Re: [SLUG] Firewall MD5 signatures on processes

[Rob B]

At 23:49 29/01/2003, Matt M sent this up the stick:

And totally unimplementable on a machine where the same binaries can have
different MD5 sums across different installations, e.g. the one you all are
(most likely) reading this mail on now.

Unless the MD5 sums table is build when you install the machine/software or configure the feature.

Correctamundo!

Y'all should remember, these Windows "firewalls" are designed to be installed on a single machine (hence the term "personal firewall") and - while they will work on a box acting as a gateway - they will only verify MD5 sums of local software. So in effect, these apps combine a bit of Tripwire/Aide with a packet filter.

Unix software rule: Do one thing, and do it well
Windows sofware rule: Do everything

cheers,
Rob
:)


--
Create your own opportunity. Blackmail a senior executive.

This is random quote 419 of a collection of 1273

Distance from the centre of the brewing universe:
[15200.8 km (8207.8 mi), 262.8 deg](Apparent) Rennerian

Public Key fingerprint = 6219 33BD A37B 368D 29F5 19FB 945D C4D7 1F66 D9C5

--
SLUG - Sydney Linux User's Group - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug