User manual KASPERSKY LAB KASPERSKY ANTI-HACKER 1.5

KASPERSKY LABS Kaspersky Anti-Hacker 1.5 USER GUIDE KASPERSKY ANTI-HACKER 1.5 User Guide Kaspersky Labs Ltd. http://www.kaspersky.com Revision date: April 2004 Contents CHAPTER 1. KASPERSKY ANTI-HACKER.................................................................. 6 1.1. Introduction ............................................................................................................ 6 1.2. What's new in v. 1.5 .............................................................................................. 7 1.3. Distribution Kit........................................................................................................ 8 1.3.1. What Is in the Distribution Kit ......................................................................... 8 1.3.2. License Agreement......................................................................................... 8 1.4. Information in the Book ......................................................................................... 9 1.5. Conventions......................................................................................................... 10 1.6. Help Desk for Registered Users ......................................................................... 11 CHAPTER 2. INSTALLING AND REMOVING THE SOFTWARE.............................. 12 2.1. Hardware and Software Requirements .............................................................. 12 2.2. Installing ............................................................................................................... 13 2.3. Removing the Program ....................................................................................... 18 CHAPTER 3. STARTING WORK ................................................................................. 19 CHAPTER 4. KASPERSKY ANTI-HACKER ­ PREVENTING HACKER ATTACKS ................................................................................................................... 22 4.1. Kaspersky Anti-Hacker Operating Principles ..................................................... 22 4.2. Security Levels .................................................................................................... 23 4.3. Recommended Settings...................................................................................... 24 CHAPTER 5. RUNNING THE PROGRAM .................................................................. 27 5.1. Starting the Program ........................................................................................... 27 5.2. System Menu....................................................................................................... 28 5.3. Main Window ....................................................................................................... 29 5.4. Menus .................................................................................................................. 30 5.5. Toolbar................................................................................................................. 32 5.6. Workspace........................................................................................................... 33 4 Kaspersky Anti-Hacker 5.7. Status Bar ............................................................................................................ 34 5.8. Context Menu ...................................................................................................... 34 5.9. Rule Wizards ....................................................................................................... 34 5.10. Changing and Saving Interface Settings .......................................................... 35 5.11. Exiting the Program........................................................................................... 37 CHAPTER 6. ENABLING THE SECURITY SYSTEM AND DEFINING ITS SETTINGS.................................................................................................................. 38 6.1. Enabling the Security System and Selecting the Security Level ....................... 38 6.1.1. Enabling the Security System ...................................................................... 38 6.1.2. Selecting the Security Level ......................................................................... 40 6.1.3. Network Event Warning................................................................................ 41 6.1.4. Training Window (Medium Level) ................................................................ 42 6.1.5. The Executable Module Substitution Warning ............................................ 43 6.2. How the Program Responds to Attack ............................................................... 45 6.3. Customizing Application Rules ........................................................................... 46 6.3.1. Managing the Rule List................................................................................. 46 6.3.2. Adding a New Rule....................................................................................... 49 6.3.2.1. Step 1. Customizing the Rule................................................................ 49 6.3.2.2. Step 2. Rule Conditions......................................................................... 53 6.3.2.3. Step 3. Additional Actions...................................................................... 59 6.4. Customizing Packet Filtering Rules .................................................................... 60 6.4.1. Managing the Rule List................................................................................. 60 6.4.2. Adding a New Rule....................................................................................... 63 6.4.2.1. Step 1. Rule Conditions......................................................................... 63 6.4.2.2. Step 2. Rule Name and Additional Actions........................................... 67 6.5. Intrusion Detection System ................................................................................. 69 6.5.1. Intrusion Detector Settings ........................................................................... 69 6.5.2. The List of Detectable Attacks...................................................................... 70 CHAPTER 7. VIEWING PERFORMANCE RESULTS................................................ 