Firewall Leak Test / Simple Tool

It's a simple tool download that provides the user with a easy test to check their current firewall status, and if it can be penetrated from malicious code internally, by accessing servers and bypassing your firewall similiar to Trojans and other malware.

I would appreciate any feedback from members about their test. Unfortunately my firewall was penetrated, so I am trying to figure out the best settings for it, and any feedback would be great.

Source

Ensure that your PC's personal firewall can not be easily fooled by malicious "Trojan" programs or viruses. Thanks to this first version of LeakTest, most personal firewalls are now safe from such simple exploitation.

There are also other tools available to assess other security parameters such as port access and unwanted probing.

Edit: Also to add is another tool which turns off plug'n'play in all windows systems...

Source

As originally urged by the FBI, and still urged by prominent security experts, our UnPnP utility easily disables the dangerous, and almost always unnecessary, Universal Plug and Play service. If you don't need it, turn it off. (For ALL versions of Windows.)

Thanks...

reply to post by Daedal


This tool is 10 years old. Certainly nothing new.

Originally posted by PhoenixOD
reply to post by Daedal

 

This tool is 10 years old. Certainly nothing new.

edit on 24-1-2012 by PhoenixOD because: (no reason given)

Yes it is 10 years old..however they still work. I did a search on here and didn't find any subjects about it, so I thought I would share. My plug n play was most cetainly running, which offers a broad platform for any potential unwanted activity. Now it is off.

reply to post by Daedal


These were very handy tool back in the day but most were written for XP.

Some of the problems can be fixed on windows 7. To turn off upnp with widows 7 just switch off the Network Discovery service.

The leak test tool is still pretty current even today.

reply to post by Daedal


I have been following the results published by this site on and off for the better part of a decade. The results and the risks tested have changed dramatically in 10 years, and the #1 spot is not always the same firewall. However it's unusual for only one tested firewall to be recommended as is the case now. I don't use that exact product recommended in the #1 position, but I do use the Free Comodo 64 bit firewall:

www.matousec.com...

I don't really like it, but with XP64, I know of no other alternative than the Windows firewall which I know isn't secure enough for me. The problem with Comodo is it comes with probably over 10000 sites pre set-up to bypass the firewall. You can disable them but I tried starting to do this and there's no way to do them all at once. After a few hours I'd barely made a dent and gave up.

The approach by ZoneAlarm is much better to me where nothing is permitted by default, and you the user define the exceptions. This is too hard for some users, but it's what advanced users like myself prefer. Too bad ZA doesn't make anything for XP64.

Edit to add: Here is the security testing suite link provided by that site:
www.matousec.com...
But heed the warning and only run it on a special test PC, don't run it on any PC where you value your data:

Warning: This software is used for testing of security products and should never be used on production machines. Using this software may damage or erase your data. This software is provided "as is" and without warranty of any kind. More information about each test can be found in its source code file and in the shared source code files of the whole suite.

reply to post by Daedal


try the shields up, from the same site as your first link.
checks all your ports and tell you whats open or closed.

Shields Up

pay close attn to, file sharing, common ports, and all service ports

If you have any decent consumer grade router, you have a firewall built in. No need for a host-based (software) firewall unless you are on a local area network and can get attacked from the inside.

Otherwise, if you just surf at home, all you really need to do is password protect your router at it's web interface and disable UPnP within the router itself.

If you just have a modem and no router, then you should invest in a cheap router rather than use a software firewall. Skip the software firewall and get a good malware protection program.

Aslo, software firewalls for outbound protection are much a "security theatre" as they only provide superficial protection from the most simple malware programs. All a malware program has to do is add a new rule to the outbound firewall, or change your internet connection proxy settings... if it's already on your computer then it certainly has the rights to do that.

Also, typical web-browser processes are able to be hijacked by malware, which means they can perform user-context specific operations utilizing the process executable file - namely, sending data out port 80, which is always open. Malware can do exactly anything you have privilege to do on your system.

If a piece of malware can inject into say, the firefox process... it goes without saying that firefox can read your sensitive emails, bank account info, and so can the malware, and so it can send it out port 80 via that same process.

If you have any decent consumer grade router, you have a firewall built in. No need for a host-based (software) firewall unless you are on a local area network and can get attacked from the inside.

Otherwise, if you just surf at home, all you really need to do is password protect your router at it's web interface and disable UPnP within the router itself.

If you just have a modem and no router, then you should invest in a cheap router rather than use a software firewall. Skip the software firewall and get a good malware protection program.

Aslo, software firewalls for outbound protection are much a "security theatre" as they only provide superficial protection from the most simple malware programs. All a malware program has to do is add a new rule to the outbound firewall, or change your internet connection proxy settings... if it's already on your computer then it certainly has the rights to do that.

Also, typical web-browser processes are able to be hijacked by malware, which means they can perform user-context specific operations utilizing the process executable file - namely, sending data out port 80, which is always open. Malware can do exactly anything you have privilege to do on your system.

If a piece of malware can inject into say, the firefox process... it goes without saying that firefox can read your sensitive emails, bank account info, and so can the malware, and so it can send it out port 80 via that same process.