Slashdot Mirror
Personal Firewalls Mostly Useless, Says Mail & Guardian
hweimer writes "More and more security researchs come to the conclusion that personal firewalls are ineffective in controlling outbound traffic. An article in the Mail & Guardian online mentions a test that 'showed that the software often causes more problems than it solves. Not one of the six firewall programs the magazine tested, regardless of whether commercial or freeware, could prevent all attempts from the test programs at establishing outgoing connections between the PC and the internet.' Simple PoCs are available, too."
More and more security researchs come to the conclusion that personal firewalls are ineffective in controlling outbound traffic.
The article's about personal software firewalls, not personal hardware firewalls. Furthermore, the fact that personal software firewalls are useless and buggy is not really a new discovery.
Push Button, Receive Bacon
Well, that's what happens when you try and introduce a complex topic like network security into the consumer market, and subsequently fail at that task. They (the software manufacturers) fail not only in raising a suitable amount of awareness (if every single computer on the planet was behind a firewall, how many worms/malware would this stop?), but they also fail to do the job properly (not blocking outbound traffic) for those who do install their software.
There is nothing interesting going on at my blog
As a lesbian, I must protest to this offensive and disparaging comment.
Yes, they may be ineffective in controlling outbound traffic. However, that's not the real point of a personal firewall.
Without a personal firewall, users have a huge issue with inbound traffic when it comes to security, especially in the Windows "territories." I'll never forget the day that I left open an unpatched WinXP box after a fresh install. I watched all of the script kiddies and automated worms go at it from my passive OpenBSD monitoring box. That machine was hacked in under ten minutes just because I left it there, open to the Internet. So, useless? No.
Not one of the six firewall programs the magazine tested, regardless of whether commercial or freeware, could prevent all attempts from the test programs at establishing outgoing connections between the PC and the internet.
First, nothing is perfect. Second, if some nasty program/spyware/adware got in, then it's too late already. The best thing is to prevent them getting in to begin with. Besides, most people don't know the difference between what should and should not be allowed to have access. I do some tech support for friends and family and it really gets annoying after the fifteenth call, "Should I let FooBar21.exe access to the Internet?" I finally went with the policy of disabling any sort of outbound filtering in whatever firewall I setup for people I will be "supporting."
Personal firewalls do not block outbound connection because it is a pain in the ass to decide what can pass or not. I mean, did you ever try some windows firewall that allows that? You get hundred of warnings from obscure services trying to send unknown data to somewhere you do not want to know. Users are clueless about it, they will just check the box that say "shut up and hack by box" if it prevents further messages from appearing.
Stupidity is the root of all evil.
Defeat that, muthafugga!
A firewall is a *device* between a device that needs 'protection' (usually a Windows PC), and an Internet connection. Keyword *device*, as in a seperate physical piece of equipment. A piece of software running *on* a Windows PC is as vulnerable as the underlying system it runs on. Eg, completely useless. 'Software Firewall' is an oxymoron.
Not running Windows, but instead running either a proprietary platform or (preferred) something unix-based. The simplest is a simple one-way NAT (outbound connections allowed, inbound connections impossible without a specific, intentional mapping). These of course only protect against active outside attacks, and not against trojan/virus emails or websites visited from the PC. The most effective method of avoiding those is to avoid use of and remove (to the extent possible) all Microsoft email clients and web browsers from the PC.
Seemed the intention of firewalls originally(at least for personal use) was to keep people out.
As people began to get broadband and leave there computers hooked up and turned on all the time it
became important to have a firewall in place(hardware at least) to keep a low profile on the net.
Cause for awhile people were getting there home computers hacked into that didnt have a firewall
in place.
Seems they work at least some what in that respect. As for trying to get out and off of your computer
that might be a job for something else perhaps?
Blocking outbound traffic really sucks, especially things like norton that reblock you online game every time
the exe gets patch. But most of the time the game launches and locksup because you cant see the box to let
pass. And there is no, allow always all the time, so every patch causes the problem.
ah well, I think some common sense is in order on what you download and what you run on your own machine.
it just seems to me that the imperfection of anything man-made will only ever get you at best a 99.9% solution. Just use some common sense and pick your software and hardware carefully to close that gap as much as possible.
Did they test zonealarm? Because even with my best efforts to circumvent it (for testing), it's still able to block everything. Even as an Admin user, it's not possible to stop the service unless you "officially" exit the program. I've been using it for years, and I haven't once ever had a program that it didn't block (if I chose to block it). Even test software which was spesifically meant to try to find holes in personal firewalls. The new version does other handy things too, like keeping an eye on software which tries to monitor your keyboard/mouse (such as keyloggers) and giving you the option to block them from doing that. Very handy.
Blocking outbound connection from a computer is pretty silly initiative in any case. Firewalls are for blocking inbound connections and for enforcing policies between networks (e.g, between the home network and the internet). Only in the latter case does blocking outbound traffic matter, and only as a last ditch "woops, I forgot to restrict this service so now I'm broadcasting sensitive information to the world!" sort of thing. It certainly doesn't hinder worms and their ilk much. And don't get me started on that silly checksumming of applications :)
Religion is regarded by the common people as true, by the wise as false, and by rulers as useful.
I'm just curious, since the article doesn't mention it, but which firewalls were tested? I've look at the website for the magazine that did the testing, but my German is rather rusty and I can't seem to find the original article. The only one mentioned in the article is the Windows XP firewall.
