Slashdot Mirror
How Secure is Windows Firewall?
Garret writes "Though Microsoft is doing their part in protecting Windows users from internet attacks by including a firewall in their latest service pack, one has to wonder just how secure is the Windows Firewall from XP Service Pack 2? Not too good according to Flexbeta. Their recommendation is to turn off Windows Firewall and get an alternative such as ZoneAlarm or Sygate PF. Simply the fact that Windows Firewall can be turned off by another application is enough to tell me Microsoft has goofed again." PCWorld also has a story about the new firewall capability.
Kerio Personal Firewall is much much better.
Why are windows users so obsessed with "stealth"?
It's annoying on two levels, firstly it breaks the requirements of the rfc's leaving other nodes on the network hanging waiting to see of a connection is going to succeed or be rejected, waiting for timeouts isnt fun. secondly, THERE IS ABSOLUTELY NO POINT, it is trivial to find out if there is a node at that address, all sufficiently intelligent scanners can tell if there is a machine there, nmap for example. YES WINDOWS USERS, I'M TALKING TO YOU, get rid of that stealth crap, if there is no machine there the nearest router will return no such host...if there's no icmp from the router, we know that there's a windows user there (of course, we cant determine the operating system of the node, but everyone knows only windows users do this)...
It's pointless, it's only used because having a "stealth" computer sounds cool on proprietory firewall marketing material (would it be so desirable if it were called "filtered"), please turn it off...
With the firewall, and the security center it was using an extra ~20 MB of memory that I need to play Doom3 faster!
If you build it, nerds will come. Soylentnews.org
I've installed SP2 on two machines now. In both cases SP2 had me reboot, and before offering a log-in prompt it presented a screen where I could enable or disable automatic updates. This is an administrative setting, and it should not have presented itself prior to an authenticated login. Sure, it only happens once, but by design it violates secure computing practices.
-Chris
-- This sig is only a test. If this were a real sig it would say something witty. --
So for average users XP firewall is a good thing since you don't have to know anything, but we (Slashdot users and internet savvy) demand more.
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
Wait, a commercial firewall developer thinks Microsoft's free firewall isn't up to the challenge? Wow, what a surprise! What if Microsoft had put a full-fledged firewall into SP2? The same companies would be whining about how Microsoft bullied them out of the market.
Hi;
The Windows Firewall is probably adequate if you only have a single computer and are connecting to the internet.
It is not built for network (ICS traffic bypasses any ICF filters) and so has absolutely no value for perimeter value.
Like most commercial products from Microsoft, supportability in Windows Firewall is more important than security. If you need security over supportability by Microsoft staff, this is not the product for you. But it is not bad for what it does.
It also has no outbound controls, unlike other personal firewalls. This is a slight issue, but I don't think it is major (what about hijacking IE to make the connections?)
LedgerSMB: Open source Accounting/ERP
My box has never been hacked into.
This can also be read as:
I never got a popup reading "ZOMG! J00ve b33n h4xx043d by da ch1n33z3!!1!1one!eleven lolololz"
It's incredible how ignorant and misleading this article is.
.NET code), it can do ANYTHING I can do. That includes turning off firewalls.
First of all, if the user using the machine is running as an admin, there is ABSOLUTELY NO WAY TO PREVENT THE FIREWALL FROM BEING DISABLED BY A 3RD PARTY PIECE OF SOFTWARE. Period. Guess what! Zonealarm and Symantec's stuff has the same 'fault'. If I have admin privs, and I run a piece of software (unless it's managed like
Software running as a non-admin user CANNOT TURN OFF THE FIREWALL. That's all you can expect.
Second, outgoing protection just makes stupid people feel better. Any programmer with a clue can write software that gets around outgoing firewall protection. It took me about 20 minutes with VB (yeah, VB!!!) to write a proof of concept app that is able to do whatever it wants on the net even with Zonealarm installed.
The only way to reliably restrict outgoing communications is at the borders of the network, not on the machine generating the traffic.
All this FUD makes me sick.
Like the advice wilderness survival instructors have about knives. What's the best survival knife? The absolute best? It's the one you have with you. All the others are useless.
Being installed by default is a "feature" more important in real life than any other.
(Yes, I'd run something else in addition).
> Simply the fact that Windows Firewall can be turned off by another application is enough to tell me Microsoft has goofed again.
Balls. The fact the Windows Firewall can be turned off makes it exactly the same as every other personal firewall, including ZA and Sygate.
Malware has been disabling the firewalls of machines it infects for years. It is simply not possible for a firewall to remain an effective security measure on a machine where hostile code has been run at the same level of privilege.
Once the attacker's code is running on your machine, the game is over and you have lost. Until we get full operating-system level sandboxing (whereby applications and users are fully protected from each other's interference until the user/admin explicitly grants rights), this will always be the case.
The main difference between the Windows Firewall and other personal firewalls is that it only blocks incoming traffic. But so what? An outgoing traffic block is of no use if the outgoing traffic is generated by hostile code on the local machine, as it can just as easily shut the firewall down completely.
Other firewalls still provided the feature because it figured most malware wouldn't bother detect and kill all the different brands of firewall. But Windows Firewall, soon to be very widely installed due to its default-on nature, would present a much more attractive target; soon every new virus, worm and piece of spyware would turn the block off as the first thing it did. Therefore the feature would be offer zero additional security.
Flexbeta's reviewer seems to have grasped the vocabulary of security countermeasures with no actual grasp of their practical implications. In summary: feh.