73 7.1. Viewing the Current Status ................................................................................. 73 7.1.1. Active Applications........................................................................................ 73 Contents 5 7.1.2. Established Connections.............................................................................. 77 7.1.3. Open Ports.................................................................................................... 80 7.2. Using the Logs..................................................................................................... 83 7.2.1. Displaying the Logs Window........................................................................ 83 7.2.2. The Logs Window Layout............................................................................. 84 7.2.2.1. Menus..................................................................................................... 84 7.2.2.2. Report Table .......................................................................................... 84 7.2.2.3. Tabs........................................................................................................ 85 7.2.3. Selecting the Log .......................................................................................... 85 7.2.3.1. Security Log ........................................................................................... 85 7.2.3.2. Application Activity ................................................................................. 86 7.2.3.3. Packet Filtering ...................................................................................... 87 7.2.4. Defining Log Settings ................................................................................... 88 7.2.5. Saving the Log to a File................................................................................ 89 APPENDIX A. INDEX .................................................................................................... 90 APPENDIX B. FREQUENTLY ASKED QUESTIONS ................................................. 91 APPENDIX C. KASPERSKY LABS LTD...................................................................... 92 C.1. Other Kaspersky Lab's Products........................................................................ 93 C.2. Contact Information............................................................................................. 96 CHAPTER 1. KASPERSKY ANTIHACKER 1.1. Introduction What is Kaspersky Anti-Hacker? Kaspersky Anti-Hacker is a personal firewall that is designed to safeguard a computer running a Windows operating system. It protects the computer against unauthorized access to its data and external hacker attacks from the Internet or an adjacent local network. Kaspersky Anti-Hacker: · Monitors the TCP/IP network activity of all applications running on your machine. If it detects any suspicious actions, the program notifies you and if required, blocks the suspect application from accessing the network. This allows you to preserve confidential data on your machine. For example, if a Trojan tries to transmit any data from your computer, Kaspersky Anti-Hacker will block this malware from accessing the Internet. The SmartStealthTM technique makes it difficult to detect your computer from outside. As a result, hackers will lose the target and all their attempts to access your computer will be doomed to fail. Besides, this allows for prevention of the DoS (Denial of Service) attack of all types. At the same time you will not feel any negative influence of this mode while working on the Web: the program provides conventional transparency and accessibility of the data. Blocks the most common hacker network attacks by permanently filtering the incoming and outgoing traffic, and also notifies the user about any such attacks. Monitors for attempts to scan your ports (these attempts are usually followed by attacks), and prohibits any further communication with the attacking machine. Allows you to review the list of all established connections, open ports, and active network applications, and if required, lets you terminate unwanted connections. · · · · Kaspersky Anti-Hacker 7 · Allows you to secure your machine from hacker attacks without special configuration of program settings. The program allows simplified management by choosing one of five security levels: Block all, High, Medium, Low, Allow all. By default the program starts with the Medium level, which is a training mode that will automatically configure your security system depending on your responses to various events. Allows flexibility of security system configuration. In particular, you can set the program to filter network operations into wanted and unwanted, and you can configure the Intrusion Detection System. Allows you to log certain security-related network events to various special-purpose logs. If required, you can define the detail level of the log entries. · · The program may be used as a separate software product or as an integral component of various Kaspersky Labs solutions. Attention!!! Kaspersky Anti-Hacker does not protect your computer from viruses and malicious programs that can destroy and/or corrupt your data. It is advised that you use Kaspersky Anti-Virus Personal for this purpose. 1.2. What's new in v. 1.5 New features of version 1.5 The new version of this program: · · · · · supports operations with ADSL modems; completely supports Stealth mode (tests passed at www.pcflank.com); is able to detect new network attacks: SmbDie, Helkern, and Lovesan; allows definition of port ranges for packet filtering and application rules; is more easy to configure right after installation without any degradation of the computer security level ­ the most frequently used applications are allowed by default to establish network connections strictly according to their types; 8 Kaspersky Anti-Hacker · has an improved graphic interface: supports XP style under Windows XP; the rule handling lists can be resized; to add a new rule you can use the key. 1.3. Distribution Kit What is in the Distribution kit License agreement. 1.3.1. What Is in the Distribution Kit The distribution kit includes: · · · · A sealed envelope containing installation CD with software files for the product This user guide Key diskette or key file on the installation CD License agreement Before you unseal the CD envelope, be sure to review the license agreement thoroughly. 