I stole this sig from a more creative user.
The personal or desktop firewall is not supposed to be your first line of defense, it's supposed to be your last line of defense.
I recommend that people use both a hardware and software firewall, the hardware firewall protects you from the Internet in general. The software firewall protects you from the other computers on your local network.
But when it comes down to it, a firewall is as strong as it's weakest link, which is almost always the enduser. Running as admin while browsing, downloading software from untrusted sources, don't blame the firewall for user stupidity.
Not one of the six firewall programs the magazine tested, regardless of whether commercial or freeware, could prevent all attempts from the test programs at establishing outgoing connections between the PC and the internet
Yeah, what a drag that their software is not completely immaculate. Let us know when you code the world's first perfect application, sparky.
And how exactly does "not perfect" translate to "useless" again?
Most of the "secured" computers I've seen have 3, 4 or more firewalls installed and "working". If one firewall isn't stopping outbound connections, go install another one, you'll be twice as secure then.
Deleted
The article (to my view) didn't mention any of the names of the programs, and I don't speak or read German, so I don't know how to find the names.
But I would swear by a nifty little app (for mac), Little Snitch which does seem to block both outgoing and incoming traffic perfectly.
It has been a nervous year, with people beginning to feel like Christian Scientists with appendicitis.
Most in the IT business have known this for years. Microsoft only makes the issue worse by fooling the general public into accepting that the firewall in Windows XP is sufficient to keep them safe. McAfee is one of the few players with a good personal firewall that manages to lock down the system pretty well but it's definitely too complex for the average user. There isn't much that can be done until the general population gets more educated as time goes on. In the meantime, it's job security for IT people.
WORK HARD, millions on welfare are depending on you!
Mac users don't think you are safe because you aren't running windows. It's amazing the number of Apps that "phone home". A great tool for Mac OS X egress filtering is Little Snitch. It's cheap and easy to use.
Strange women lying in ponds distributing swords is no basis for a system of government.
The article makes a number of critical errors that impact its credibility.
The article expounds on the dangers of Javascript, but fails to mention ActiveX. I suspect the author had heard about "scripting" being a security hole and assumed incorrectly that the other person was talking about Javascript. JS is inconsequential compared to ActiveX when it comes to actual risk.
Additionally, when it claims that AV software essentially supersedes any firewall in terms of protection, it fails to consider the security nightmares in Windows. Specifically, through the trust relationships, you can modify registry settings and execute code on computers without your viral code ever touching the disk on the machine by doing it remotely from another computer. Because memory scanning is essentially ineffective, modern AV programs cannot effectively protect against this, which is why most security companies suggest combining AV with a Firewall. Plus, there are regular buffer overflow exploits that have the same effect: Code running without touching the disk. Where do they come from? Over the wire. Code Red and Nimda are good examples of attacks that were stopped by even the most basic firewalls. Safe browsing had no effect whatsoever on whether a user was infected.
Finally, the article fails to take into consideration the thought that goes into the automatic rule creation most firewalls come with now. Developers understand that users demand convenience and security, and work to find a good match of both. To this effect, most modern desktop firewalls will use signature based rules (so that a malicious program has to do more than just be named after a trusted program) to create a basic rule that allows that program outbound access. The ports are not being just "left open" willy nilly, they are connected to known programs and watched. Some firewall programs even watch for threadjacking malware that would inject itself directly into trusted programs, that gives even more protection.
The author of the article should reevaluate his or her knowledge of internet security. It is likely that the increasing ease of use has been interpreted as a drop in protection, but this is not the case. A secure system is one that uses a heterogeneous mix of disk and network protection.
A fundamental concept in computing now-a-days is that software designers attempt to do as much thinking for the end user as possible. This is a generally good thing, as the easier/more-intuitive software is to use, the more people will use it. That point aside, this can be a negative thing as it keeps users from needing to understand what they are actually doing. Using computers NEEDS at least a basic understanding of what's going on.
I don't mean everyone should study the TCP/IP stack and fully grasp ports and such, but seriously....you can't just show someone what a car does & explain the controls and then expect them to be able to drive properly & safely. It takes training & study.
The same is true with computers. I'm not suggesting an 'internet license' or anything, but I would recommend that high school core classes at least provide the basics of the underlying fundamentals of computing. Until someone understands what those firewalls are for, they will never reach a truly useful state.
Brad
So if I have a hardware firewall in my router is a software firewall useful as a last ditch defense? Or is it nothing more than an annoyance and resource hog?
Download my free songs!
Could not find the list of the six software tested. Dont know if Zone Alarm was tested and found to be defective too. But I would be surprised. Everytime I update FireFox, Zone Alarm knows that the exe file has changed and alerts me to renew permission for it to connect to the internet.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
FTFA: Users who still prefer a firewall should first check whether they are using a router with firewall functionality. If so, then no firewall is needed, including the one build in to Windows XP, reports PC Professionell. As far as I'm concerned, the main purpose of using personal firewalls is to prevent unwanted outbound connections, for example from Microsoft products. Hardware routers only block incoming traffic, and can't do it on a per-program basis. The article is too quick to dismiss personal firewalls for not being every man's savior.
But that's not why I use a personal firewall. I use a personal firewall to prevent "non-malicious" software from phoning home, running automatic updates, checking licenses and all that other crap which might inconvenience me if it happens at the wrong point in time. To keep nasties out I have a hardware firewall.
