Intrusion Detection Systems mailing list archives

Re: BlackICE Defender w/ McAfee/NAI PGP Desktop


From: budke () budke com (Eric Budke)
Date: Wed, 08 Dec 1999 09:59:23 -0500



At 10:18 AM 12/7/99 , Shawn A. Clifford wrote:
---
On a side note to the original discussion, I have encountered the following
problem.

My home machine is an "ancient" 100MHz 486 w/ 52 MB RAM, running NT 4.0 SP 
6, PGP
Desktop 6.0 from McAfee, and BlackICE Defender.  The BlackICE service starts,
aborts, and tries again in 5 minutes.  After which, the service is unable 
to run
because it can't open/bind to the adapter.

I became suspicious that the product wasn't working because once I bought
BlackICE Defender, I put it in "paranoid" mode, then went to the
http://www.grc.com page and requested a port scan of my machine.  BlackICE 
didn't
make a peep!

I really wish NetworkICE would put together a Web page that would do a test of
your installed system by simulating an attack sequence or probe sequence that
should set off the alarms at the different levels.  That way the customer can
validate the software.  I wonder how many people have bought the software,
installed it, and don't even realize that it isn't running because the service
died without notice?

To their credit, the guys at NetworkICE were working with me for a while, 
emailing
me updates to try out, but I haven't heard anything from them in the past 4
weeks.  I suspect the problem is with whatever the "PGP Net" 
driver/wrapper has
done to my dialup interface.

Both of these products are only ~$40, available by network download, so I 
would
think NetworkICE has got a copy of PGP Desktop to test with their product.  I
can't be the only person who wants privacy and security features on their home
Internet PC?

I seriously would suspect the PGP desktop, more specifically the PGP net. 
It has caused a number of issues on my boxes. Ironically and specifically 
Cybercop can't bind to the interface if PGPnet is attached to it. Try 
binding PGPnet to a different interface (it might mean throwing in a dummy 
card or something.) Given that the two products are produced from the same 
company, I find it hilarious. But, I know NAI will not be the last company 
to have incompatible products.

This causes a problem if you are using the PGPnet software, which I haven't 
actually gone through yet. But it will get your other products working. And 
while I have little knowledge of the BlackICE product (other than here in 
the last week or so) I really don't think it is something they can be 
faulted with. I'd yell at NAI, as it screws up other products as well, 
including some of their own.

Has anyone else tried these two products together?


Regards,
-- Shawn Clifford <sac2 () compuserve com>

--
PGP Key can be found at http://www.budke.com/pgp/budke_budke_com.txt



Current thread: