New Windows Attack Can Disable Firewall

BobB writes to tell us NetworkWorld is reporting that new code released on Sunday could allow a fully patched Windows XP PC's personal firewall to be disabled via a malicious data packet. The exploit depends on the use of Microsoft's Internet Connection Service. From the article: "The attacker could send a malicious data packet to another PC using ICS that would cause the service to terminate. Because this service is connected to the Windows firewall, this packet would also cause the firewall to stop working, said Tyler Reguly, a research engineer at nCircle Network Security Inc."

Comments

Hmmm

[Anonymous Coward]

From TFA: Its not clear if it only affects the windows default firewall, or any 3rd party firewall installed on the system.

Re:Hmmm

[Anonymous Coward]

Please reread the second to last paragraph on first page of the article.

Either RTFA or don't, but don't pretend that you did.

Not that big a deal, but still.

[Grendel Drago]

Sure, it requires that you be on the internal LAN already, and that you be running ICS, and who runs ICS anyway? But what kind of shit design is this that lets you take down the firewall if you piss off the IP-masquerading software? Did someone cut their fuzz-testing budget? What's their excuse for having this kind of vulnerability?

Re:Not that big a deal, but still.

[RLiegh]

>Sure, it requires that you be on the internal LAN already, and that you be running ICS, and who runs ICS anyway?

Anyone using NAT under Linux, for one. Families connecting multiple computers onto a single network, for another. Not to mention people who share the same printer or who have a central file server set up to share mp3s or whatever.

Re:Not that big a deal, but still.

[Lord Kano]

What's their excuse for having this kind of vulnerability?

I'm pretty sure that it goes a little something like this...

We're Microsoft, what are you going to do? Switch?

LK

Re:Not that big a deal, but still.

[happy monday]

Well, I tried to check whether I'm running ICS, so ran services.msc, and couldn't find it. The I noticed the firewall and ICS are listed together as one service, called Windows Firewall/Internet Connection Service (ICS). So it seems to two services have been merged together somehow, and running one entails running the other.

Re:Not that big a deal, but still.

[Anonymous Coward]

Anyone using NAT under Linux, for one.

Anyone using NAT under Linux is not using ICS.

Families connecting multiple computers onto a single network, for another.

If they cannot afford a router (but can afford multiple computers and know how to install a second ethernet card and setup ICS perhaps

Not to mention people who share the same printer or who have a central file server set up to share mp3s or whatever.

None of these scenarios have anything to do with ICS whatsoever.

Re:Not that big a deal, but still.

[@madeus]

Anyone using NAT under Linux, for one. Families connecting multiple computers onto a single network, for another. Not to mention people who share the same printer or who have a central file server set up to share mp3s or whatever.

None of those things require Internet Connection Sharing, and I would argue it's not even the easiest or most common way to achive them. Virtually anyone with a consumer DSL offering can just plug their computers (or printers, or network storage devices) right into one of the RJ45 ports on their DSL modem and be served a DHCP IP from the modem - even most cable modems these days even have standard RJ45 interfaces you can plug in to a cheap switch (allowing you to use several machines on the network, even if they have a policy that you are only supposed to use one machine).

It was useful on Windows 98 when so many people were limited to using modems for internet access, but Ethernet is so ubiquitous these days it's a bit of an anachronism. Even in Windows 2000 the ability to configure the routing policy is limited to renaming the connections so that the prefered routes occur first in alphabetical order (I kid you not), that is unless you upgrade to something like Advanced Server which comes with administration tools to enable routing tables to be modified.

Re:Not that big a deal, but still.

[Kangburra]

It was useful on Windows 98 when so many people were limited to using modems for internet access

...and once again the US assumes everyone else in the world has DSL and 4 port modems.

Hello, a lot of people still use 56K modems to connect to the net. The biggest ISP's in Australia supply a USB only DSL modem when you sign up. These people rely on ICS.

Re:Not that big a deal, but still.

[@madeus]

...and once again the US assumes everyone else in the world has DSL and 4 port modems.

I'm not from the US, and FYI all the other countries in the developed world do pretty much all have broadband, with 4 port DSL modems (from the likes of Negear, Zyxcel, etc.) being very much the norm.