I always get questions, especially from my college friends, about what AntiVirus software and Firewall I use on my Windows machines. And to be honest, it stuns me to see them stunned when I tell them I use neither. This BSI Agency pretty much summed it up in the middle of the article:
Granted, "safe surfing" changes from household to household, but people who are using the internet should at the very least have the slightest idea on what they should be clicking on. All of the browsers today come defaulted to spit out warnings whenever someone is clicking on, say, an EXE file. Of the general users I've seen surfing, these warnings are normally defaulted to the 'x' button which is entirely "unsafe surfing."
I do, however, have my router set up to block outgoing traffic to certain domains as well as connection types that I know my family will never use. Upon request, I go out to friend's and neighbor's houses to set that kind of stuff up for them, because having to walk them through it would be hell, much less trying to explain what I was doing. Firewalls and AntiVirus software aren't exactly very user-friendly; people would rather install them and expect them to work rather than read through heavy material and configure them to fit what they need.
The issue with most desktop software firewalls that attempt to control outbound connections is that they have no idea in advance what constitutes a valid program and what doesn't. So they ask the user, who in most cases is unable to answer the question. The only information typically provided is the executable name, and in many cases it's a generic one (like svchost.exe) that leaves even an experienced user without the ability to make an informed decision.
The problem is that this trains users to ignore the prompts and habitually click "allow" or "deny" (usually because they find out the hard way that stuff breaks when they click "deny"). The result is far worse than if there were no attempts to control outbound access, because most of these firewalls (Zonealarm in particular) use similar techniques for *inbound* traffic too... they will prompt the user when a program opens a listening port, and if they hit "allow" will enable global inbound traffic to that port, creating a hole that otherwise wouldn't have been there.
This happens regularly in practice- I've seen it over and over again with my small business consulting clients. Although technically an outbound software firewall with program control could be a good last-ditch effort to block malware that has managed to get installed and running, on a practical basis they cause more problems than they solve.
-R
Use the "printable" version of stories when it's available! That link from the slashdot summary made my eyes burn because I didn't have that site adblocked.
i nsight_tech/&articleId=275381
FYI: http://www.mg.co.za/printPage.aspx?area=/insight/
It's not that difficult to do!
Once malware is running on your PC you should assume it can do ANYTHING it wants, including disabing firewalls/antivirus, etc.
Heck, Windows Firewall has an API to allow programs to add themselves as exceptions (probably because if it didn't programmers would just use 100 different non-forward compatible methods to do it).
I haven't found on TFA , but then again i read it on a rush because my boss was in the room, but i guess they performed the test the way most regular users use a personal firewall.
This means press install, press next, next, next,next, OK and done I have my own personal protection!
If you take the time to tune the software firewall, i'm pretty sure you would have much better results.
What is best in life? To crush your enemies, to see them driven before you and to hear the lamentations of their women.
I still remember the lone time I got virused, as it also was the lone time when I put a non-firewalled machine on the internet.
Basically the story is that I had managed to fry my home machine, didn't have a second computer at the time, but hey, looks like I got enough older parts for one (or a couple of them.) Stupidly enough, the firewall program (Sygate was my favourite at the time) was among the few things I had never backed up, but otherwise I could have a computer to play with in an hour or so.
Now I could have, of course, went and bought some security program, or could have downloaded it at work and burned it on a CD, or whatever. I chose to just do a sacrificial install instead. As in, you know, install Windows, go online unprotected long enough to download a firewall, reformat, reinstall Windows. I fully expected the first install to get virused, but that's ok, since it would get reformatted a few minutes later.
It also was Windows 2000, not XP, so no activation hassle.
Well... let's just say that what I didn't expect was how fast the thing got virused. I expected it to get virused eventually, yes, but it got owned within a couple of minutes. Scary.
A polar bear is a cartesian bear after a coordinate transform.
Hey, the article was oooold, dated back in "25 June 2006". If it were some great discovery, we should probably have come across it much sooner.
...and anti-virus scanners are not 100% effective. Given the continual cat-and-mouse game played by the white hats and the black hats, short of removing a PC completely from a network, there's little to completely, 100% guarantee security.
That said, many of the software personal firewalls ARE actually quite good. The people using them just need to understand the potential ramifications. Education of basic Internet security combined with good Web browsing and file handling practices can go a whole lot farther than blindly relying on a single product.
-Jim Barr
http://jimstips.com/
My mom always said, "Jim, you're 1 in a million." Given the current population, there are 7000 of me. God help us all!
I think the problem here is Software vs. Hardware firewalls.
Compair a Cisco PIX 501 to Nortons latest and greatest software firewall
Software firewall basically starts off blocking what it thinks are potential viruses or threats to your computer.
A hardware firewall such as a PIX 501 just blocks everything until you tell it otherwise.
A software firewall basically is a nusence with all its little security warnings "CAUTION Your getting on the internet"
Hardware firewall just stays out of the way and does only what its told to do.
The biggest of them both is the fact that software is so much easier to bypass than that of a Hardware firewall. Software only blocks what comes into your computer where as the hardware is there right when traffic passes your modem.
Also you get what you pay for...a PIX 501 runs around 400-500 where as norton with ANti-Virus is what...50 bucks? You basically get what you pay for and cant expect much more.
The greatest revenge in life is massive success.
Even though I'm behind a firewall, I use ZoneAlarm on all of my PCs so that I can catch what's communicating with the Internet and what's not. So far, it's done superbly well as far as I can tell.
