eEye Digital Security

Since receiving the upgrade to Blink 4.2.0, my AIM sessions in Pidgin (the opensource IM client I use) are disconnected after ~30seconds.  This problem does NOT occur in other IM clients (such as Miranda IM and the official AIM client), and does not occur with other IM protocols (MSN, XMPP).  Firewall rules have been created using the interactive dialogs (relevant firewall rule is Allow TCP to Remote (All IPs : 5190) from Local (All IPs : All Ports)), and problem persists even after disabling the firewall.  Creating rules in apiex.ini has succeeded as a workaround for the time being.

Would love to know what's going on with this one.  It's as though the type 5 FLAP message used by Pidgin for keep-alive with the oscar (AIM) service is being intercepted by Blink.

 Hmmm, maybe try allowing ICMP only for Pidgen?  Sounds like the keep-alives are not liked.  I dunno, I would have to think more about it some first.

 Thank you for reporting this, we are looking into it.

It appears as though Pidgin is not the only IM application effected by this problem.  I just installed the IM client Digsby to test it out, and it suffers from the same problems with AIM only.

Ah, I've been having a similar problem! I thought it was just a funny coincidence but ever since the new update with Blink, my aim would disconnect after a minute when I send an IM. I am using the Trillian client, but I don't use yahoo or msn to compare. I thought it was just a trillian problem, so I've been looking towards them. Haven't heard anything from them. If this is a Blink problem and I'm not the only one, then it's good to know that the problem is getting looked into.

Hey I have some more info on this for you all. I am using the latest version of Pidgin 2.5.3 and it does the exact same thing to me. It disconnects when you send an AIM message after you have not sent anything for a minute or two. I messed with Blinks settings and found if you disable the intrusion protection the problem goes away. The firewall, anti-malware, and system protection does not seem to bother Pidgin.

Can you round it down to a particular set of rules, by disabling a set of them at a time in the Intrusion Prevention section and then seeing if you can find the one that may be causing issues?  This does not always work in the cases that involves something within the IPS engine itself and not just a rule persay.

Got some more data:

1) If you first start Pidgin with intrusion protection off in Blink and then turn it on Pidgin has no problem. But if intrusion protection is on when Pidgin starts up it has the problem.

2) Also found out if I uncheck Enable Protocal Detection on the Intrusion Protection tab of Blinks option screen Pidgin works just fine also.

3) There is also nothing in the event logs when Pidgin stops working.

T 2:

2) Also found out if I uncheck Enable Protocal Detection on the Intrusion Protection tab of Blinks option screen Pidgin works just fine also.

Okay that sounds more like an internal issue now.  Try going to the "Analyzers" tab of the Intrusion Protection section in Blink.  Leave the IPS on, start Pidgen, and then try disabling a section of the Analyzers at a time to see if a particular section of them are causing this.  If Pidgen times out and disconnects you will probably have to reconnect it and keep trying this procedure.

     IF after trying every section and you still do not have any luck, try the same procedures I described by disabling sections under the "Signatures" tab of the IPS in Blink.  More than likely the Signatures in Blink's IPS has nothing to do with this, the Protocol Analyzers themselves sound like the issue to me.  This will end up probably being something that eEye will have to fix internally with one of the Analyzers themselves, that details with all Instant Messaging programs in general.

The last thing you could do is this.  Make sure Pidgen is not running at all before you start this procedure.

1.  Disable all sections of Blink; Firewall, AV, IPS, all of them.

2.  Save the following two commands to a Text document that you can keep up on your screen and access easily:

reg add HKEY_LOCAL_MACHINE\SOFTWARE\eEye\Blink /v Blinksvc /t REG_DWORD /d 2

reg add HKEY_LOCAL_MACHINE\SOFTWARE\eEye\Blink /v Blinksvc /t REG_DWORD /d 0

3.  Now, highlight the first command and copy it.  Go to your Start button in windows, then to Run, and then type in cmd.   Once your Command Prompt window is up left click in the window, right click, and then select Paste.  The command should drop into the Command Prompt, go ahead and hit Enter to run it.  It should say it was successful or something like that.

NOTE:  At this point Debugging in Blink is turned on.  Leave the Command Prompt window up.

4.  Re-enable Blink's IPS now.

5.  Next, start Pidgen, wait til the issue in Pidgen occurs.  After you experience your issue with Pidgen, you need to stop Blink's debugging processes.

6.  Copy and paste the second command from your Text document into the Command Prompt window.  Once you run this, it should say it was successful and now Blink's debugging is turned off.

7.  Finally go gather Blink's debugging log (blinksvc.log) from the following location on your system:

C:\Program Files\eEye Digital Security\Blink\blinksvc.log

8.  Send this log and a link to this post to the following two individuals at eEye:

lnicula@eeye.com  and  moh@eeye.com

Hopefully this information can assist eEye further.  These are really the only two recommenations for a course of action a user can take to help eEye out with any information they may have.

 Thanks blue1978.

Just follow his direction and send the log file to me.

I'll look into the issue, thanks!

 Any further luck on this Neatchee?

Well, I tried again after the most recent update, and still no dice.  I've yet to send in debug info, and it looks like now I might not get the chance to.  I've just upgraded to Windows 7 Beta x64 and Blink won't install :(  If I can get THAT problem squared away, I'll work on some debug info :P

Please email me at lnicula@eeye.com. We have a potential fix we would like you to try out.

Thanks!

Since I have not tried Pidgen, I will try it with Blink Personal Edition in a VM and see if I can reproduce these issues and try to get some debugging information.   I will probably not be able to do it for a few days though (still working 12 hours on 12 hours off at work  :(   ).

--Premature response removed-- >.>