Hello, a lot of people still use 56K modems to connect to the net.

Indeed, but those are not usually people with more than one computer - because people with more than one computer are the sort of people that will just get cable or DSL (unless they are in the sticks, and most bumpkins don't own more than one computer so that's a very small percentage).

The biggest ISP's in Australia supply a USB only DSL modem when you sign up. These people rely on ICS.

Not true. Bigpond/Telstra, Internode, OptusNet, Netspace, Westnet and the rest all supply DSL modems with an Ethernet interface or no modem at all. Providers everwhere - not just in Austrialia - have the option of a USB modem for customers who want the cheap and nasty option, but the people who have chosen to go for the USB-only modem option (where it's still avalible, and it's avaliblity is rapidly declining) are almost certainly not "relying on ICS" because they almost certainly have only one personal computer in the house.

Re:Not that big a deal, but still.

[Kangburra]

unless they are in the sticks

Which is, of course, most of WA.

Re:Not that big a deal, but still.

[mackyrae]

hahhaha You're right, the US actually has relatively SLOW internet. We should be assuming fiber optics for East Asia ^_^ You did know that Asia has much faster internet than the US, right? Actually, a large chunk of Americans are /still/ using dial-up (*gag!*) Maybe in 3rd world countries it's all dial-up, but then, do they even have computers of their own? Oh, and yeah, you're right though about 4-port modems. I can tell you for damn sure my modem only has 1 RJ45. The router has 4 out though. Shouldn't mix up hardware components like that.

Re:Not that big a deal, but still.

[Fred_A]

What's a WA ?

Re:Not that big a deal, but still.

[jacksonj04]

Do like we did and get an integrated box (Though it only works for DSL). Modem, 4-port router and WiFi hub all in one. Fewer cables for the win! It's true that all 4 ports on the router are used, mostly out to full switches...

Re:Not that big a deal, but still.

[Kangburra]

Western Australia.

Re:Not that big a deal, but still.

[@madeus]

Which is, of course, most of WA.

Actually, the vast majority of people in WA (which, for it's size, has bugger all people in it to begin with) have access to broadband in the form of DSL or Cable.

Re:Not that big a deal, but still.

[walt-sjc]

Personally, I dumped the Telco supplied POS DSL modem and got a Sangoma S518 PCI card. Best thing ever. Can do full rate QOS (since you eliminate the "Huge Buffer of Doom") and syncs at a higher rate than the crappy Westell modem. Not sure if they work in AU, but it's worth looking into.

Re:Not that big a deal, but still.

[@madeus]

I can tell you for damn sure my modem only has 1 RJ45. The router has 4 out though. Shouldn't mix up hardware components like that.

I'm not mixing up hardware, but you are. Units like the Netgear DG834 (with comparible systems from Zyxel, Actiontec, etc) are all DSL modems with 4 Ethernet ports and in the US, Europe and Australia providers are shipping the same gear. They are typically switches not hubs though.

It's almost exclusively cable providers that provide systems with only one RJ45 port (and typically those systems also have an optional USB port - which is on some, but not most DSL modems).

Pretty much all ISP's and cable providers are using the same gear, all over the world. The same is true for cable and satellite set top boxes - it's just differently badged, with different software, but the hardware is stock equipment for one of a handful of vendors.

Re:Not that big a deal, but still.

[Fred_A]

Ah, right. Thanks.

Re:Not that big a deal, but still.

[Talchas]

Hmm, my verizon DSL modem has one ethernet out and one usb out, and nothing else. The service came with a wireless router though, and it was several years ago that we signed up. (its a westell wirespeed)

Re:Not that big a deal, but still.

[Anonymous Coward]

Washington

Re:Not that big a deal, but still.

[Lagged2Death]

...who runs ICS anyway?

0.1% of Windows desktops is still a lot of desktops.

Re:Not that big a deal, but still.

[Anonymous Coward]

The ICS service and the Windows Firewall Service are one and the same. Look at the services on your box. Just because you do not have ICS enabled does not mean you are not vulnerable to this attack.

Re:Not that big a deal, but still.

