I may be in minority, but I do use Windows Firewall on most of my boxes. I deny all the connections by default, including some of the predefined ones, and only selectively enable some, just enough to get by with some required functionality. And anytime I need to deal with a more internet access-hungry app, I just run it from VM.<\/p>\n\n\n\n
It’s hard to run some apps from VM though. Probably the most annoying bit when you have your Windows Firewall set to deny everything by default is Office 365. Its main functionality is not word or spreadsheet editing, but confirming your Office version is legitimate. To do so, and it does it all the time, it obviously needs to connect out. However, the rules one would need to set up for this to work properly are absolutely and kinda obviously, crazy. This page<\/a> gives you details. Thanks Microsoft!<\/p>\n\n\n\n With Windows Firewall on, you will come across one more problem: <\/p>\n\n\n\n – access to symbols server. <\/p>\n\n\n\n It’s often great to have access to it, and yet, I don’t feel like enabling a carte blanche<\/em> access to the port 80 or 443 for any reversing tools that I happen to run. So I go with IP-specific enabling rules. <\/p>\n\n\n\n And here’s the catch:<\/p>\n\n\n\n – in the past, one would need to check the IP that msdl.microsoft.com<\/em> resolves to, and enable connectivity to that IP only. <\/p>\n\n\n\n Times changed though, and we live in a world of CDNs, and redirectors. As such, enabling access to msdl.microsoft.com<\/em> mapping is no longer enough. This is because the latter redirects all the requests to a bunch of servers.<\/p>\n\n\n\n How do we find them?<\/p>\n\n\n\n I don’t have a generic answer, but we can cheat a bit.<\/p>\n\n\n\n You can try to use curl or wget and download the following PDB from the server (the flags I use print out a lot of debug\/verbose logs which is handy):<\/p>\n\n\n\n wget -v -d https:\/\/msdl.microsoft.com\/download\/symbols\/regedit.pdb\/85B6C521417160A68521696D68568CB41\/regedit.pdb<\/em><\/p><\/blockquote>\n\n\n\n If you look at the logs your downloading tool outputs you will notice that the request is being redirected to a different Symbol Server e.g.:<\/p>\n\n\n\n https:\/\/vsblobprodscussu5shard76.blob.core.windows.net\/….<\/em><\/p>\n\n\n\n So, yes, you need to find out what the IP of this server is, and voila… now your rules should work.<\/p>\n\n\n\n If you are wondering how I found this out… I checked from VM with firewall disabled. Literally, this is a regular activity for anyone who wants to keep their host OS in err… firewall denial.<\/p>\n\n\n\n Googling around for vsblobprodscussu5shard76<\/em> I came across 2 posts only, and this one<\/a> is a winner in a contest of value-and-madness-adding content…; the list of possible servers goes as follows:<\/p>\n\n\n\n Good luck…<\/p>\n","protected":false},"excerpt":{"rendered":" I may be in minority, but I do use Windows Firewall on most of my boxes. I deny all the connections by default, including some of the predefined ones, and only selectively enable some, just enough to get by with … Continue reading StorageAccount\nvsblobprodscussu5shard90\nvsblobprodscussu5shard9\nvsblobprodscussu5shard89\nvsblobprodscussu5shard88\nvsblobprodscussu5shard87\nvsblobprodscussu5shard86\nvsblobprodscussu5shard85\nvsblobprodscussu5shard84\nvsblobprodscussu5shard83\nvsblobprodscussu5shard82\nvsblobprodscussu5shard81\nvsblobprodscussu5shard80\nvsblobprodscussu5shard8\nvsblobprodscussu5shard79\nvsblobprodscussu5shard78\nvsblobprodscussu5shard77\nvsblobprodscussu5shard76\nvsblobprodscussu5shard75\nvsblobprodscussu5shard74\nvsblobprodscussu5shard73\nvsblobprodscussu5shard72\nvsblobprodscussu5shard71\nvsblobprodscussu5shard70\nvsblobprodscussu5shard7\nvsblobprodscussu5shard69\nvsblobprodscussu5shard68\nvsblobprodscussu5shard67\nvsblobprodscussu5shard66\nvsblobprodscussu5shard65\nvsblobprodscussu5shard64\nvsblobprodscussu5shard63\nvsblobprodscussu5shard62\nvsblobprodscussu5shard61\nvsblobprodscussu5shard60\nvsblobprodscussu5shard6\nvsblobprodscussu5shard59\nvsblobprodscussu5shard58\nvsblobprodscussu5shard57\nvsblobprodscussu5shard56\nvsblobprodscussu5shard55\nvsblobprodscussu5shard54\nvsblobprodscussu5shard53\nvsblobprodscussu5shard52\nvsblobprodscussu5shard51\nvsblobprodscussu5shard50\nvsblobprodscussu5shard5\nvsblobprodscussu5shard49\nvsblobprodscussu5shard48\nvsblobprodscussu5shard47\nvsblobprodscussu5shard46\nvsblobprodscussu5shard45\nvsblobprodscussu5shard44\nvsblobprodscussu5shard43\nvsblobprodscussu5shard42\nvsblobprodscussu5shard41\nvsblobprodscussu5shard40\nvsblobprodscussu5shard4\nvsblobprodscussu5shard39\nvsblobprodscussu5shard38\nvsblobprodscussu5shard37\nvsblobprodscussu5shard36\nvsblobprodscussu5shard35\nvsblobprodscussu5shard34\nvsblobprodscussu5shard33\nvsblobprodscussu5shard32\nvsblobprodscussu5shard31\nvsblobprodscussu5shard30\nvsblobprodscussu5shard3\nvsblobprodscussu5shard29\nvsblobprodscussu5shard28\nvsblobprodscussu5shard27\nvsblobprodscussu5shard26\nvsblobprodscussu5shard25\nvsblobprodscussu5shard24\nvsblobprodscussu5shard23\nvsblobprodscussu5shard22\nvsblobprodscussu5shard21\nvsblobprodscussu5shard20\nvsblobprodscussu5shard2\nvsblobprodscussu5shard19\nvsblobprodscussu5shard18\nvsblobprodscussu5shard17\nvsblobprodscussu5shard16\nvsblobprodscussu5shard15\nvsblobprodscussu5shard14\nvsblobprodscussu5shard13\nvsblobprodscussu5shard12\nvsblobprodscussu5shard11\nvsblobprodscussu5shard10\nvsblobprodscussu5shard1\n\nThese account names could have either of these suffixes:\n\n{storageaccountname}.vsblob.vsassets.io\n{storageaccountname}.blob.core.windows.net<\/code><\/pre>\n\n\n\n