For example, every time I play a media file in Windows Media Player, it tries to connect to the Internet not once but twice - once when Media Player fires up and once again after it's fnished! Excuse me? Exactly what is Media Player trying to figure out? Well, whatever it is, it's none of their damned business. Check "Remember this setting", click "Deny", and done.
Every time a process tries to act like a server, ZA also notifies me of that as well. It's a bit of a pain when I fire up a game server for the first time and the pop-up balloon interferes with the screen (whoops), but again it just shows that it's at least doing what it's supposed to do.
ZoneAlarm has its share of issues, but it clearly goes with the attitude of "better safe than sorry". There have been some rare times where the program itself doesn't start, for whatever reason, but its service gets started. On those rare occasions I've noticed that the service, if it can't communicate with the control daemon, or whatever you want to call it, it just blocks all network access. It could have just allowed everything instead and there'd be no way of knowing if it's working or not. Personally, I'd rather have it block all access. Not only does that let me know that there's a problem, but it's certainly keeping the PC's network connection secure.
Using a hardware firewall for inbound and ZA for outbound connections makes perfect sense as far as I'm concerned. It's not trouble-free, but they've been getting better at its stability over the past several revisions from what I can tell.
The Overrated mod is for reversing inappropriate, positive mods, not for voicing disagreement with a post.
Some of the problems with 'virtual firewalls' can be solved through real firewalls on ... virtual machines
(i.e. Sieve at http://sievefirewall.sourceforge.net/ or at http://www.vmware.com/vmtn/appliances/directory/24 5)
Sorry to say that this article was about as useful as a RubberBand Band. Now if they'd identified the tested apps along with version of Windows, I'd be more willing to even consider the article to be informative but no, they make so many claims about personal software firewalls not being effective in some cases. What Cases and what worms/trojans/malware was able to bypass them or what firewalls were able to be bypassed?
Now I was one of the original beta testers for Zone Alarm and while it isn't perfect by any means, it's still about the only useful one I've seen and I continue using it today and recomending it as being fairly effective at what it does. It's at least better then the joke MS includes called Windows Firewall, which doesn't even have any outbound control unlike ZoneAlarm, which is what I mainly use it for and no I'm not a windows user as I'm currently running KDE-3.5.2 on Gentoo with 2.6.17 vanilla-series kernel (default tree), instead it's to ease the load I have in supporting the other computers in the household that still run Windows as yet.
The worst offender in my experience is Norton Internet Security. It blocks everything, browser mail, MS Update everything! your just computer locks up for 30 sec - 3 minutes and then the goddamn little symantec pop up appears!
"Warning! Your computer is trying to make a connection to the internet, this is an unsafe act. Please press OK to reboot"
I have one holding open my bedroom door (for kitty) and it works great!
If slashdot, digg and friends were to link to printable versions, how long would it take for those sites either to remove the print version or to put their ads there?
Instant Karma's gonna get you, Gonna knock you right on the head (John Lennon, 1970)
This is why I run winpooch http://winpooch.free.fr/. It's not a firewall, but it does allow me to monitor my outgoing connections, and apply rules to them. For example, I can have it prompt me for every outbound, just announce when an outbound connection is established, or allow all outbound. Same thing with inbound. More complex rule sets are allowed as well.
It's not gonna save me from a worm itself, but it will tell me when I have a worm or rootkit making outbound connections.
And it allows me to use ClamWin to do on access scanning, tells me whenever an application tries to change the registry or system files, and provides a simple method to determine most of the potentially damaging processes running on my machine.
Best of all it's opensource.
Sometimes the best solution is to stop wasting time looking for an easy solution.
And where do you insert this "device" between your PC and the wireless router in the coffee shop or hotel romm in which you're sitting? Wave it around in mid-air or something?
Besides that, the most useful purpose of these things isn't against trojans that someone's running because they're an idiot, it's software such as media players insisting on phoning home (for example, the "Microsoft Windows Media Configuration Utility" connection attempt that occurs when WM9 tries to update itself).
Do you have a bladder-control problem, too?
Whoever wrote that was a dick!
---southpaw
The problem isn't that personal firewalls are useless. Rather, they are being marketed for a purpose they are not equipped to perform properly.
I use a personal software firewall on all my Windows machines for two reasons: one, to prevent worms and such from getting a foothold on my machine, and two, to prevent phoning home of "non-malicious" software that has no real reason to be connecting out. I've run a bunch of programs over the years that attempt to connect to some remote machine for some unknown purpose and were subsequently caught by the firewall. None of these programs have been malware per se, but the outward connection is something that I nevertheless wish to prevent. In order to prevent actual malware from connecting outward, I am very careful about what I download and run.
In fact, the only time that I've been nailed with malware in recent history was once when I hadn't installed a personal firewall and I VPN'ed through my hardware NAT router, thus exposing my machine to the full ill-will of teh Intarweb.
You comment makes me wonder how much measure of security I have in a simple home network setup that consists of the following: (outside-in viewpoint...)
sbc DSL home service (not fixed IP) DSL device old netgear 4port home router with DSL ethernet interface + 4 internal routed ports providing basic NAT services to home net and PPPoe auth to the DSL CO internally, windoze PCs not running any kind of inbound/outbound FW software.
So what's the risk level w/crackers and script kiddies being able to somehow traverse the NAT router setup to access my home net PCs?
A chain is only as strong as its weakest link. That's doubly true when it comes to protecting computers that are connected to the internet.
