Slashdot Mirror
How Secure is Windows Firewall?
Garret writes "Though Microsoft is doing their part in protecting Windows users from internet attacks by including a firewall in their latest service pack, one has to wonder just how secure is the Windows Firewall from XP Service Pack 2? Not too good according to Flexbeta. Their recommendation is to turn off Windows Firewall and get an alternative such as ZoneAlarm or Sygate PF. Simply the fact that Windows Firewall can be turned off by another application is enough to tell me Microsoft has goofed again." PCWorld also has a story about the new firewall capability.
Kerio Personal Firewall is much much better.
Why are windows users so obsessed with "stealth"?
It's annoying on two levels, firstly it breaks the requirements of the rfc's leaving other nodes on the network hanging waiting to see of a connection is going to succeed or be rejected, waiting for timeouts isnt fun. secondly, THERE IS ABSOLUTELY NO POINT, it is trivial to find out if there is a node at that address, all sufficiently intelligent scanners can tell if there is a machine there, nmap for example. YES WINDOWS USERS, I'M TALKING TO YOU, get rid of that stealth crap, if there is no machine there the nearest router will return no such host...if there's no icmp from the router, we know that there's a windows user there (of course, we cant determine the operating system of the node, but everyone knows only windows users do this)...
It's pointless, it's only used because having a "stealth" computer sounds cool on proprietory firewall marketing material (would it be so desirable if it were called "filtered"), please turn it off...
With the firewall, and the security center it was using an extra ~20 MB of memory that I need to play Doom3 faster!
If you build it, nerds will come. Soylentnews.org
As long as the firewall is activated prior to any ports being opened on bootup, it's probably better than nothing. That is, at least the 99% of users that don't understand what a firewall is will be safe.
Help! I'm a slashdot refugee.
Windows will always be insecure. I have tried its firewall and it feels very basic. If you want more protection you should buy a linksys router with a built in firewall that won't hinder your computers performance or bug you while you open your e-mail program. With a hardware solution you will not be as vulnerable as if you were using Windows but there are a few problems.
I've installed SP2 on two machines now. In both cases SP2 had me reboot, and before offering a log-in prompt it presented a screen where I could enable or disable automatic updates. This is an administrative setting, and it should not have presented itself prior to an authenticated login. Sure, it only happens once, but by design it violates secure computing practices.
-Chris
-- This sig is only a test. If this were a real sig it would say something witty. --
While their new XP SP2 firewall is somewhat degraded comared to, say, ZoneAlarm, thats not entirely a bad thing. The new firewall is a step in the right direction, especially being on by default. Not only that, but by not including a "top of the line" firewall in XP, they allow for a market where 3rd parties can still sell firewalls as opposed to being yet another software industry crushed by Microsoft.
GRC - Shields Up: If you aren't stealthed, the evil boogeyman will get you... and your children!
I think there's a reason for this. If M$ put a good firewall and good virus scanner in XP, they would be using their monopoly position to put third-party anti-virus and firewall software companies out of business. They wouldn't be doing this intentionally, but it doesn't matter. That whole incident with IE fucked them over.
If M$ could go back a few years, they would see that not putting IE in the OS would have avoided all the anti-trust problems AND made windows more secure. LOL at M$.
My other car is first.
The problem is that it can be turned off by another application. Reading comprehension -- it's a good thing.
They're NAT devices, and the "firewall" is just a side effect. If you want a real firewall, buy a real hardware firewall device, or run something like IPCop on an old computer.
So if it couldn't be turned off by software that would mean...? that would mean that MS is abusing their monopoly.
The whole point of the firewall is so that bad applications (like the ones that would turn a firewall off) don't get installed in the first place.
And as far as I can tell, all the article is talking about is the fact that it asks you if you want to keep blocking a program or not. And it DOES ask you for every program that uses the LAN/internet/whatever.
