BlackICE PC Protection (ISS) and Norton Anti-Virus
 

You can get a free scan from here https://www.grc.com/x/ne.dll?bh0bkyd2 it will tell you if you have ports open or if you are stealthed.

Regards.

Re: BlackICE PC Protection (ISS) and Norton Anti-Virus
 

Didn't much care for Nortons antivirus 2005, when I installed it, it turned off firewall by default, using its worm protection only.
Tried this link:
http://www.symantec.com/product/index_homecomp.html

Click on the box marked http://www.symantec.com/product/imag...vbar.clear.gif
http://www.symantec.com/product/imag...dard.en-us.gif

Re: BlackICE PC Protection (ISS) and Norton Anti-Virus
 

Congratulations ..... you seem to have installed two of the most vilified security programs (according to popular opinion) available !! :shocked:

I would seriously think about installing some of the more popular (and free) applications often suggested on these forums. :erm:

Re: BlackICE PC Protection (ISS) and Norton Anti-Virus
 

thank you guys

I did both of the tests.

the GRC was positive except that my PC responded to a PING.
the symantec gave that:
ICMP Ping

Ping. Ping is a network troubleshooting utility. It asks your computer to acknowledge its existence. If your computer responds positively to a ping, hackers are more likely to target your computer.




22

SSH. TCP connections to this port might indicate a search for SSH, which has a few exploitable features. SSH is a secure replacement for Telnet. The most common uses of SSH are to securely login and copy files from a server.




80

HTTP (Hypertext Transfer Protocol). HTTP is used to transfer Web pages over the Internet. Port 80 should be open only if you're running a Web server.



Any idea how I can correct these problems and make these ports stealth?

thanks
lionel

Re: BlackICE PC Protection (ISS) and Norton Anti-Virus
 

For what it's worth, BlackICE had a pretty poor reputation in the past, but then NetworkICE (the developers of BlackICE) was bought by Internet Security Solution (ISS) back in 2001, and it has vastly improved in popularity amongst security professionals since that acquisition.

I work in IT Security for a major high-street financial institution, and I know of many banks and financial organisations that use ISS tools ;)

In fact, ISS is one of the world's most reknowned security specialist companies. They specialise in enterprise-level solutions, such as Intrusion Prevention/Detection Systems, network-based firewalls, etc... and are damned good at what they do. Check here for SC Magazine's (the Security Industry's trade magazine) review of RealSecure. Admittedly, it's not a review of BlackICE, but RealSecure got a five-star review, and not many products get such an accolade from SC Magazine.

Incidentally, you may have heard of the recent presentation that Michael Lynn gave at this year's Black Hat Conference detailing the flaw in Cisco's IOS that could bring the backbone of the web to it's knees... well, Lynn worked for ISS until the morning of his presentation (whereby he resigned to give the presentation without causing liability to ISS).

Unless your budget can stretch to the ISS RealSecure Desktop Protector then you can't get much better than BlackIce.

As to your question of disabling ping, ssh and http ports... erm, I'm afraid I don't actually use BlackICE so I don't know how to do it :blush: but as it would use a 'default deny' policy, I'd have thought that there is a program that has been granted access on these ports, so check to see where you can modify the program access control list (or some similar option). If you get really stuck, then I could always install it and have a look for you :)

Re: BlackICE PC Protection (ISS) and Norton Anti-Virus
 

I currently have McAfee Firewall and VirusScan Online installed, and I have a Linksys BEFSR81 router - I got that in order to share the Internet connection between my PC and laptop, though it comes in very handy if I want to share, copy or back up files, as I now effectively have a LAN. I leave the PC connected to it whether I'm using the laptop or not; there's really no point in constantly unplugging it and plugging it back in again.

I've just tried the All Service Ports and Common Ports tests - and got a perfect rating! Whether that's due to McAfee, the router or both, I neither know nor care; that sort of news is always welcome. Let's hear it for NAT! :D

Re: BlackICE PC Protection (ISS) and Norton Anti-Virus
 

This should help, ensure you have Adobe reader (PDF) installed first though, if not got to: www.adobe.com
and click on adobe reader and download, then click on this:

http://www.cogeco.com/files/pdf/inte...User_Guide.pdf