[mackyrae]

My modem has one RJ45 out. That's what Comcast gave me when I signed up for cable internet. Then I bought a Linksys WRT54G and hooked it up to the one RJ45 out. That has 1 in and 4 outs. The Linksys is not a modem. It is a router. The router has multiple RJ45-outs. The modem only has one.

You even said it right here:
It's almost exclusively cable providers that provide systems with only one RJ45 port (and typically those systems also have an optional USB port - which is on some, but not most DSL modems).
The cable company gives you a modem with one ethernet-out. Where are you getting cable internet that isn't from the cable company?

Okay, the thing you named does have a modem in with the router, but heck, if I'm getting a free modem from the cable company, I'm not going to buy another modem when I have a free one. I'll just hook up a cheap router rather than pay for a 2-in-1 when I have one of the two already.

Re:Not that big a deal, but still.

[dohcvtec]

...and who runs ICS anyway?

Anyone using NAT under Linux, for one.

Huh? Do you have any clue what ICS is? ICS stands for "Internet Connection Sharing" (incorrectly cited in the article and post as "Internet Connection Service".) ICS is Microsoft's proprietary Windows-only NAT software. It has exactly ZERO to do with Linux or any other Unix-like OS.

Re:Not that big a deal, but still.

[@madeus]

I'll try my best to clarify:

Where are you getting cable internet that isn't from the cable company?

You can get broadband (which is I assume what you mean) from sources other than a cable company (cable internet is just one form, and not actually the most common form of broadband).

o) Cable broadband providers most commonly provide CPE's (Customer Premises Equipment) with a single RJ45 interface, and often USB. Additionally, most cable providers do not encourage use of 3rd party cable modems. If you want to connect other devices, it's usually better to buy your own switch in this case, as you seem to have done with the WRT54G (which is both a wireless router and a switch). Cable providers have also different in that historically they been more picky about how many machines they 'allow' you to connect - typically because they are used to making money from 'multi room' subscriptions with cable boxes and have being trying to aply the same model to internet access (most seem to have given up on that now though, thankfully).

o) DSL broadband providers most commonly provide generic (sometimes rebadged) ADSL CPE's with more than one RJ45 interface (with ADSL2+ increasingly so, as pretty much all ADSL2+ capable modems have multiple interfaces). Some (from vendors like Actiontec) also have USB interfaces, but it's less common (built in wireless is more common in DSL modems though). DSL providers also rarely enforce limits on how many machines you can use (e.g. by checking to see how many unique MAC addresses it can see on your line, as some cable providers have done), because they are coming from a different background (one where vendors sell bandwith, rather than devices).

Most DSL providers are quite happy for their customers to buy a 'wires only' service (aka BYOM - Bring Your Own Modem), but some do prefer that you use one they have supplied as although ADSL is a standard, some CPE's are more compatible with the chipsets in specific brands of DSLAM's (the provder equipment that DSL routers connect to) and makes for less support calls.

Most interestingly, enforcing the use of specific provided equipment allows DSL providers to guarentee quality of service - allowing to compete with cable companies with VOD (Video On Demand) services. This is the direction a lot of satillete and DSL/telcoms companies are moving in and why they are providing their own CPE's for DSL lines now (even though they are not quite ready to deliver VOD just yet, next year it's set to explode in popularity - especially in regions where cable is not already dominant).

(Was about to go on about that, but must get back to work :-)

What can you trust?

[RLiegh]

If the graphics applications you use require windows, and all of the major firewall vendors are bloated (symantec), worthless (keiro) or both (macaffee) then what can you do?

Re:What can you trust?

[snsr]

Use Ghost Security's appdefend and a decent silent firewall to gain adequate security for the average graphics user.

Re:What can you trust?

[Anonymous Coward]

... get Comodo?

Re:What can you trust?

[Anonymous Coward]

As MS firewall can be ignored at will by some applications, IMHO it's worthless

Re:What can you trust?

[oGMo]

A few things:

• Keep all your broken (Windows) boxes in a heavily-firewalled subnet (and make sure the firewall is something secure, i.e., not Windows)
• Don't put the broken box on the network at all
• Run your app in a VM
• Find a new app

Re:What can you trust?