And do you honestly think that it's impossible to turn off Zone Alarm and those other ones with an application? I'm willing to bet that it's possible
The article's website is timing out, but can't you 'turn off' Norton, Zonealarm by simply doing a WM_CLOSE or TerminateProcess anyway?
If the program has managed to make its way onto the host machine, then that is when the firewall isn't doing it's job.
Nothing costs nothing
I have run Windows XP Professional since its release. I run my box 24x7 connected to a 2MBit cable connection. I use the Windows firewall and have auto-updates downloaded automatically. I have an ftp port open using the Microsoft/IIS ftp server. I have a port open for remote desktop. It's been this way for 2+ years.My box has never been hacked into.
So, now some wise asses can ask for my IP address, sure. But my point is that by taking just the most basic precautions, you reduce your chance of being hacked to just about nothing.
The new firewall may not be perfect, but it will further reduce the number of easy targets, which is a giant step forward.
Never, ever lose a file again. Ever.
So for average users XP firewall is a good thing since you don't have to know anything, but we (Slashdot users and internet savvy) demand more.
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
Wait, a commercial firewall developer thinks Microsoft's free firewall isn't up to the challenge? Wow, what a surprise! What if Microsoft had put a full-fledged firewall into SP2? The same companies would be whining about how Microsoft bullied them out of the market.
Uh no, welcome to your logical falacy of the day. The user can turn it off becuase it comes with a pretty point and clicky window for them to do it with. Applications can turn it off because it comes with a freaking API that lets them do it. The Windows firewall is the kid with a "kick me" sign taped to his back.
Save your time - don't bother. It adds absolutely nothing to the body of knowledge. It reports that it blocks all the ports very adequately. It also reports that it doesn't block outgoing connections from your computer! Really? Well that has been common knowledge for the last year. Windows Firewall only blocks incoming connections. This doesn't mean it is less than adequate. It does point out that Windows responds when certain standard port connections are attempted. This is a good compromise, but hardly a hole in the firewall - it is not a hole in a firewall to block connections using certain standard ports. And as for stopping the firewall using another Windows command - absolutely no evidence supplied. FUD!. Windows Firewall is pretty good.
Hi;
The Windows Firewall is probably adequate if you only have a single computer and are connecting to the internet.
It is not built for network (ICS traffic bypasses any ICF filters) and so has absolutely no value for perimeter value.
Like most commercial products from Microsoft, supportability in Windows Firewall is more important than security. If you need security over supportability by Microsoft staff, this is not the product for you. But it is not bad for what it does.
It also has no outbound controls, unlike other personal firewalls. This is a slight issue, but I don't think it is major (what about hijacking IE to make the connections?)
LedgerSMB: Open source Accounting/ERP
"Basic clue about CS -- it's a good thing."
Definitely. And while we're at it, maybe we should send the flexbeta editors a one-line shell script that'll disable the OpenBSD packet filter. I'm sure watching their heads explode would be fun.
What the hell do users expect if they run trojans under admin-accounts... "the API used to manage the Windows Firewall could also be used by attackers to modify the software or turn it off." Ya think??
My Sig: SEGV
Windoze 9x/ME/2000/XP PC + New high speed cable connection + No firewall + No anti-spyware + No anti-virus + Kazza = The Killer CombinationTM!
Seriously folks, get yourself a decent firewall, don't trust Internet Connection Firewall in Windows XP, get anti-virus, get Spybot, and DITCH IE!
Lots of us told lots of people at Microsoft that integrating the MS HTML control in WIndows Explorer was a horrible security risk, way back when they first did it. They also knew that it was likely to cause legal probelms. They still did it, because they believed the danger of an independent application platform (which is how they saw Netscape and Java) was too high to be risked. Even if they had a certified message from Bill Gates 2004 to Bill Gates 1996 about the risks, they would probably still have done the same thing.
Microsoft doesn't care about any problem that doesn't hurt their bottom line. It's rare that any company does: that's just part of being a limited liability corporation. And in 1996 and 1997, security wasn't an issue, it didn't win sales, so they didn't care.
