
#-----------------------------------------------------------------------
# Copyright (C) 2000-2001, Jean-Sebastien Morisset <jsmoriss@mvlan.net>
#-----------------------------------------------------------------------
# $Id: subseven,v 1.4 2001/08/11 17:01:21 jsmoriss Exp $
#-----------------------------------------------------------------------
# README
#-----------------------------------------------------------------------
#
# These rules were developed based on <http://xforce.iss.net/alerts/
# advise30.php>.
#
# There have been many versions of the SubSeven backdoor released, and 
# most of them were very buggy until version 1.7 came out. The latest 
# version is 1.9. This backdoor has been called 'BackDoor-G' by Network
# Associates, Inc., when they discovered version 1.7. SubSeven allows 
# remote attackers to obtain cached passwords, play sounds, look at a 
# webcam on your system, capture screenshots, and notify you over IRC 
# or ICQ when someone gets infected. SubSeven only works on Windows 95 
# and 98.
#
# To install, copy this file to /etc/firewall/modules/public/
# block-remote-ports/subseven. There's no need to execute rc.firewall 
# with the --update-config parameter.
# 
#-----------------------------------------------------------------------
# START OF MODULE CODE
#-----------------------------------------------------------------------

echo "Reject $INTOPT $IPADDR -> $ANY phAse Zero (logged)"
ipchains -A $OUTCHAIN -j REJECT -p tcp -y -s $IPADDR $UNPRIVPORTS -d $ANY 1234 -l
ipchains -A $OUTCHAIN -j REJECT -p tcp -y -s $IPADDR $UNPRIVPORTS -d $ANY 6711 -l
ipchains -A $OUTCHAIN -j REJECT -p tcp -y -s $IPADDR $UNPRIVPORTS -d $ANY 6776 -l