1.3.2. License Agreement The License Agreement (LA) is a legal agreement between you (either an individual or a single entity) and the manufacturer (Kaspersky Labs Ltd.) describing the terms on which you may employ the anti-virus product which you have purchased. Please ensure you read all the terms of the LA! If you do not agree to the terms of this LA, Kaspersky Labs is not willing to license the software product to you and you should return the unused product to your Kaspersky Anti-Virus dealer for a full refund, making sure the envelope containing the CD (or diskettes) is sealed. Kaspersky Anti-Hacker 9 By unsealing the envelope you agree to all the terms of the LA. 1.4. Information in the Book Issues covered in this documentation This book contains information on how to install, customize and manage Kaspersky Anti-Hacker. The book is divided into the following chapters: Chapter Kaspersky Anti-Hacker Summary What is Kaspersky Anti-Hacker? Items in the distribution kit and information in this book. System requirements. software. How to install the Installing and Removing the Software Starting Work How to start working with the software product. Example of the security system configuration. Operating principles of the software product. Main terms, and tasks to be accomplished by the product. Screening the main program window and working with its items. How to enable the security system. Defining the security settings - rules for applications and datagram filtering rules. Reviewing the logs - network attacks, application activity and packet filtering. Reviewing the list of open ports, established connections, and active network applications. Information about Kaspersky Labs Ltd. Contact data. Glossary of the documentation. terms used in this Kaspersky Anti-Hacker ­ Preventing Hacker Attacks Running the Program Enabling the Security System and Defining its Settings Viewing Results Performance Appendix Labs Ltd. . Kaspersky Appendix . Index 10 Kaspersky Anti-Hacker Chapter Appendix . Frequently Asked Questions Summary Answers to frequently asked questions. 1.5. Conventions Conventions used in this book In this book we use a number of conventions to emphasize various important parts of the documentation. Convention Bold font Meaning Menu titles, commands, window titles, dialog elements, etc. Additional information, notes. Critical information. Attention! Actions that must be taken. To start the program, follow these steps: 1. 2. Step 1. ... Example of a user defined task to be accomplished using this program. Solution of the task. Solution Note. Task: Kaspersky Anti-Hacker 11 1.6. Help Desk for Registered Users Services provided by Kaspersky Labs to registered users Kaspersky Labs offers a large service package enabling its registered customers to employ Kaspersky Anti-Hacker more efficiently. If you register and purchase a subscription you will be provided with the following services for the period of your subscription: · · · New versions of this software product, provided free Phone and e-mail support advising on matters related to installation, configuration and management of this software product Information about new products from Kaspersky Labs and about new computer viruses (for those who subscribe to the Kaspersky Labs newsletter) Kaspersky Labs does not provide information related to management and use of your operating system, and associated technologies. CHAPTER 2. INSTALLING AND REMOVING THE SOFTWARE 2.1. Hardware and Software Requirements System requirements to be met in order to run the program In order to run Kaspersky Anti-Hacker you need a system that meets the following requirements: · · · · · · · Preinstalled Microsoft Windows operating system version 98/ME/NT 4.0/2000/XP To install under Microsoft Windows NT 4.0/2000/XP, you must be authorized administrator Supported TCP/IP protocol Local network (Ethernet) or dial-up connection (standard or ADSLmodem) Microsoft Internet Explorer (minimum 5.0 , 5.5 (SP 2) or higher recommended) At least 50 Mb of free space for the program files and extra space for the program logs To run under Windows® 98/Me/NT 4.0, you must have: · · Intel Pentium® processor of 133MHz or higher under Windows 98 or Windows NT 4.0 Intel Pentium® processor of 150MHz or higher under Windows Me Installing and Removing the Software 13 · · · 32 Mb RAM Preinstalled Service Pack v. 6.0 or higher under Windows NT 4.0 Workstation To run under Windows 2000, you must have: · · Intel Pentium® processor of 133MHz or higher 64 Mb RAM · To run under Windows XP, you must have: · · Intel Pentium® processor of 300MHz or higher 128 Mb RAM 2.2. Installing Step-by-step installation. Setup Wizard Run the Setup.exe program from the CD to start the program installation. The setup wizard operates in dialog mode. Every dialog box contains a certain set of buttons allowing management of the setup. The main buttons are: · · · · OK ­ to accept actions Cancel ­ to cancel action(s) Next ­ to move one step forward Back ­ to move one step backward Before installing Kaspersky Anti-Hacker please quit all programs running on your computer. Step 1. Read general information The first dialog box of the setup wizard (see fig. 1) contains general information about the Kaspersky Anti-Hacker package. 14 Kaspersky Anti-Hacker Step 2. Read the license agreement The License Agreement dialog box (see fig. 2) contains the agreement text. Read it carefully and press Yes if you agree to the license agreement terms. Otherwise, press No to abort the setup. Fig. 1. The first dialog box of the setup wizard Fig. 2. The License Agreement dialog box Step 3. Input user information Enter the user information in the Customer Information dialog box (see fig. 3). Enter the appropriate data in the User Name field and the Company Name field. By default the information for these fields is taken from the Windows registry. Fig. 3. The Customer Information dialog box Installing and Removing the Software 15 Step 4. Select the folder the program will be installed to In the Choose Destination Location dialog box (see fig. 4), select the installation folder where the Kaspersky Anti-Hacker program components will be installed. The folder must be defined in the Destination Folder field. To do this, press