I want to cover a few definitaions that aren't in the article. If they are using different definitions for these terms, they are going to confuse a lot of people (and may be confused themselves).
For the 'Connect' scan, the tester will have sent a 'SYN' packet to the port being tested. The 'Stealthed' ports will have sent back no response at all. The 'Closed' ports will have sent back an ACK/RST packet.
For the 'SYN' scan, the tester will have sent a 'SYN' packet to the port being tested. The 'Stealthed' ports will have sent back no response at all. At this point, the 'SYN' scan is identical to the 'Connect' scan, so the 'closed' ports should have sent back ACK/RST.
This leads me to believe that either the testers system was broken, the target system firewall was in a different state during the SYN scan, or there is something really weird going on there.
As for the 'Turning Off' claim, that appears to be when the user or process has admin rights. As with the ludicrous Trend Anti-Virus 'vulnerability' posted to Bugtraq last week, it's unreasonable to expect software to 'defend' against being reconfigured or turned off by an authorised administrator.
I've just realised I'm defending M$ here
In any event, it's obvious this is not a cure-all since it won't block outgoing connections. But it's still a big improvement and ought to immunize XP users against at least one class of attacks. In fact, coupled with a virus (especially an email virus) scanner it ought to wipe out 99.95% of all Windows desktop compromises. That's a pretty damn big step and we should credit MS for taking it, even if it doesn't go quite as far as we'd like.
It doesn't matter whether you're on Linux, on Windows, or on anything else, a firewall has to be outside the control of the objects it's protecting against. For Windows Firewall to protect against local applications, it would have to be running outside the security permiter around those applications.
I don't care if you're Windows Firewall or Zone Alarm, any settings the user can change an application can also change, because no application that the user runs can have any more rights than the user. Whatever the user interface application does, another application can do as well.
Wrong. The security console, by default, will pop up a warning that the firewall is inactive. I've seen this myself when diabling the firewall for even a single connection. The only way to disable the warning is to turn off firewall status monitoring.
So we all complain that SP2 is taking far too long to come out. Then we complain it's far too complicated to deploy, so we don't install it. Then once we do, we immediately complain it's not good enough.
If it's not good enough, why didn't we all complain during the last 14 or so months when it was still in development.
FWIW, the built in firewall is better than the firewall in my router, in that it can open ports based on program, instead of statically keeping them open. Neither have outbound protection. Since most home users have only the router, if that, I'd say it's a step in the right direction.
Also, keep in mind that adding a full featured ZA-style firewall might risk more anti-trust lawsuits.
-Ryan
AUWYHSTOT (Acronyms are Useless When You Have to Spell Them Out Too)
It's incredible how ignorant and misleading this article is.
.NET code), it can do ANYTHING I can do. That includes turning off firewalls.
First of all, if the user using the machine is running as an admin, there is ABSOLUTELY NO WAY TO PREVENT THE FIREWALL FROM BEING DISABLED BY A 3RD PARTY PIECE OF SOFTWARE. Period. Guess what! Zonealarm and Symantec's stuff has the same 'fault'. If I have admin privs, and I run a piece of software (unless it's managed like
Software running as a non-admin user CANNOT TURN OFF THE FIREWALL. That's all you can expect.
Second, outgoing protection just makes stupid people feel better. Any programmer with a clue can write software that gets around outgoing firewall protection. It took me about 20 minutes with VB (yeah, VB!!!) to write a proof of concept app that is able to do whatever it wants on the net even with Zonealarm installed.
The only way to reliably restrict outgoing communications is at the borders of the network, not on the machine generating the traffic.
All this FUD makes me sick.
> Simply the fact that Windows Firewall can be turned off by another application is enough to tell me Microsoft has goofed again.
Balls. The fact the Windows Firewall can be turned off makes it exactly the same as every other personal firewall, including ZA and Sygate.
