in

eEye Digital Security

The endpoint to vulnerability starts here.

 

Which hips should I combine with blink personal edition?

Last post 07-09-2007 10:05 PM by Blue1978. 5 replies.
Page 1 of 1 (6 items)
Sort Posts: Previous Next
  • 07-06-2007 12:50 PM

    Which hips should I combine with blink personal edition?

    Dear forum debators, Which hips (host intrusion prevention system) should I combine with blink personal edition or unnecessary? I was used to use winpatrol plus and System safety monitor which I like most. Are they good surplus for extra security stuff or Am I overdoing? Thank you for your support help, but I'm a blink personal edition fresh user. Best Regards.
    Filed under:
  • 07-07-2007 10:46 PM In reply to

    Re: Which hips should I combine with blink personal edition?

         Well, to answer your question (without writing a book and boring you), my opinion is all you really need is Blink.  Blink was meant to be an "All-in-one" security suite.  Other users have pointed out that they use WinPatrol with Blink and do not experience any problems.  SSM, I am not quite sure, but I think it will probably interfere with Blink because of all that is tries to do.  Keep in mind, before I came to Blink I use to use SSM and Agnitum's Outpost Firewall Pro.

         All I was use to hearing about all the time (in forums and such) was folks ranting and raving over "Leak Tests" and how well their firewalls did against them.  How it was a crisis if their firewall failed one of them, etc.  A lot of folks, when they see that Blink does not pass hardly any of these test, consider it to be a failure and do not wish to speak of it anymore.  What they all fail to make note of is one simple thing.  Blink can not be compared to all of these other security products quite frankly, because it was not created to perform "containment" for your system once it has been infected (as a lot of these other firewalls out there are trying to do by alerting you to everything going outbound etc and competing in Leak Tests and such).  Yes Blink does do basic firewall functions, i.e. ask you to give permission to programs wanting access to the internet, etc.  Blink's main purpose (which might I add is one of the most difficult things to try to do from a security perspective) is to protect you from known and unknown vulnerabilities and attacks.  It is trying to keep you from being infected or from your machine being compromised in the first place.  Common sense is, once your compromised it is already a done deal, might as well wipe your system and restart from a known good point that you can trust. (Granted this is a bit extreme for some forms of malicious code infections that CAN be removed easily, however for other things in nature that is a different story).  The other big thing to note is Blink is doing what is called "Protocol Analysis".  Basically meaning it is analyzing all of the Protocols (UDP, TCP, ICMP, RPC, etc)that is coming in and out of your system for known and unknown vulnerabilities.  How this compares to other firewalls is this.

         Lets say IE makes a outbound request (with a firewall alert) asking for access to use port 80 for the internet.  You allow it, seeing you just opened your browser and are trying to view a web page.  Once you allow it, most firewalls go about their business at that point.  They could care from that point on what is going out through that traffic, or for the matter, what is returning on behalf of those requests through another port.  Now granted they are expecting traffic to be returning in response to that traffic and they are watching for that, but once they see it is "legitimate" traffic, they allow it in.  Once again they go about their business.  What they are not checking for is a known or unknown exploit or vulnerability of some sort that may lye within some Java coding, Active X, HTML, etc that has been placed on that website with malicious intent, waiting for you to come by and expose yourself to it.  Granted most firewalls allow you to filter active content from web pages, but once again if you tell the firewall not to filter it or allow it for that particular web page the firewall just goes about its business and ignores it.  Blink does not ignore all this, it is monitoring the traffic you are allowing and not allowing for these instances of misuse or concern.

         Coupled with what I have said here, Blink is also trying to protect you from vulnerabilities (both known and unknown) that exists in software.  If you note on most security websites now, besides your everyday malware, spam, and attempts to exploit you via emails the only thing bigger than all of that is the growing list of vulnerabilities being found in software applications that are not necessarily Microsoft (but yes they have their problems too).  It is very simple to have a completely patched windows machine, have all the greatest software out there installed on it and all it takes is for you to visit the wrong website and your machine is compromised because of one of these that your product does not protect against.

         The reason I say your product does not protect against it is because most products now fall into a few of these categories:

    1. Signature based - Great and all if you have a Signature for the issue at hand.  Does nothing for zero-day exploits until after the fact.