Browse and indicate the folder path in the Choose Folder standard dialog box. Fig. 4. The Choose Destination Location dialog box Step 5. Input the program group name in the Start\Programs menu Define the folder name in the Select Program Folder dialog box (see fig. 5) for the Kaspersky Anti-Hacker icon to appear in the standard Program menu. Press Next. Fig. 5. The Select Program Folder dialog box Step 6. Define paths to the key files* In the Key File dialog box (see fig. 6), you must define the key file name (the *.key file) and the path. 16 Kaspersky Anti-Hacker If the file is located in the setup folder, its name will be displayed in the list of key files to be installed. If the key file is located in a different folder, press Add and define the key file name and the path in the Select Key File standard dialog box. If required, the program may simultaneously use several key files. Fig. 6. The Key File dialog box It is advised that you check the Select Key Association checkbox. In this case you will be able to install new key files by double-clicking on their names. If you leave the box unchecked you will have to copy a key file to the shared files folder in order to install it. The Key File is your personal key that contains the following housekeeping data, essential for Kaspersky Anti-Hacker to apply all its features: · · · · · Your version vendor information (company name, addresses, telephone numbers) Support information (Name and location of support services) Product release date Name and number of the license License period of validity Step 7. Copying files to the hard drive Read the setup information in the Start Copying Files dialog box (see fig. 7). If you need to change any settings, you must return to the appropriate wizard box by pressing the Back button. If the setup information is correct, press Next. The program will start copying files to the hard disk. Progress is indicated by the progress bar in the Setup Status dialog box (fig. 8). Installing and Removing the Software 17 Fig. 7. The Start Copying Files dialog box Fig. 8. The Setup Status dialog box Step 8. Completing setup Upon completion of the Kaspersky Anti-Hacker package installation the Completing Setup Wizard dialog box appears on the screen (see fig. 9). To complete the installation you must restart your system. Check the Yes, I want to restart my computer now box to restart your system right away, or the No, I will restart my computer later box to postpone the restart. Press the Finish button to finish the installation. Fig. 9. The Completing Setup Wizard dialog box 18 Kaspersky Anti-Hacker 2.3. Removing the Program Removing the program from your computer To remove the Kaspersky Anti-Hacker program follow these steps: 1. Press the Start button in the bottom left corner of your Windows desktop and point to Programs. Point to the program group that corresponds to your Kaspersky AntiHacker installation. The default name of this program group is Kaspersky Anti-Hacker, but you may have changed it during the installation. Then point to Kaspersky Anti-Hacker Uninstall. If you wish to uninstall Kaspersky Anti-Hacker, press Yes in the confirmation box. If you change your mind, cancel the uninstall process by pressing the No button. To add/remove the program you can use the Add/Remove Programs icon in the MS Windows Control Panel. 2. 3. CHAPTER 3. STARTING WORK How to start working with the software product. Example of security system configuration As soon as you install the program and restart your computer the security system is activated. In fact, from this very moment, Kaspersky Anti-Hacker is monitoring for attacks against your machine and attempts by your applications to interact via a local network or the Internet. After you enter the system you begin to work as usual. When no network connection is established, the security system on your machine is indicated only icon in the system tray. If you click on it, the program main window will by the appear on your screen. In this window, you may review information about the current security level and change this level if required (for details of the program main window refer to subchapter 5.3 on page 29). By default the Medium level is enabled. This level allows you to configure your security system conversationally. In most cases you will not have to configure the system yourself: the most frequently used applications are allowed by default to establish network connections strictly according to their type. However sometimes you will have to configure your security system manually. Let's review the corresponding example: Task: Suppose your computer is connected to the Internet, and you start Microsoft Internet Explorer and enter www.kaspersky.com in the address field. The following message will appear on your screen: Create a rule for IEXPLORER.EXE (see fig. 10). In the upper area of this dialog box you will see the icon for the application concerned, its name (in this case Microsoft Internet Explorer), the site address www.kaspersky,com, and the port to be used to establish the connection. To review more details about this application, you just have to click on the underlined link (see fig. 11). The required network connection will not be established until you select how to handle this application activity. To do this, you must respond to the message on your screen. 20 Kaspersky Anti-Hacker Fig. 10. Self-training dialog box of the security system Fig. 11. Information about the connection to be established Follow these steps: 1. Select the Allow activity of this application according to its type option button and Web browser (IE, Netscape...) from the drop-down list. Press . 2. After this, Kaspersky Anti-Hacker will allow Microsoft Internet Explorer to establish the connection. In addition, the application will be allowed to establish other connections in accordance with its type. As you have probably noticed, there are three options in the Create a rule for IEXPLORER.EXE dialog box: · Allow activity of this application according to its type (the option you selected in the example above) ­ allows only network communication that is compliant with the specified application category. Select the required category from the drop-down list below the option button. You can allow any activity of this application by selecting Allow all from the drop-down list.