[jonwil]

Having the machines behind a NAT router should stop a lot of attacks. And if that isnt enough, find a NAT router with a built in firewall (or add an extra firewall appliance such as a old PC with linux on it)

I have yet to see a windows based firewall that doesnt suck.

Re:What can you trust?

[orpheus_okt]

worthless (keiro)

Uh... Is there something I missed in the last weeks/months? No, I'm not implying that I heard exactly the opposite, but it sounds like there are serious security holes in the old Kerio firewall although I was always convinved it's still one of the better free ones out there. And I really must have missed the news then...

Up to now, I was sticking to Kerio on Windows. Especially because of its rather powerful options to filter single applications, addresses, ports and plenty of other manually configurable stuff instead of a placebo firewall which provides a "Yes, I'll save you from all Evil"- and a "Take care of yourself"-Button (at maximum with a Beginner-Amateur-BetterAmateur switch). Those are worthless.

Come on, tell me people! Why is Kerio considered bad these days? (

Re:What can you trust?

[Alarash]

You use an IPS/IDS appliance that goes up to level 7.

Re:What can you trust?

[EvilIdler]

You can use Outpost (firewall+spyware protection)m or Norman (all that and good antivirus).

Re:What can you trust?

[ZERO1ZERO]

I always thought Keiro was the best free one as well, so I too am interested in why it is (apparently) out of favour now.

Re:What can you trust?

[gbobeck]

You use an IPS/IDS appliance that goes up to level 7.

For extra effectiveness, make sure your level 7 IPS/IDS appliance is armed with nothing less than a +3 Sword of Packet Smiting.

Re:What can you trust?

[kjart]

Having the machines behind a NAT router should stop a lot of attacks. And if that isnt enough, find a NAT router with a built in firewall (or add an extra firewall appliance such as a old PC with linux on it)

Seems like good advice - no matter what your OS is. Not much to pay for another (solid) layer of security, and the second option is a nice way to recycle old PCs.

Re:What can you trust?

[rufusdufus]

This is the only truly safe thing you can do: repartition and format your drive and reinstall with the internet disconnected. You can also install firewalls et al other people on this thread are suggesting. Install and configure your main applications. Then, make a image* of the drive.
When you use your computer for important stuff, save your data to external drives.
Then every few days, restore the image. Once you've learned how to do it it will take about 5 minutes which is actually quite a bit faster than a virus scan, and guaranteed to clean even invisible root kits.

*the key thing is to get an imager than can boot the computer from a CD. The old Norton ghost can do this. You don't want to use any program that is running inside the OS you are restoring since it wont be able to remove root kits. Another example is Acronis Trueimage. There are many others.

Re:What can you trust?

[Debug0x2a]

Don't forget obnoxiously overzealous (Zone Alarm)

Re:What can you trust?

[mjjw]

Use different graphics programs on a different operating system (although *most* major graphics apps run on Mac as well as PC).

Or sit your windows PC behind a hardware / linux firewall (or both).

Or run those graphics applications inside a VM running on your windows PC. If the PC is compromised, the VM should still be relatively safe (especially if running with networking disabled - you can usually still copy files in and out of the VM).

Or combine all of the above and use e.g. Mac OS X behind a hardware firewall, with the Mac OS X software firewall enabled and run your graphics apps on windows running inside a Parallels VM (which runs at near full speed). This is the approach I use.

Re:What can you trust?

[pedestrian crossing]

You use an IPS/IDS appliance that goes up to level 7.

Mine goes up to 11.

Re:What can you trust?

[master_p]

I use ZoneAlarm by ZoneLabs...it is the best software firewall for Windows. The first thing I do when I do a fresh Windows install is to disable the Windows Firewall and install ZoneAlarm...

Re:What can you trust?

[Alarash]

Aah, you all know I meant layer 7 not level, stop making fun of me because I posted before my 3rd coffee.

Re:What can you trust?

[mackyrae]

Howabout Avast? It's free (woo!). I use it to keep from sending virus-ified Windows files to Windows users (it's not like I'd notice if there was a virus on mine cuz it'd be dormant).

Re:What can you trust?

[Anonymous Coward]

...it is the best software firewall for Windows.

By what criteria? Under what objective measurement? Methinks you have fallen prey to marketing.