Yes, and thats generally the thing between the chair and the keyboard, not your firewall. Obviously a personal software firewall can't be perfect, but they do a pretty good job of protecting you from inbound traffic (hell, even the XP SP2 firewall does a decent enough job of this, try connecting an unpatched unfirewalled XP machine directly to the internet and see how long it takes). The best they can do for outbound is provide you with information about it and you can confirm/deny, unfortuneatly most people just click yes to everything. And if a computer has been compromised already and is trying to send outbound info, it was most likely the fault of the person who installed it without knowing what it is.
Also, the article fails to mention which firewalls were tested, or how, but they get on the right track at the end when they talk about malware being at its root a problem that requires a social solution, not just a technological one (though hopefully not having everyday users run as admin 24/7 in vista will help, if only slightly).
There are ways around personal firewalls, therefore personal firewalls are useless.
So says an article linked by an article linked by an article that I can't really read. Pardon me if I am not convinced.
I'm quite content with the personal firewall I have. It stops lots of outbound connections from applications that like to phone home. If there is an app on my system that searches for IE windows and uses them to surrepticiously send data out -- I'm already f*d. Fortunately, my firewall blocks IE so I'm not vulnerable to that one. (It could use Firefox though).
Quo usque tandem abutere, Nimbus, patientia nostra?
Okay, we are talking about Windows users: they will simply click 'Yes' to anything that pops up on the screen.
Click here or here.
My view has always been using a combination of things that help is th ebest idea. Using a router that has a hardware firewall + a software firewall + antivirue + a secure browser(firefox) is a decent way to keep safe. This won't stop everything, but it's better than surfing around with no protection. Also add not doing stupid things to that equation for maximum protection.
Meh, this is just more proof that PCs are just too hard for the average person to use. There's no way the typical user can easily follow the suggestions in the article. If anyone ever comes up with a good appliance-like device that does the things most people want to do online without worrying about viruses and trojans, the PC will be dead. I think that this complexity is leading into an era of coexistence for the home user wherein they resign themselves to sharing the computer with malware until it becomes unusable. Then they call for their favorite helpful neighbor geek, or just buy a new computer and start over again.
To the making of books there is no end, so let's get started
The cited article fails to either list the tested firewall software, list the tests performed, or even link to some place where that information is available. It is a statement of the obvious, well known facts that: (i) some software fails to perform even its designed function, and (ii) correctly designed software is often misconfigured to the point where it cannot perform as designed.
... but if average joe wanders down some dark internet alley without a condom on, its his own fault, whereas when average joe is going to a regular business site or using regular business software, the onus really should be on the publisher to disclose fully the risk, and to provide some tools to allow the user to understand what is going out.
The article further makes suggested solutions we have heard a thousand times, nothing new.
To meaningfully talk about security on a the average Joe's winbox, the focus has to come off average joe and be placed on the OS software companies, and on laws and rules (at least in the US) that utterly fail to require any software publisher to be responsible for either designing securable software, or providing adequate notice of the risks associated with installing or using software (or a website). Of course, malware and greyware writers will not follow those requirements
With respect to malware that attaches without user intervention, IMO, all outbound traffic ought to be opt in, not opt out by default on OS install, and turning that off ought to be as hard as cancelling AOL (i.e. next to impossible).
I don't have a sig line, sorry.
I'm so tired of this I blogged it a while ago
http://millionfirefoxconverts.blogspot.com/
Gizmos Gagets For Ninjas
I always get a kick out of people who set their firewall to prompt on every attempt to access the net, especially when they're running as admin on their boxes.
Even without the user running as admin, it's fairly easy to create a program to bypass outgoing firewalls. Basically the trick is it piggypack your communications over an existing application that's trusted.
Nearly everybody is going to trust IE (or Firefox, or whatever browser) to access the network. All you have to do is figure out a way to use that program to do your communications for you.
I once wrote a proof of concept app (in VB no less!) that used IE to do exactly this. I setup a simple piece of server software that accepted requests via HTTP GETs and returned the response as base64 encoded text in an HTML body. When my app needed to access remote data I just used IE to request that data from the server and then base64 decoded it. I could have also done something like have the server software act as a proxy so I could request any remote data I wanted, even if it wasn't hosted by my server. It was trivial.
The best part was that *every* major outgoing firewall failed to detect this attempt, despite that fact they claim to be able to tell when one application is using another to piggyback communications. Perhaps it was the way the COM interface worked, I'm not sure... but it never failed and never prompted me to allow it to happen.
Linux has IP Tables which is very good for the job. Is it as good as BSD? I would argue less time consuming if you already run Linux, but it's not the same.
e nt=firefox-a&rls=org.mozilla%3Aen-US%3Aofficial&q= iptables&btnG=Search
Notes: I believe for stateful packet inspection, the kernel needs ip_conntrack and a few other things in it. Most distro kernels have this but it's worth double checking. From there, it's learning the IP tables syntax which isn't hard after going through one of the many examples out there. Once you get logging going, check out intrusion prevention systems!
http://www.google.com/search?hs=3PG&hl=en&lr=&cli
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
The response I get (yes, I'm the guy who wrote the tutorial) is that people find it quite useful.
The fact that it includes a few tips on how to give spammers a hard time helps too I guess.
