Bypassing Black Ice PC protection?

["Curt Wilson" <netw3_security () hushmail com>]

-----BEGIN PGP SIGNED MESSAGE-----


Recently seen: what appears to be an attacker bypassing Black Ice PC protection through unknown methods.

Windows 2000 pro, all service packs/hotfixes, legit install of Serv-U FTP server.

Black Ice PC Protection,
Product version 3.6.cbd
blackice.exe version 3.6.32
blackd.exe version 3.6.32
blackdll.dll version 3.6.28
BlackDrv.sys version 3.6.28
iss-pam1.dll version 3.6.06

> From Serv-u FTP log file:

[5] Sat 08Mar03 19:09:07 - (000008) Connected to 80.117.235.141 (Local address 192.xxx.x.x)
[5] Sat 08Mar03 19:09:07 - Connection denied to IP-number 80.117.235.141

host141-235.pool80117.interbusiness.it

Black Ice is set to PARANOID and set to block all FTP access except specified IP ranges. This IP 80.117.235.141 is NOT 
included.

Black Ice did generate an alert to indicate a block, 4 seconds earlier:

Time, Event, Intruder, Count
3/8/2003 7:09:03 PM, TCP_Probe_Ftp, 80.117.235.141, 1

> From attack-list.csv:

Severity timestamp (GMT)issueId issueName intruderIp victimIp parameters count responseLevel intruderPort VictimPort 
packetFlags

4 2003-03-09 01:09:03 2003004 TCP_Probe_Ftp 80.117.235.141 192.168.x.x port=21&reason=Firewalled 1 A 3392 21 0x22d06

What did the attacker do 4 seconds later to bypass Black Ice? I don't see how Serv-U should have known about this 
persons IP if Black Ice was doing it's job. I see these FTP probes all the time but this is the first one that's 
actually appeared in my FTP server log. Unfortunately, I don't have the log*.enc file for more in-depth analysis.

Any ideas, or inside information about a Black Ice bypass technique?

Curt R. Wilson
GSEC, GCFW, GEEK(!)
Netw3 Security
www.netw3.com
-----BEGIN PGP SIGNATURE-----
Version: Hush 2.2 (Java)
Note: This signature can be verified at https://www.hushtools.com/verify

wmMEARECACMFAj5sVo0cHG5ldHczX3NlY3VyaXR5QGh1c2htYWlsLmNvbQAKCRBGd/Yw
aRH3KyBUAKCvs/rNMD/tz3ADUjoj3lEBovjLpwCcDalmOhw+ZC592NE2C0KjHR5QMyg=
=UUnM
-----END PGP SIGNATURE-----


----------------------------------------------------------------------------

<Pre>Lose another weekend managing your IDS?
Take back your personal time.
15-day free trial of StillSecure Border Guard.</Pre>
<A href="http://www.securityfocus.com/stillsecure";> http://www.securityfocus.com/stillsecure </A>