Malware has been disabling the firewalls of machines it infects for years. It is simply not possible for a firewall to remain an effective security measure on a machine where hostile code has been run at the same level of privilege.
Once the attacker's code is running on your machine, the game is over and you have lost. Until we get full operating-system level sandboxing (whereby applications and users are fully protected from each other's interference until the user/admin explicitly grants rights), this will always be the case.
The main difference between the Windows Firewall and other personal firewalls is that it only blocks incoming traffic. But so what? An outgoing traffic block is of no use if the outgoing traffic is generated by hostile code on the local machine, as it can just as easily shut the firewall down completely.
Other firewalls still provided the feature because it figured most malware wouldn't bother detect and kill all the different brands of firewall. But Windows Firewall, soon to be very widely installed due to its default-on nature, would present a much more attractive target; soon every new virus, worm and piece of spyware would turn the block off as the first thing it did. Therefore the feature would be offer zero additional security.
Flexbeta's reviewer seems to have grasped the vocabulary of security countermeasures with no actual grasp of their practical implications. In summary: feh.
Contrary to what Flexbeta says, I suggest it's a better idea to first get the new firewall package, disconnect from the internet and then switch the firewall off before installing and initiating the new one.
Switching the firewall off [no matter how weak it is] while connected to the net will open your machine up to all sorts of problems.
Actually I was surprised by the Windows Firewall, it wouldn't let my laptop on my wireless subnet connect to my desktop on my wired subnet because by default the SMB ports are restricted to "local subnet only". I had to put in a custom filter that covered both my subnets to let me connect.
I didn't use v4 for long before I went back to v2, but I've switched to Sygate Personal Firewall recently as it (Kerio) for some strange reason started to crash. Sygate's FW is nice and all, but its advanced rules configuration system is still somewhat annoying. For some reason it appers to be impossible to create a rule or set an option that blocks any traffic that isn't explicitly allowed *sigh*.
If you can tell me that Kerio v4 has dropped the horrid user interface, I'll probably have a look at it again.
________
Entranced by anime since late summer 2001 and loving it ^_^
In Linux land most users run apps (esp untrusted ones) as a normal user and not as root. (the obvious exception is lindows which is evil incarnate)
Firewall rules can only be changed as root.
Because of the extensive use of Linux in shell hosting enviroments Linux is fairly robust against local exploits. Windows is still terribly weak to local privlage escilation.
Obviously there are ways around (say sabotaging the users enviroment and tricking them into giving the software root access), but it actually makes things harder on Linux. It's not worth the bother on windows.
Not only does windows have greater need for security measures (due to the allure of a large uninformed userbase) but they continue to lag behind.
For example, SP2 has added nx support... which enables non-executable stacks on Windows but only on some CPUs (which have just started coming out).
Compare this to RedHat Fedora. Since FC1 fedora has had exec-shield. Not only does execshield feature non-exec stack, heap, protection buffer zones, libraries mapped with a 0x00 in their address, address space randomization for all parts of the binary, but it even provides all this on old hardware.
Such patches have been available for Linux outside of distros for years. Solaris has even offered non-exec stack for years.
Microsoft is inexcusably behind.
For god sakes, what do you expect of them? They are not in this to make slashdotters safer, they know we can defend ourselves just fine. They have a firewall that, while not perfect, is easy enough for the average and new user to use and provides a decent amount of protection. No its not the second coming but I don't think they ever intended it to be. They did what needed to be done and I applaud them for their effort and end product.
MS bashing on here never bothered me until SP2 came out when A LOT of people mainly wrote it off as crap. They did a damn good job this time and a lot of you people should stop bitching about them.
Mac OSX has a firewall supplied which does exactly the same - inbound connections only with an option to open ports for file sharing, remote desktop etc... except NOT enabled by default.
Again, if you're using it for serious stuff you'd add a hardware FW at the network perimeter.
