Stealth port features of Firewalls

[Deleted member 178]

Block incoming connections is not the same as Stealth Ports. Stealth Ports is a port scanning countermeasure. You must enable Stealth Ports on Firewall - Tasks pane...

it is a placebo stuff in fact, why?

i know your IP , im not dumb , and i know common port adresses , i scanport you, i saw the usual port blocked (i dont received my packets back) , i know you are stealthing them with a 3rd party FW, i will just use another way to bypass it...

 

[Online_Sword]

i saw the usual port blocked (i dont received my packets back) , i know you are stealthing them with a 3rd party FW, i will just use another way to bypass it

I think it is quite difficult to defend hackers with a strong desire to attack a specific and particular target.
But I think many hackers might not have a fixed target.
When they find that they cannot receive the packets back, they may think that the target machine is just shut down.
In order to save time, they may stop to find another target, then we are saved...

 

[Deleted member 178]

When they find that they cannot receive the packets back, they may think that the target machine is just shut down.
In order to save time, they may stop to find another target, then we are saved...

unfortunately, pinging a machine offline will send back reply saying the host is unreachable... no reply = stealth

found this article that will gives more details

Asimple "ping" from the attacker travels through the cloud, and to the router in front of your firewall. Next, the echo request gets to your firewall. A stealth firewall will simply drop the echo request, and no reply is sent back to the attackers' computer. So, you're invisible, right? Since there's no reply, there's no computer there, right? Wrong and wrong! If there really was no computer (or firewall) there, the router sitting in front would reply for you with a simple ICMP "host unreachable" message back to the attacker. The attacker would then know that there really is nothing there. The lack of this "host unreachable" message is a clear indication that something is there and it's dropping the packets rather than replying to them.

source

 

[hjlbx]

it is a placebo stuff in fact, why?

i know your IP , im not dumb , and i know common port adresses , i scanport you, i saw the usual port blocked (i dont received my packets back) , i know you are stealthing them with a 3rd party FW, i will just use another way to bypass it...

If you are targeted, as typical home user, there is little you can do.

If hacker wants my $2, they can have it by knocking on the front door... I will give it to them. Much less work for them...

 

[CMLew]

If you are targeted, as typical home user, there is little you can do.

If hacker wants my $2, they can have it by knocking on the front door... I will give it to them. Much less work for them...

Nice discussion here. I'm curious of why some hackers want to target a particular home user? I mean unless he's a millionaire or such, but a household PC for kids.. I mean can't help it but wondering...

 

[Deleted member 178]

Nice discussion here. I'm curious of why some hackers want to target a particular home user? I mean unless he's a millionaire or such, but a household PC for kids.. I mean can't help it but wondering...

hackers dont target you for money primarily, they just need transform your computer into a bot , then use the botnet to attack larger and more valuable targets.

 

[CMLew]

hackers dont target you for money primarily, they just need transform your computer into a bot , then use the botnet to attack larger and more valuable targets.

I see. thanks @Umbra . Seem world of internet is just as country on war.

 

[LabZero]

In terms of security It's better make stealth ports and not closed because any response, even negative, provides valuable information to an attacker, in fact any package is a source of data, for those who can read them at a low level. In fact Nmap, for example, is able to determine the operating system of the attacked computer even with all ports closed, however, in the case of stealth ports the hacker cannot, because he doesn't receive responses.
Closed ports can allow TCP/IP stack attack if this is vulnerable.

 

[Deleted member 2913]

HJLBX,

You mentioned "Block incoming connections is not the same as Stealth Ports. Stealth Ports is a port scanning countermeasure. You must enable Stealth Ports on Firewall - Tasks pane...".

Stealth Ports in the GUI has 2 options "Block Incoming Connections" & "Alert for Incoming Connections".
Doesn't "Block Incoming Connections" here means Stealth Ports?

 

[hjlbx]

HJLBX,

You mentioned "Block incoming connections is not the same as Stealth Ports. Stealth Ports is a port scanning countermeasure. You must enable Stealth Ports on Firewall - Tasks pane...".

Stealth Ports in the GUI has 2 options "Block Incoming Connections" & "Alert for Incoming Connections".
Doesn't "Block Incoming Connections" here means Stealth Ports?

I have to get definitive answer from Comodo, but I think that setting does both = Stealth Ports and Blocks Incoming Connections (BIC = if source port is from outside of your system AND the connection is not permitted by any firewall rules [e.g. an application assigned the Allowed Application firewall rule. In CIS an Allowed Application is permitted all connections - both Inbound and Outbound.]).

In other words, Comodo firewall will not block an Allowed Application from receiving a connection from a source port outside the system (e.g. soft vendor server calls the application installed on your system) even if user has enabled "Stealth Ports."

Safest firewall rule for apps is Outgoing Only; this rule does not allow incoming connections - even from safe sources. As a side note, very, very few soft vendors, in my experience, will "call" a user's system. Typically, it is always the application the contacts the server (initiates the connection) and sometimes (rarely) there will be an inbound connection. And typically, that inbound connection will use a different internet protocol (e.g. UDP instead of TCP), but not always.

Inbound connection does not = downloading, video streaming, phone\video calls, etc - if the connection was initiated by an application installed on your system.

Inbound\Outbound is determined by source port that initiates connection (your system initiates connection versus another system initiates connection with yours - e.g. server, hacker's system, system that can connect to yours via LAN, etc).

 

[upnorth]

This test that's probably known to most on this forum works very well : GRC | ShieldsUP! — Internet Vulnerability Profiling