More generally, while there is nothing wrong per se with having a personal firewall on your windows box, I personally believe it to be a false sense of security. Its best use actually seems to be to flag processes on your own computer making unexpected network connections, not to protect you from attack.

As this and previous articles have discussed, attacks targeting the windows IP infrastructure seem likely to be able to, or have been proven to, disable or bypass some personal firewall software.

I strongly recommend you use a standalone firewall customized for that purpose, such as those based on linux (e.g. ipcop) or openbsd. There are several reasons for this:

• the majority of attacks you will experience are worms or script kiddies. These attacks do not generally consider standalone firewalls as part of the attack path, certainly not when running on a different operating system (possibly even different cpu architecture). It is not impossible, but I would be impressed to see an automated attack which compromised such a device AND THEN went on to search for and infect windows boxes
  
• they form an additional line of defence before an attack can even reach your windows box
  
• they run no software not necessary to the task they perform and therefore have a lower profile in terms of the number of exploits available
  
• they often include specialist intrusion detection tools
  
• they log verbosely and are easily programmed to alert you
  
• they store no data, so that if they are compromised, there is less risk of loss or theft of date
  

Re:What can you trust?

[zerojoker]

I can't think of any reason why Kerio - or the new Sunbelt Kerio PF should be not effective.
I mean blocking applications from within is always a problem (for every Firewall) and it has been shown that there's always a method of sending data out (no matter which vendor), however I think Kerio is still quite effective on blocking incoming traffic

Re:What can you trust?

[Virgil Tibbs]

exactly why is kerio "worthless"? because its free? - (as in beer)

Re:What can you trust?

[ben there...]

Objectively, ZoneAlarm has done very well in Gibson Research Corp's tests. The Shield's Up online test available from that page has come back with all "cloaked" responses on all ports, meaning your computer doesn't even identify that it is there, in contrast to other firewalls that return a "blocked" message. GRC's latest test appears to be LeakTest, and ZoneAlarm has passed that test since its creation. Others have caught up, but ZoneAlarm is definitely, objectively, among the best personal firewalls.

Re:What can you trust?

[Anonymous Coward]

You can run a hardware firewall.

Re:What can you trust?

[Jessta]

You don't need a firewall. Just disabled the network services that you aren't using.

Re:What can you trust?

[Anonymous Coward]

leaktest checks to see if programs ON YOUR computer can get out past the software firewall without your permission.

It has nothing to do with external attacks.

Re:What can you trust?

[walt-sjc]

Advice like that is why we have a major botnet problem.

Re:What can you trust?

[rainman_bc]

Don't put the broken box on the network at all

lol, that's what I keep telling the security guy in my office :) The only way to make sure your network is 100% secure is to pull all the patch cables... I think we might be able to push him over that tipping point now ^_^

Re:What can you trust?

[QuailRider]

So glad you asked. I'm sure a lot of Slashdotters will chime in with the default Linux answer. It's valid, and I accept that it works well. However, once you've worked with OpenBSD's PF packet filter syntax, you'll never want to look at another iptables ruleset again. Kerio / Sunbelt Personal Firewall is ok for a standalone WinXP machine (I've got it running on my mother's pc). I would not want to trust Microsoft's built in firewall or internet connection sharing tools. I used to use Kerio Winroute on my file server before migrating to OpenBSD, and it worked nicely for a few years. But the newer versions of WinRoute have gotten really expensive, bloated, and encumbered. The day WinRoute phoned home to check it's license was the day I ditched it for OpenBSD.

Re:What can you trust?

[TheNinjaroach]

Use a hardware firewall, much harder to compromise than any software on a Windows box.

Re:What can you trust?

[Anonymous Coward]

worthless (keiro)

Worthless? Kerio is a great product!

Free, easy to configure, and can have very detailed custom filter rules.

Great product.

Re:What can you trust?

[couchslug]

Not rely on software firewalls?