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
For the most part, if you're a savvy user you already have firewall software or are protected in some other fashion. What SP2 is aimed at is the unwashed masses who just have their Best Buy and Walmart boxes directly connected to the Internet with no protection at all.
If anyone reading Slashdot *needed* SP2 to make their XP system secure you should be ashamed of yourself. =)
So while it's not perfect, it's a situation where anything helps.
This also leaves the door open for other vendors who want to provide better or different firewall solutions. Ditto with not adding AV software.
Remember, unlike Apple and Linux distros MS can't bundle much into their OS unless they want to get dragged back to court...
dude, i just scanned that ip address. they are so weak! nothing blocked. im gonna have fun haX0ring that all night! thanks d00d!
A firewall should NOT need to be an extra application, it should have been part of the system when it was first concieved.
Hows about, a firewall should not be implemented in software on the same pc its protecting.
But it sure is cheaper and easier than buying a hardware firewall or buying/setting up a dedicated software firewall.
To make laws that man cannot, and will not obey, serves to bring all law into contempt. --E.C. Stanton
Is still around 10000000 times better than no firewall.
Microsoft did the right thing by letting the firewall be turned off by another program. Otherwise, people who install SP2 and already have a firewall would be pretty screwed up. Two software firewalls on the same machine is never a good idea.
What really pissed me off was the comment that Zone Alarm people gave that a worm could turn off the firewall. OK....A worm could turn off their product too.
There has also been criticism that the firewall doesn't block outgoing connections. I guarantee you if they did do that, firewall manufacturers and "Type A" slashdot readers would be crying anti-trust.
I don't know how well these people know TCP, but the results they report aren't possible as far as I can see. If the NetBIOS ports report closed on a connect scan (i.e send a reset in response to the SYN, or a reset to the first ACK), they cannot be "stealthed" against a syn-only scan, since they would get the reset there too.
By using the native System Preferences panel? No, it sure doesn't. But you can write your own firewall rules and load them from the command line or use a 3rd party GUI to configure them. Of course these rules would apply to all programs. To block outgoing connections on a per application basis, you'd have to use Little Snitch
I actually do this when I play UT2004 on one of my old boxes that's still running windows. Of course I also disable the network connection when I do this and restart the firewall when I'm done....
;)
It must be a royal bitch to play UT2004 online
Join the TWIT army now!
Every Microsoft Conf. that I have attended in the last 8 mos has stressed that with the Firewall installed and turned on in a windows XP machine. They strongly recommend running another Firewall appliance in additon to this. Such as ISA or a Hardware solution. Or both. The firewall is designed to supliment your other security measures not replace them. The reason file sharing ports are enabled is because of complaints microsoft had recieved of the firewall breaking netbios.
Find me something that -can't- be turned off by another application, if you know how it works?
That's a really lame complaint. If a program has the proper authorities, or can hack the proper authorities, then of course it can stop the operating of another application.
In Unix, they call it "kill".
How many Windows viruses will auto kill your task-window process whenever they see it come up? I bet lots of them. Same deal.
While delousing Windows boxes, I usually find myself downloading the least popular anti-virus programs I can possibly find to do it, because then I am usually able to get it running on the machine without bringing the whole system down.. any good virus would automatically kill norton, mcafee, and other popular virus scanners..
and even if you can't kill the running process, if you have access to change the configuration files, then you can effectively take it down that way as well..
think about your complaints before you make them!
"Champagne for my real friends - and real pain for my sham friends!" http://ericblade.postalboard.com/
The vast majority of computer users -- Windows, Linux, OS X -- lack the knowledge to correctly configure a firewall. They also lack the will and intent to acquire that knowledge. Almost all computer users don't have the foggiest notion of how IP networks function, and will never acquire that knowledge.
Badmouthing Microsoft for rolling out a less-than-perfect firewall is more than a bit hypocritical when much of it comes in the form of kneejerk ritualistic abuse from open source users who couldn't implement a firewall if it involved anything more complicated than selected "Yes" during their Linux installation.
