Security Basics mailing list archives
RE: how to block ALL AIM traffic ?
From: "Joe Kanser" <jkanser () corpam org>
Date: Thu, 28 Apr 2005 11:37:44 -0500
All, There are several ways to block application traffic. First, and easiest is to create a policy stipulating acceptable, and abuse, of corporate resources. Once in place and sent to all corporate users, they must comply or seek employment elsewhere. Another would be to lock down administrative rights so that "joe user" cannot install software at their whim. The final task would be to install third party software such as Cisco Security Agent, which is a host based IDS system that can block installation and transmission of software, or Altiris, which is a systems management tool in which you can set up "blocked" software apps and it will summarily delete those if installed. You have lots of options, my best advice would be to lock the systems down so that your users cannot install software. That will save you a lot of future headaches as well. Joe Kanser -----Original Message----- From: Ramon Kagan [mailto:rkagan () yorku ca] Sent: Thursday, April 28, 2005 7:17 AM To: Realized Mofo Cc: security-basics () securityfocus com Subject: Re: how to block ALL AIM traffic ? HI, I don't have AIM traffic on my network right now... but what I would do it conduct a tcpdump, full packet capture (-s 0) for port 5190 traffic. Then I would inspect the payload for a pattern. Once I have a pattern write a filter/signature based on it to conduct the packet drop. I was hoping to give you a signature or pattern, but we seem to be AIM free here. Ramon Kagan York University, Computing and Network Services Information Security - Senior Information Security Analyst (416)736-2100 #20263 rkagan () yorku ca ----------------------------------- ------------------------------------ I have not failed. I have just I don't know the secret to success, found 10,000 ways that don't work. but the secret to failure is trying to please everybody. - Thomas Edison - Bill Cosby ----------------------------------- ------------------------------------ On Tue, 26 Apr 2005, Realized Mofo wrote:
I am at an office with 50~ machines , out of thoes about 20 or so use AIM. I would like to block AIM and normally i'd just block the AIM port (5190) or whatever it is.. BUT AOL seems to have found a great way around this and has 4000+ diffrent ports they use and i'd assume lots of diffrent hosts. Whats the best way of blocking all AIM traffic ?
Current thread:
- Re: how to block ALL AIM traffic ?, (continued)
- Re: how to block ALL AIM traffic ? Bipin Gautam (Apr 28)
- Re: how to block ALL AIM traffic ? Times Enemy (Apr 28)
- RE: how to block ALL AIM traffic ? Evan Littmann (Apr 28)
- Re: how to block ALL AIM traffic ? Netops (Apr 28)
- Re: how to block ALL AIM traffic ? Markus Schabel (Apr 28)
- Re: how to block ALL AIM traffic ? Mark Owen (Apr 29)
- Re: how to block ALL AIM traffic ? david kuhlman (Apr 29)
- Re: how to block ALL AIM traffic ? H Carvey (Apr 28)
- RE: how to block ALL AIM traffic ? Rochford, Paul (Apr 28)
- Re: how to block ALL AIM traffic ? Mark Cyprus (Apr 29)
- RE: how to block ALL AIM traffic ? Joe Kanser (Apr 29)