What do P2P Applications do and How to block Peer to Peer Applications (P2P) using Symantec Endpoint Protection?
What is Peer to Peer (P2P) Application?
P2P is nothing but just Peer to Peer networking. As we have Server - Client Model and Peer to Peer network in the same way these P2P applications work. You need a P2P program that will be installed on your computer it creates a community of P2P application users and it creates a virtual network between these users. For the user it will look as it is in a Peer to Peer network and he can share files from his local computer and download files shared by other users. It is very similar to our Instant Messaging like Yahoo, AOL or GTalk where even though to whom we are taking to are on a different network but a virtual network is created where it looks we are on a same network and we can share files and chat. The P2P application has been very much in demand from last couple of years. A P2P application is mainly used for sharing Music, Movies, Games and other files.
What are the disadvantages of Peer to Peer (P2P) Application?
Is it estimated that for any given ISP 60 to 80% of their traffic is consumed by P2P traffic. So even in your office if people are using P2P application they will consume a huge amount of bandwidth without production.P2P application is very famous for distributing Pirated software. Your users might be using pirated software on their computers and Auditors will never appreciate that. Symantec Underground Economy says that "The annual global cost to businesses of software piracy in one 2007 study puts the cost at nearly $40 billion"
You can never trust the file you are downloading from a remote user in P2P environment.90% of the files contain malwares. Thus if your users are using P2P application there is very high rate of Virus Outbreak in your network that too very frequently. In 2008 10% of malware were propagated via P2P applications. Even the very infamous W32.Downadup also propagated and updated itself via P2P applications.
P2P is a very famous mechanism for distributing Bots, Spywares, Adware, Trojans, Rootkits, Worms and other types of malwares.
Since it is very easy to change the port for these P2P applications it is very difficult to block this traffic. It is strictly not advised to have P2P application allowed in your network. Enterprises should take measures to prevent P2P clients from being installed on any computers on the network. End users who download files from P2P networks should scan all such files with a regularly updated antivirus product.
How to block Peer to Peer Applications (P2P) using Symantec Endpoint Protection ?
There are 3 ways of blocking Peer to Peer Applications on your network using Symantec Endpoint Protection.
1. Blocking Peer to Peer Applications using Intrusion Prevention System
Open Symantec Endpoint Protection Manager
Click on Policies -> Intrusion Prevention -> Edit Intrusion Prevention Policies .go to Exceptions -> Click on Add.
Then under Show Category scroll it down and Select Peer to Peer.
On the bottom right hand side of the policy click on Select all -> click next
Action -Block
Log - Log the Traffic
Click OK then Click OK on the policy and assign it to all the client groups.
Then Select All ->Click Next
Click Ok then OK on the Policy and then assign it to all the groups.
2.Blocking Peer to Peer Applications using Application Control of Application and Device Control
Since these Peer to Peer (P2P) Application is software installed on your computer so you can block the Process used for running these applications. As they are complete software so if the user tries to rename the main process name the application will not work. So you can block these processes using Application control.
For more help you can refer this Document:http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007092616264848
3. Blocking Peer to Peer Traffic using Symantec Endpoint Protection Firewall.
You can block the P2P traffic using Symantec Endpoint Firewall in this case even if the user has any P2P applications installed those applications won't be allowed to connect to the internet. Since it is very difficult to track the port number for the application as they can be easily changed by the user. So you can block the Inbound/Outbound traffic from the P2P processes.
In the Symantec Endpoint Protection Manager go to Policies -Firewall -Edit Firewall Policy - Rules- Add Rule -Click Next
In the Rule type select Application and click next
Select Define an Application and Click Next
In the File Name type the name of the process and click Next
Click Add More and add the name of other P2P application processes.
Click Finish.
Rename the rule to something like "Blocking P2P" so that you can identify.
Under Action change Allow to Block.
Under Logging Change it to "Write to Traffic Log".
Note : Most of the P2P application use Torrent file to download files from other P2P application so make sure when Creating a Firewall rule or Application Control rule block *.torrent file.
