3Com 3C16111 - SuperStack 3 Firewall Web Site Filter, User Manual

Page: 177 / 214

Trojan Horse Attacks 177
Port Scanning Port Scanning is the testing of ports to see which are active and which are
disabled. Although ports are scanned as part of normal traffic the
scanning of many ports in a short period of time is a common precursor
to an attack
Firewall Response: None - the Firewall will allow port scanning but
will log all port scans to aid diagnosis. Ports not in use will be disabled by
the Firewall.
IP Spoofing IP Spoofing is a method of masking the identity of an intrusion by making
it appear that the traffic came from a different computer. This is used by
intruders to keep their anonymity and can be used in a
Denial of Service
attack.
Firewall Response: The Firewall will drop any spoofed packets log the
event and alert the administrator.
Trojan Horse
Attacks
Trojan Horse attacks rely on a piece of software installed within your
network prior to the attack. Attacks vary in severity and effect from
showing messages on screen or crashing an individual PC to theft of
information and infiltration of the network.
The Firewall blocks attacks in two ways:
■
Known Trojan Horse attacks are identified and blocked.
■
Ports not in use are blocked by default.
Trojan Horse attacks that the firewall is capable of blocking include:
Back Orifice, ini killer, NetBus , NetSpy , Priority , Ripper , Senna Spy , Striker,
and SubSeven .
Using an anti-virus tool and updating the firmware of your Firewall as
soon as a new version is available will significantly increase your chance
of resisting a Trojan Horse attack.
DUA1611-0AAA02.book Page 177 Thursday, August 2, 2001 4:01 PM