    2. Outbound Protection - i.e. Firewalls - Just how locked down can you make your system so the simplest form of activity even remotely wanting to go outbound is stopped. Keep in mind once it does alert you to something: "That is great and all, BUT it is already in your system trying to make contact outbound!"

    3. Other Software - i.e. HIPS - This is where I bring up SSM.  Yes it is a great HIPS! Yes I use to use it, BUT if I got tired of it asking me if "I" wanted to shutdown my own computer system when I clicked on the start, shutdown, button.  No offense now, but a little on the paranoid side of things imo!  It did a great job and all asking for permission on every little process that wanted to run and all, which is great.  BUT if your leaving these decisions of whether or not you want to allow something to run up to the common everyday person that does not understand what every process in windows does,  is called or what its name is trying to decide when using SSM, then that is about as useful as Windows Vista's UAC control is for securing them.  Finally once again it alerts you once the unknown is already in your system.  Just my 2 cents on the thought though.

         To sum up this book that I have written, that I did not want to write in the first place, I will say this about Blink. 

         Blink is a refreshing change compared to all of these other products.  Coming from using SSM I found Blink to be TOO quiet imo, but that is understandable when your use to being asked if you want to shutdown your own computer and if you want to be allowed to access the "Properties" under the My Computer icon.  *chuckles* ...come to think of it on that note, I think SSM would have alerted me if I would have spilled my soda on my computer too. :P  It is all good though. :)

         eEye has created Blink to do a lot of the decision making for you(hence sometimes it will flag stuff that is not really malicious, i.e. some of the protocols being used by P2P filesharing and Newsreader Programs it is overly cautious about).  Also take into consideration another reason Blink is so quiet is, if it knows something is not needed or probably is bad without a doubt it will simply "drop" or ignore any suspicious activity and not bother you that much in the process of doing so.  Other things it will alert you to, like programs asking for access etc.  eEye wanted to strike a balance between usability and Security.  To me it is not fun if I can not use my own computer and not be bothered every 5 secs with a new question from a firewall or HIPS asking about this and that.  So yes, once you get use to using Blink it is awesome, but at first you will be like I was (coming from SSM that is) curious whether or not it was actually protecting me, because it was sooo quiet.  Overall I think you will enjoy it.  Once final thing that a lot of folks are not aware of is that Blink has always originally been created for use in Corporate or Enterprise environments.  This is why your interaction with the program is not the same as is with most security applications.  It will evolve once it matures for the everyday home user, but it has already proven itself in the business world.  THis is all food for thought, it is all up to you.  Once you get use to it I think you will drop everything else you have and actually be able to relax and use your system a bit more freely than you did before. 

     

  • 07-08-2007 4:30 PM In reply to

    • serv
    • Top 25 Contributor
    • Joined on 06-14-2007
    • European Union
    • Posts 41

    Re: Which hips should I combine with blink personal edition?

    "Blink is a refreshing change..."
    "Once you get use to it I think you will drop everything else you have and actually be able to relax and use your system a bit more freely than you did before. "
    Copyright by Jeffrey "Blue1978"

    Woow Jeffrey. Thank you very much for your point of view. All mine too. The book that you have written, that you did not wanted to write is just great ;).

    Regards
    Serv B.

  • 07-08-2007 5:32 PM In reply to

    • snharden
    • Top 25 Contributor
    • Joined on 06-26-2007
    • Brisbane, Queensland, Australia
    • Posts 36

    Re: Which hips should I combine with blink personal edition?

    Well to say the least I'm speechless.. So I will remain speechless. Damn fine post though. Well said.

    By the way, can I get a autographed copy of that?

     snharden

    SN Harden
  • 07-09-2007 4:37 PM In reply to

    Re: Which hips should I combine with blink personal edition?

    Dear Blue1978, Congratulations ! This is more than a teaching is a blink handbook. You excelled, buddy. I pasted down your lessons.Best Regards.
  • 07-09-2007 10:05 PM In reply to

    Re: Which hips should I combine with blink personal edition?

    Lol ...

Page 1 of 1 (6 items)
© 1995 - 2009 eEye Incorporated