-- That grumpy BSD guy - http://bsdly.blogspot.com/
Of course, they aren't perfect. But I've a got a friend who was having a recurring problems with varioius malware. I set her up with Zone Alarm, Anti-Vir, Ad Aware and advised her to download Firefox to browse with rather than using IE. Without Zone Alarm to block the malware traffic while Anti-Vir downloaded updates to its signature files, her internet connection was saturated with so much malware traffic that she couldn't connect to anything else. Further, she gets to see what programs try to access the internet.
Personal firewalls are more to protect from inbound attacks. Not to restrict outbound traffic. Yes, it also helps to inform you what programs $M wants to let out. When I build a XP system and put it on the net to put $M patches on it, if I don't have a personal firewall, it will be own'ed before I can finish patching. That seems like a useful thing to me.
DON'T LISTEN TO THIS MORON!!!
I take no responsibility for what I say. Even though I'm never wrong
I think the problem here is Software vs. Hardware firewalls.
No, that's not the problem. The problem is you've chosen to ignore the fundamental flaw of Windows.
Windows 3.1, 95, 98, 2000, XP (Longwait??) were never designed to run securely. BSD/*nix's are, from the kernel up. Are they invincible? No, but no OS is. Are they meaningfully better? Yes, very much so.
Now, if you still insist on believing the problem is not your OS.
1. Not one of my home customers would pay for a firewall what they paid for their PC!
2. A pix is not a magic bullet. It's good at it's job, but the windows desktop is still very vulnerable. (activex anyone?)
Please, for your own benefit look at the facts with a little more objectivity.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
I love how, whenever I go to my grandparents to fix their computer (after they've dealt with their ISP's tech support) the ethernet cable is always running straight to the PC and bypassing the router. It's hard enough to get average Joe to understand the usefulness of a hardware routing/firewall device, but when the ISP is actively having them bypass it I can see a software firewall being somewhat useful at times.
Remember the Microsoft Advantage flap earlier this year? I do. I have a copy of WinXP Pro, paid for, registered, all eyes dotted and tees crossed.
Then I get the "you may be the victim of counterfeiting" or somesuch. What????? Oh, my, was I angry. How dare they? I think I actually posted some ALL-CAPS message to M$, insisting that I was holding the receipt.
Now I've just remembered that the machine also features the free version of AG firewall, and how I was very miserly in allowing services to "access the Internet". M$ services, in particular. Like I don't even get the pictures in the left pane of the Search dialogue.
So I turned off the firewall and clicked the hazy grey little star in the taskbar, you know, the thing you get after you tell it to shut up about your counterfeit version of Windows.
Of course I got right to the "congratulations" page. Then I got a lovely invitation to download some very helpful M$ software.
So I turned the firewall back on.
--
"I want more life, father." ~Roy Batty
"Press to test."
(click)
"Release to detonate."
Windows NT upwards (including 2000 & XP) was designed to run securely and has all the security features of Unixes. Windows 9x wasn't.
most ppl already have a dedicated firewall machine.
who is M&G? I never heard of such magazine so I don't trust them.
With that said, I have actually considered upgrading to Netgear Prosafe Wired Router.
\
Looking at product manuals for portable travel routers, I see lots of claims about "stateful packet inspection firewalls" and "NAT", but these only apply when the router is being used to share an Internet connection with the ethernet port connected not to one's laptop but to say a hotel's room connection.
Is there any of these products that does the following: I plug my laptop into the router's ethernet port, I am able to configure the router through its web interface, the router connects to a wireless access point, the router then functions as a router for my laptop providing hardware firewall services?
An incomplete defense is useless in a chess game because your opponent will attack via the hole you left and you'll lose. If you're defending against ego-driven attackers or attackers who target you personally then it's appropriate to try for a security posture with no holes in it.
Mass-produced malware is usually not built for pride of workmanship. It is commercial software built to make money and is not a fraction better than it needs to be.
The right question to ask about effectiveness is what fraction of the spyware in circulation will be controlled by Zone Alarm and its kin. We accept a detection rate of 50-80% from antispyware programs. The threshold for a program like Zone Alarm should be higher because it has to be worth the hassles it causes, of course.
Those hassles are probably inevitable. If you try to control outgoing traffic you are trying to add a feature that should have been in the OS, namely a new permissions system. Turf wars with the OS and destabilization due to hooking deep APIs are certain to happen. Historically if you attempted to touch the Windows network stack (PGPNet, for example, and the Freedom software forced me into a wipe and reinstall) you broke it.
Outbound traffic controls are harder to subvert but less effective if you do them outside the client machine. How can a separate firewall box know whether a port is being opened by BitTorrent or by CoolWebSearch?
It did contain the tag "duh", but still....
I've been using these personal firewalls for years without a single occurance of malware or rooting. See for yourself, they run on a variety of architecture. They can be found here and here.
A couple of others that are nearly as good (in my personal experience) are here and here. .
Give them a try. You'll be impressed with the increased security.
designed to run securely and has all the security features of Unixes.
And that's why you need a pix and an antivirus subscription and antispyware software and a NAT'd router on 2000/XP?
Denial, it's not just a river in Africa my friend.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Without Zone Alarm to block the malware traffic while Anti-Vir downloaded updates to its signature files, her internet connection was saturated with so much malware traffic that she couldn't connect to anything else.
In other words: If that is your main problem, by all means, use Zone Alarm. However, for normal users that simply want to "improve the security" of their systems, and not use some expert geek friend to clean their system of garbage they could have easily avoided in the first place, it doesn't work. Besides, most sane people would fix such a problem with a reformat, as if your friends system was that bad, there's surely other problems lurking too.