I've run Freesco and later MonoWall firewalls on mostly-free hardware (Asus P255T2P4/128MB/P233 with super-glued passive heatsink) almost 24/7 since 1999. Neither have been difficult to set up, and Freesco is very noob-friendly. Freesco needs minimal resources and will even run on a 486.
Both have performed with boring, appliance-like reliability. I run from a Compact Flash card in an IDE adapter instead of a hard disk. Those parts are dirt cheap nowadays.

http://www.freesco.org/

http://m0n0.ch/wall/index.php

http://pigtail.net/LRP/printsrv/ Get ideinfo.exe from here to check CF card parameters.

http://www.pfsense.com/ I haven't tried this yet, but it's a popular fork of MonoWall so I'm mentioning it to save someone else the trouble. :)

Re:What can you trust?

[Ken_g6]

This being halloween, I guess it's appropriate that I made a deal with a daemon...

I personally use wipfw, the Windows version of the BSD firewall (which I hear Macs also use). It works fine on my desktop, but I think it may have broken suspend/hibernate functionality on my laptop, so back up your system before installation.

Re:What can you trust?

[megaditto]

Well, how many home users have a second PC with 2 NICs, and know how to configure it as a NAT/firewall server?

For the absolute majority of home windows users, a software firewall is the only viable option. And if MS did their job, that would be the only solution they would need.

Re:What can you trust?

[thelost]

I've heard nothing bad about Kerio and as far as I'm concerned it's fine. Personally I recently switched to Outpost Firewall and am very impressed, plus it's got an active user community which i always look for when deciding whether to take up a product.

Re:What can you trust?

[ConceptJunkie]

I block DOS attacks with Bigby's Interposing Hand.

Re:What can you trust?

[Anonymous Coward]

Well if your graphics application is tying you to Windows, and Windows is by your own admission untenable, then the first thing that should spring to mind is that you should switch graphics applications.

Re:What can you trust?

[Hal_Porter]

That's not what it's meant for. Loads of Windows applications need to be able to connect to the outside world, so the firewall doesn't stop them. You probably needed to be admin to install them, so you're trusted to install stuff.

What it for is to stop a repeat of the Blaster worm, which attacked the SMB daemon inside Windows. If you have the firewall turned on, machines on the Internet can't send a buffer overflow exploit to these ports because the firewall blocks them, so a vulnerability is blocked. Given that XP has a bunch of daemons running by default, and given that someone will find an exploit for one of them every few months, it's actually a sizeable gain.

Interestingly enough, when Blaster hit (before SP2 and the firewall being on by default), I had to turn on the firewall to be able to get to windows.update.com to get the patch. Otherwise, Blaster was so endemic on the Internet this was impossible. I actually got spam from a recruitment company asking me how to stop his machine shutting down when he connected to the Internet, and I explained this to him and he was pretty grateful.

So if the firewall had been enabled, most machines would have stayed up long enough to get the update, and it would have been far less serious. Incidentally, I worked at a big company back then, and blaster was endemic on their intranet too, carried in on laptops. They repackaged the microsoft fix in a way that destroyed machines, and as soon as I uninstalled it the machine crashed. So allowing any machines non firewalled access to the internet is a disaster if an buffer overflow exploit is found for any default enabled service.

Re:What can you trust?

[springbox]

If you're using a 3rd party firewall for Windows, I would suggest Sygate's old personal firewall (before Symantec bought it.) Get it here. It's reasonably up to date, and works fine with the latest Windows OSes, and it should give you the same amount of control that Kerio does.

Re:What can you trust?

[blackfog]

You might want to look at some other firewalls than those after a comparison.

In similar settings (LAN of over 2000 PCs, mostly firewalled) I have found Sygate & Outpost perform well enough.

Re:What can you trust?

[petgiraffe]

The only way to make sure your network is 100% secure is to pull all the patch cables

I wouldn't say 100% for even that solution. Do the computers have Wifi? IR ports? Wireless mice or keyboard?
Even if they have none of those there are still CDs, Floppies, and USB keys with rootkits.
Even if you prohibit removable media of any kind there are still social attacks and plain old user error.
Better not let any humans near the computers.
No computer, network, or system of any kind can ever be 100% secure. That's just life.

I guess maybe you can throw all the computers into a volcano just before it erupts and stand a reasonably good chance of them being secure against any future attacks (but not compromises that occurred prior to and during the vulcanization procedure).

Re:What can you trust?

[AliasN]

If it blocks Norton, sign me up.

Re:What can you trust?

