App Review Bypass Firewall kaspersky 2017

[aliali]

Bypass Firewall kaspersky 2017 final


video:



psiophon



video 3 low restriced freegate



video4: interactive mod

 

[Der.Reisende]

Video is set to private, therefore not viewable.

EDIT: Thank you for fixing!

 

[Wave]

According to YouTube the video is set to private so I cannot view it.

Spoiler: Image

https://snag.gy/NdTAHD.jpg

If you don't mind me asking, what is the purpose/scope of the vulnerability (as in what does the bypass actually result in, e.g. execute malware and perform actions without triggering the protection, bypass self-protection to terminate Kaspersky Firewall from memory, privilege escalation, etc)?

 

[omidomi]

I can't see video , plz make it public

 

[DardiM]

Thanks for the video

The method used to bypass KSI firewall, were used with KIS activated ? (I mean before the other progs are used, on the video)

 

[omidomi]

Thanks for the video

The method uses to bypass KSI firewall, were used with KIS activated ?

can you see the video?
btw: plz explain it

 

[DardiM]

can you see the video?
btw: plz explain it

try here :

https://www.youtube.com/watch?v=D6N7Wt9Nbi4

 

[omidomi]

try here :

https://www.youtube.com/watch?v=D6N7Wt9Nbi4

thanks I see this picture here:

Great that link work well.
@harlan4096

 

[hjlbx]

Report it; Kaspersky will fix it...

 

[Evjl's Rain]

as far as I know, if the program is already executed before being blocked by kaspersky firewall or application control it is not applied yet. The rule is applied after you turn the app off and open it again

I tried to block iobit advanced system care service using app control when it was running in background but the service was still running without being killed. Then manually killed the service and then I wouldnt be able to execute anymore

 

[DardiM]

as far as I know, if the program is already executed before being blocked by kaspersky firewall or application control it is not applied yet. The rule is applied after you turn the app off and open it again

I tried to block iobit advanced system care service using app control when it was running in background but the service was still running without being killed. Then manually killed the service and then I wouldnt be able to execute anymore

Yes, it would be interesting to see the same bypass without the prog already in memory
and without "resume" used.

I made a test with ZAM already running.

- I run a Deep scan
- I selected deny during the scan
=> cloud blocked : "No internet connection" (no need to quit and run again)
​

So the bypass seems to be working, by using the Freegate + proxy and the IDE on "pause"
(no other stuff)

A lot of steps have to be done manually, curious to see if a malware can do that without KIS blocking

 

[aliali]

edit post 1

update video

 

[DardiM]

edit post 1

update video

Thanks for this video update

Have you already reported this issue to Kaspersky ?

 

[aliali]

Thanks for this video update

Have you already reported this issue to Kaspersky ?

Yes 4 years ago

kis 2013/14 /15/16/17 ==>>bypass

Kaspersky Endpoint Security== pass

 

[hjlbx]

Yes 4 years ago

kis 2013/14 /15/16/17 ==>>bypass

Kaspersky Endpoint Security== pass

Ask @harlan4096 for assistance in submitting the bug; he is very long-time Kaspersky beta tester\forum member and - I would assume after all these years - has forged contacts with Kaspersky staff.

I have found that a lot of time bugs get reported, but for whatever reason(s) they don't get put onto the "To Do" list because the report is never brought the attention of the person(s) managing the "To Do" list...

 

[DardiM]

@omidomi wrote @harlan4096 on a post above, and @hjlbx (and me now )
I think as soon he will see the alerts (and thread & video), he will contact Kaspesky

 

[harlan4096]

I'm going to report it to KL... also, could You test it again but previously going to Settings and selecting -> Additional -> NetWork -> Monitored ports -> Monitor all network ports...

 

[aliali]

I'm going to report it to KL... also, could You test it again but previously going to Settings and selecting -> Additional -> NetWork -> Monitored ports -> Monitor all network ports...

harlan4096 thanks

update video

 

[uncle bill]

Am I the only one to think that there's absolutely no problem? The connection are made by psiphon which is trusted... so, is there really a problem?

 

[DardiM]

Am I the only one to think that there's absolutely no problem? The connection are made by psiphon which is trusted... so, is there really a problem?

It was only on the last update video, the use of psiphon (I just watched it), after @harlan4096 asked for "Monitor all network ports"