Further, she gets to see what programs try to access the internet.
Which is exactly why I stopped using zonealarm. Without zonealarm constantly pestering me about dangerous "attacks", either software I used would silently stop working because they needed net access, or I would need to allow most everything by default, reducing any effectivness of the firewall. A few weeks of clicking yellow dialog boxes, and you get enough. I didn't have a big problem with malicious software before ZA, and having the software equivalent of an annoying mum trying to warn you against stepping on something dangerous for every single step you take as you walk down the pavement, is just too annoying, too time-consuming, and too ridiculous. When you consider the additional implication, that you mum only notices the broken glass on the pavement, but never sees madman with the gun sneaking up on you from behind, it becomes even more obvious that it's only a big waste of time.
Maybe a what-is button that actually told you what a program is,who wrote it, checked is signature, who the program was trying to talk to, and why the programs developer thought it important for the program to open a connection would help. Microsoft is a lot like Linux in one thing, they get blamed for a lot of stupid shit they have no control over right now and it's probably time for that to stop; there needs to be a signature program that's reasonably fair to big-time commercial, small-time commercial, and amature software developers writing for the windows platform. If it ain't signed and registered, it don't run period.
Apocalypse Cancelled, Sorry, No Ticket Refunds
I would be interested in what Slashdotters think if ISA Server 2004? We have a number of clients who rely on it, and it would be instructive to discover any percieved flaws, or things that we should be looking out for? Thanks in advance.
kybred
Sure you can use a hardware packet firewall for the essential functionality, but what of detailed logs, intrusion detection software, VPN solutions, SSH proxying, etc.?
Aside from that, the hardware firewalls can be cracked, and have been in the past. But they're harder to upgrade and repair when an OSS patch is released a few hours later.
People place too much faith in firewalls anyhow. Worse, a lot of them enable uPNP functionality, which becomes a gaping hole in the security because anything connected to the internal network can temporarily enable a port forward/masquerade. i.e. A uPNP exploit on the internal network means your external firewall is enslaved by the exploit, the same way admin rights allow an exploit to disable a software firewall on a Wintendo box.
I do not fail; I succeed at finding out what does not work.
openSuSE 10.1 actually makes it sickeningly easy to configure a firewall, subnet masquerading, DNS merging, and port forwarding. It took less than an two hours to get it all working (including dial-up and DHCP network alteration of the DNS forwarding.) IIRC it took almost two days to get it working with RedHat 5.2.
I realize it's not a fair comparison, as there is over 5 years of dev work in between the two, but the point is you don't need much knowledge, just a spare dual-nic box that'll run one of the more recent distros.
A friend of mine is a bit annoyed. It was faster and easier to set up SuSE's firewall and have it working reliably than his WinXP dial-up node. :P
I do not fail; I succeed at finding out what does not work.
And just how would most sane people keep from getting infected again while updating Windows to a reasonably secure level? The average time it takes for a plain vanilla Windows install to get broken by malware is less than the amount of time it takes to navigate to Windows update.
I think that perhaps you disqualified yourself from the conversation with the admission that you've never had large problems with malware. There is a very large of people that have precisely that problem and, for those people, a decent firewall can be part of the solution.
I've by 1250 PST read every level 4 and above comment. But, for weeks now I've been wondering about a
firewall that is as first and last line of defense. How about a firewall that does this?:
-- Lets the user select folders that NO application is allowed to read
-- Not only warns the user that a banned folder is being subject to read attempts, but immediately
blocks access and performs a reverse lookup of the site and the app being used by that site, whether the
app is HTML, Java, C/C++ whether local or remote
-- not only shows the hex stream, but the PLAIN LANGUAGE (localized, of course) so the user can see what
is going on.
-- sets up a honeypot of tempting docs to cull a list of existing abusive sites and tributary sites so
an automatic blacklist can be performed.
-- lets me generate a list of keywords I ban and allows me to substitute words that actually get let out
of the system so the end-delivery is useless to the sniffing side
-- warns the user of encyrpted inbound and outbound traffic so the user can say, "Hey, I'm not actively
doing anything that warrants encryption, either site-initiated, or invoked by me. This way, I can be
suspicious of encrypted traffic that might be hiding contents lifted from my lan or disks.
See, what **I** am worried about is masked processes that sniff around my files and catalogs key or
interesting words, then waits for me to turn on some legitimate local or remote system-intensive app.
Once I've turned on a system-bogging app, the invasive app secretly slip-streams my gems into the
upstream info.
At this point, the attacker could then direct my nuggets to a legit site or one that LOOKS like one I
could trust, but maybe even THAT site or its spoof may have been "had", meaning I might never know to
where my data ultimately gets directed.
(Posting anonymously just in case i am being keystroked at work...)
David Syes
hey, i use your guide all the time.. it's good when you don't have the time to read all the man pages for pf, but i miss more about authpf is it as a super great feature
;)
thanx from norway
Step One: Uninstall all McAfee related products on your computer.
Step Two: Go to http://free.grisoft.com/ and download and install their FREE anti virus software.
Best fix for McAfee I have seen yet.
I'm a happy pessimist. I expect and prepare for the worst, when it doesn't happen I am pleasantly surprised.