[AJWM]

If the graphics applications you use require windows, [...] then what can you do?

Buy a cheap Linux box and use it as a dedicated firewall appliance. (Or buy a firewall appliance, odds are it has Linux embedded in it anyway.) I've got an old 166 MHz Pentium box (ancient Dell desktop) that cost me all of $15 (plus the 2nd NIC I had lying around). No worries.

Re:What can you trust?

[PhotoGuy]

Mine goes up to 11.

Why not just make 10 the loudest?

Re:What can you trust?

[Anonymous Coward]

Why not just make 10 the loudest?

:|

His goes to eleven

Re:What can you trust?

[AeroIllini]

You use an IPS/IDS appliance that goes up to level 7.

My IPS/IDS appliance goes up to 11.

Very Naughty

[davro]

Microsofts company's public relations agency said Monday in a statement.
"Microsoft is not aware of any attacks attempting to use the reported vulnerability or of customer impact at this time."

Well then everything is fine and dandy then ;(

It is Internet Connection SHARING

[Anonymous Coward]

The article didn't sound right calling it Internet Connection Service so I did some poking around on the blog the article referenced: http://blog.ncircle.com/archives/2006/10/microsoft _ics_d.htm/

ICS == Internet Connection Sharing.

Re:It is Internet Connection SHARING

[bigberk]

That link is a bit off, try this for the blog

Re:It is Internet Connection SHARING

[CFBMoo1]

Yeah I went to see where this service was and all I saw was Windows Firewall/Internet Connection Sharing(ICS). The firewall service is tied to the ICS service. You can't shut one off and not the other. They both go down when you disable this service. Atleast thats what I'm seeing on my patched XP pro box. I never changed the settings for that so it's defaulted to Automatic and on all the time.

you mean,

[Anonymous Coward]

http://en.wikipedia.org/wiki/Fire_extinguisher ?!

nothing new here, go on... :)

Lack of testing?

[Anonymous Coward]

Maybe the bug slipped past because nobody uses ICS. Too cheap to buy a free after rebate router?

Re:Lack of testing?

[RLiegh]

>Too cheap to buy a free after rebate router?

Personally speaking; I just hate letting my old k6-2 sit around and gather dust. Some slackware and a little cut and paste from the NAT HOWTO and it makes a fine file serving/ICS machine.

Re:Lack of testing?

[Anonymous Coward]

If you are using slackware, what the fuck does that have to do with ICS?

Re:Lack of testing?

[Antiocheian]

It doesn't have to be GNU/Linux (although it is better) -- Windows has fine NAT software products too.

BTW, I was using software NAT on a very clean BNC cable-based ethernet and it was very stable and very configurable. All printers and shared devices were connected to the "server", no extra cables no extra boxes, no problems.

Staying away from MS networking solutions is always a safe choice.

Re:Lack of testing?

[hcdejong]

The drawback of that approach is that you have yet another large box with noisy fans using 10 times the amount of power a router would use. But if you need a file server anyway...

Re:Lack of testing?

[bigberk]

I've got a 200 MHz Pentium (also slackware) doing my NAT and firewalling ... easily handles 10 Mbps. I've read that even an ancient, free (100 MHz) linux router can do 50 Mbps. I think the best approach in layered network security is diversification of your defences; maybe a Linux or BSD router, but still have the desktop PCs run their own firewalls.

Re:Lack of testing?

[udippel]

Try Soekris (http://www.soekris.com/); for example.
Get the Soekris version from
http://www.zelow.no/floppyfw/download/floppyfw-3.0 /floppyfw-3.0.0/

No moving parts, no noise, less than 10 W.

Recommended.

Re:Lack of testing?

[jawtheshark]

a little cut and paste from the NAT HOWTO

Please, don't do that. At least try to understand *first* what you do before cutting and pasting it. Believe me, I learnt the hard way.

My firewalls (two different sites) run on a P-III/768Meg and on an AMD64 2800+/1Gig, and that's pretty much overkill ;-) The P166 machines they replaced were doing fine, but the hardware was really getting old and I feared outages... So the next machines in line became firewalls ;-)

Please explain me...