Insecurity on the network is, in the end, a human problem. Computers do what they're told. The only effective solution is to go after the behavior and the people who cause the insecurity.
-- Slashdot: When Public Access TV Says "No"
Simply the fact that Windows Firewall can be turned off by another application is enough to tell me Microsoft has goofed again.
That's horrible, horrible logic. I'm supressing lines of cursing and name calling due to that little line you just spouted because it is just plain stupid to say that. For one, pretty much any program can do anything it pleases if the user has permission to.
What 90% of people forget is that the great majority of users are running windows in an administrator's permission set. It's just like someone running their linux box as root. You run a certian program, you're screwed.
Give me root permissions on your unix machine and I'll write a nice little script, not even a program, to do lots of nice little things to your computer.
The one thing that drove me nuts about setting Joe SixPack, Computer Luser, up on a software based firewall is that it would check with them each time their computer tried making an outbound connection to anything. This happens a lot when the software first gets installed; but a dangerous thing happens.
People get rapidly conditioned to click the yes button, to permit the traffic to pass, because they quickly find out that if they click no, something breaks (i.e. IM Client).
What happens is that users become afraid to click no, for fear of breaking something - which effectivly negates the integrity of the firewall.
It appears that MS has integrated it pretty well into windows (duh, would you expect anything else?), to allow dynamic opening and closing of ports without having to confirm each connection with the user.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
...of VBScript code to turn it off:. FirewallEnabled = FALSE
---------------------
Set objFirewall = CreateObject("HNetCfg.FwMgr")
Set objPolicy = objFirewall.LocalPolicy.CurrentProfile
objPolicy
A customised linux firewal distribution like Smoothwall, ClarkConnect or eSmith would be by far the easiest way for you. They are generaly very easy to setup and require little to no linux experience.
Under some of these distros, the file erver can be the same machine, but it is no reccomended. Every service you add on the forewal machine increased the risk of a vulnerability. Most of the time you would be fine, but there is still a risk.
The firewall PC can be very low powered - Pentium 100MHz with a 2GB drive or less. Your file server may want to be much higher spec'd.
and here's why. If Microsoft gives you a basic port blocker and says "here. this isn't a network level firewall solution, but it will help a little", then it's not their fault that you were 0wned. It's your fault, because you're on a network that doesn't have proper security precautions. If Microsoft gives you a port blocker/firewall with some serious kung-fu, guarantees you're secure, and someone breaks it... then it's Microsoft's fault, 'cause they said it was secure. MS seems to care about its image with regard to security, anyway, which is an improvement...
of course, pcflank.com didn't find anything to worry about on my computer. then again, my computer's a mac... (no, I don't care about karma, do what ya gotta do)
Karma only matters to me now and zen.
"Simply the fact that Windows Firewall can be turned off by another application is enough to tell me Microsoft has goofed again"
Any 3rd party filewall could easily be turned off by another application as well. It would just have to end the process and there are about 9 different ways to go about that in windows.
Hikery.net - The best hiking site ever. Made by yours truly.
Obviously so-called "personal firewalls" suffer from a few problems.
...) makes some people feel more secure, hence drive less careful. The same applies to PFWs, especially with users who aren't that knowledgeable in computer security. Those also suffer from the fact that PFWs are often difficult to understand for them, so user error may also contribute to reduce the security provided.
They run on the exact machine they are supposed to protect, often under the same user account (since Windows programs often want to run as Administrator, so lots of people have administrator privileges on their "normal" accounts).
Obviously, they can therefore easily be defeated by trojans.
Then there's a few social problems. Having a car with additional security (big crumple zones, ABS, SIPS, airbag,
A big point is, PFWs are not trivial to write and test, and often have to run as superuser. This can actually mean that they introduce new security holes.
Free as in mason.