This article basically says personal firewalls are useless because there are things they can't prevent. Recently I've seen someone argue antivirus software is useless because they aren't 100% accurate and won't catch all your virii. Okay well I have some screwdrivers at home. I want to put together a cupboard this evening. I'll only need the phillips head. Should I throw out the flathead since it won't do all my work for me? Moronic.
Yes, software firewalls have their problems. Yes, they do require some knowledge to use correctly (as does almost all software!)
Personally I use a hardware firewall for incoming, a software firewall for inbound, I do run as admin because Windows just isn't designed to be run well from an unprivlleged account. I use antivirus too though I do switch it off if my computer's going to be doing something CPU or disk intensive AND I'm not doing anything I consider risky.
Furthermore you can't test 6 bits of firewall software and extrapolate that they're all garbage from the sample.
These posts express my own personal views, not those of my employer
I want to know how you are supposed to block ports from going outbound if you have to deal with this stupid FTP process that goes hi_port to hi_port... I can't remember right now what it's called because it's been a long time since I actually wrote my iptables firewall but this is something that was always strange to me.
It *REALLY IS* that simple. Period.
Gentoo Linux - another day, another USE flag.
"Users who still prefer a firewall should first check whether they are using a router with firewall functionality. If so, then no firewall is needed, including the one build in to Windows XP, reports PC Professionell."
I remember a law enforcement officer I met saying how hard it was to use multiple firewalls, and you could hire his company to do it, LOL. He also recommended a hardware box, HOWEVER, the ones reading this, don't realize a NAT box, from a firewall. SO, IMHO, you should STILL use a software firewall. And learn about and how to use computers, because NO I am not coming over to fix yours!
While ZoneAlarm isn't the best firewall (best is a combination of firewalls, and knowledgeable users), it has helped with uneducated/undereducated pc users (my mother for example), tell when there computer is about to do something they don't want it to do.
Your first line of defense is ALWAYS you, who do you let use your pc, do you leave it connected, logged into, powered up by request, etc.
These techniques like the POC provided usually use IE to send outgoing connections.
I personally block IE from accessing the Internet which renders that POC useless.
which I use at home is an old computer (was a 166MHZ CPU/32MB RAM, but is now a 300MHZ CPU/64MB RAM). A linux distro called IP COP which is based on a similar distro called smoothwall.
It turns your old computer into a dedicated firewall/router that operates under broadband, dialup and apparently now has wireless support. And if you add Mike's Hosts File to it then you have a a fairly easy setup for safer web surfing.
Combined wih using Mozilla Firefox/Thunderbird on the computers that connect through my IP COP distro. I've had very little issues with spyware, pop-up adverts and other misc headaches.
Little Snitch on OSX works great at tracking / blocking outbound traffic.
Ask Me About... The 80's!
but works great otherwise
Ask Me About... The 80's!
I was not asking about multiple internal ehternet ports but rather multiple ethernet interfaces.
all the best,
drew
FreeMusicPush If you want to see more Free Music made, listen to Free
Duh! You're telling us what we already know. Anybody who hasn't been paying attention and blindly goes with "The article is flawed! Personal firewalls *really* work!" should be modded down -1 Dumbass until they show me the source for their personal firewall.
Help us build a better map!
This reads like a shill piece. There's no data mentioned, only "statements" about the claimed state of software firewalls. My BS meter is starting to twitch...
They should have added "Agnitum Outpost Firewall Pro" to their list. This piece of software - when all features are enabled - is some hard ass mofo in things of security. :\
;)
For example: I click a link in a prog that's not allowed to connect. Now it opens in firefox. Which then is blocked too because it got manipulated by the program. I did not see that in others like panda, norton or some free ones.
Of course you can get this on linux. But it's much more work for the end-user.
Outpost is the first win-fw that i'm really happy with.
But sure: If you're in idiot and you disable half of the stuff and say "allow all" to every important security question, this helps nothing.
But don't you then just *DESERVE* to be filtered out by natural selection?
(I would find it unfair for us otherwise!)
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Which Linksys hardware do you use that supports OpenVPN?
Where did you get the firmware?
I guess you complain about it taking more than one hour to learn how to drive a car as well? (Feel free to miss the point - you seem to have a talent for it.)
My WRT is just fine and hasn't been rebooted in months with 2 bittorrent clients and a few emule shooting at it constantly. Plus the regular http, ftp and emails both ways. The WRT runs Linux just fine and it makes a hell of a router!
Write boring code, not shiny code!
Drew, I'm still not sure what you mean. Do you mean for example two internal and two external Ethernet interfaces, or different types of Ethernet connections (RJ45, Coax, AUI, etc)? Or something else completely? The firewalls that I listed have 5 Ethernet interfaces, one being for the external network (cable, DSL, etc), and the rest for the internal network, typically with at least one that can be set for DMZ.
Shenan
I may just be being dense today.
I have a wrt54g. It has and external interface and 4 ports that are on the internal interface and the wireless is also on the internal interface.
So, I have (in linux terms) eth0 connected to the net (24.244.xxx.xxx) and eth1 (192.168.100.1) on the inside. eth1 has multiple ports.
I am asking for something that can do:
eth0 (24.244.xxx.xxx)
eth1 (192.168.100.1)
eth2 (192.168.101.1)
eth3 (192.168.102.1)
at a minimum.
Someone else indicates that the wrt54g can do what I want. I need to investigate more.
Is my explanation clear now at least? Or should I try again to explain?
all the best,
drew
(da idea man)
FreeMusicPush If you want to see more Free Music made, listen to Free