List of Known Peer to Peer Applications and its main Process
|
Executables
|
Client Name
|
Catagory
|
| LimeWire.exe | LimeWire | p2p |
| emule.exe | eMule | p2p |
| kazaa.exe | KaZaA | p2p |
| zultrax.exe | Zultrax | p2p |
| Shareaza.exe | Shareaza | p2p |
| morpheus.exe | Morpheus | p2p |
| mlnet.exe | MLNET | Malware |
| kiwialpha.exe | KiwiAlpha | Spyware |
| KCeasy.exe | KCeasy | p2p |
| imesh.exe | iMesh | p2p |
| gnucleus.exe | GNUCLEUS | Malware |
| gift.exe | Gift | Virus/Worm |
| aMule.exe | ||
| edonkey.exe | eDonkey | Malware/p2p |
| edonkey2000.exe | eDonkey | Malware/p2p |
| dc++.exe | ||
| bittorrent.exe | Bittorrent | Torrent |
| BCDC++ .exe | ||
| Ares.exe | Ares | Malware/p2p |
| warez.exe | ||
| abc.exe | ABC | Virus/Worm/Torrent |
| Azureus.exe | Vuze | p2p |
| bitcomet.exe | BitComet | Torrent/Malware |
| BitSpirit.exe | ||
| BITTORNADO.exe | ||
| bitlord.exe | ||
| burst.exe | ||
| utorrent.exe | ||
| qtorrent.exe | ||
| tribler.exe | ||
| DCPlusPlus.exe | ||
| ApexDC++.exe | ||
| STRONGDC.EXE | ||
| hydranode.exe | ||
| Jubster.exe | ||
| Pruna.exe | Pruna | Malware |
| grokster.exe | ||
| entropy.exe | ||
| Acquisition.exe | Acquisition | p2p/Malware |
| bearshare.exe | ||
| Cabos.exe | ||
| gnucleus.exe | ||
| Grokster.exe | ||
| FrostWire.exe | ||
| xolox.exe | ||
| swapper.exe | ||
| Phex.exe | ||
| Piolet.exe | ||
| Blubster.exe | ||
| Napigator.exe | ||
| Overnet.exe | ||
| TVUPlayer.exe | ||
| tvprunner.exe | ||
| coolstreaming.exe | Cool Streaming | Malware/Torrent |
| ctv.exe | CTV | p2p/Malware |
| Tvants.exe | Tvants | Torrent |
| PPlive.exe | PPlive | p2p |
| peercast.exe | Peercast | p2p |
| iceshare.exe | IceShare | p2p |
ref:https://security.health.ufl.edu/p2p/p2p.shtml
I have attached the Firewall and Application & Device Control policy to block P2P Applications.
Nice article...
Nice article...
Regards,
Srinivas H.P.
HCL Infosystems Ltd
Great article Vikram. I am
Great article Vikram. I am always telling my kids and their friends how they put their systems and home networks at risk when using P2P. Most kids don't seem to care about these threats until their parents have been hit by something that they allowed into their home network by using some P2P application. I will make sure my teenager continues to spread the word at school about the threats of P2P filesharing.
Thanks,
Thomas
This is really very helpful
This is really very helpful
Prachand Kumar
MCSE-2003 Symantec Technical Specialist (SCTS)
Its very usefull for me...
Its very usefull for me... thanks...
Thanks for the
Thanks for the article...
This is truly benificial...
Nel Ramos
Adding
is there a way wherein I will not input the exe file one by one in the Application control config?
Jomar Gonzales
Re
I dont think it accepts importing or exporting a list, but I think it's better to add it one by one, so that it is controlled and for documentation purposes.
Of great use
I have taken this information and added it to my production envirionment and have made life easier and for myself. Thanks a million.
thank you very much just
thank you very much just implimented in our network you would be i was shocked by the sheer number of people using these in a work enviorment.
A NICE WRITE UP
A NICE WRITE UP
Sandeep
great
Thank you vikram ist very useful for us.
------------------------------------------
Everything works better when everything works together.
Vikram, Thanks for posting
Vikram,
Thanks for posting this and many other articles!!!!!
Would you like to reply?
Login or Register to post your comment.