[Anonymous Coward]

What those engineers were thinking? A data package, the thing a firewall is filtering to some point, can disable the firewall? Who thought it would be a nice feature to have that?

"We need a firewall of our own!"
"Why?"
"To keep our monopoly; those firewall and antivirus companies are making money that should be in our pockets."
"But antitrust..?"
"We say it's because we want to have a secure system, it should've been in the first place. Those companies have no case! >:D"
"But even we cannot access their systems anymore without logging our activity on our massive 'slave-farm'."
"We'll add a backdoor, so we can remotely disable it. Noone will ever find it >:)"
"Excellent..."

Re:Please explain me...

[fmileto]

Steve? Steve Gibson? is that you?

Microsoft's woes..

[hexed_2050]

Bill: "We must delay Vista a few more weeks because Sam the janitor found that if he logged on exactly at 12am, the system would implode and cause a reinstall. Thank god for QC!"

Grunt: "Hey Bill, there is a bug in XP that can totally disable the firewall! How about making an SP3 for XP?"

Bill: "You obviously don't share my vision do you?"

Because, of course, Windows Firewall is awesome!

[Channard]

I never used Windows Firewall on my PC - I used Zonealarm or Tiny Personal Firewall. Why? Because given how many security holes XP had - and probably still has - I wouldn't trust my security to it. And lo and behold, here we are.

Re:Obvious

[boobavon]

Windows firewall is the first thing i check for when i do a fresh install. I have *never* gotten a virus and i don't use any of the other products out on the market. So yea, some of us do. And we get better performance because of it.

Not as bad as it sounds

[DavidD_CA]

So for this attack to work, according to the article...

1) The attacker has to be on the LAN already, or executing code from a PC on the LAN

2) The LAN has to be connected to the internet through a PC using ICS, and

3) There can be no external firewall device such as a router sitting between the LAN and the internet

While this is certainly a valid attack... so are a lot of other attacks once you're already in the LAN. This one just happens to nuke a software-based firewall from the inside. Big deal.

Re:Not as bad as it sounds

[dhammabum]

While this is certainly a valid attack... so are a lot of other attacks once you're already in the LAN. This one just happens to nuke a software-based firewall from the inside. Big deal.


Well, if a trojan or virus gets on a LAN-based machine and it takes out ICS and the firewall, that leaves that machine more open to attack. It would also be a DoS as IP forwarding is killed.

Re:Not as bad as it sounds

[bazorg]

so are a lot of other attacks once you're already in the LAN. This one just happens to nuke a software-based firewall from the inside. Big deal.Exactly what I thought.. when I'm already in the LAN I want to attack I use a sledgehammer not these computer thingies.

Re:Not as bad as it sounds

[Anonymous Coward]

No, actually this is bad.

Q: Why would you wish to run ICS in the first place?
A: because you do not have a NAT router.

This could be, for example, because you have a usb cable modem.

Now, the only thing needed is an infected machine on the inside....

Re:Not as bad as it sounds

[Anonymous Coward]

While you are certainly correct I think you miss a point.

If a person uses one computer as a router with a wireless AP connected to that PC. It can be trivial to get into the LAN via the wifi connection, turn off the firewall and then attack from the (hopefully faster and more robust) internet connection later on.

Re:Not as bad as it sounds

[Anonymous Coward]

It can be trivial to get into the LAN via the wifi connection

Really? Trivial?

Re:Not as bad as it sounds

[gad_zuki!]

Not to mention, by default, windows firewall allows local segment traffic onto ports 135-139. So if the cracker wants to brute force the shares he doesnt even need to take down the firewall.

Internet Connection Service?

[Red_Deth]

The exploit depends on the use of Microsoft's Internet Connection Service.

Is ICS not Internet Connection Sharing?

Re:Internet Connection Service?

[someone1234]

Yeah, it is Internet Connection Sharing With Spammers.

"New?"

[TheShadowzero]

How is this new? Any attack worth its salt disables the firewall first thing. Saying this is news is like telling people AIDs is linked to death.

Re:"New?"

[jimicus]

Saying this is news is like telling people AIDs is linked to death.

You think that's bad? Recent research shows life is linked to death.

Re:Obvious

[Anonymous Coward]

Well, I wouldn't agree with 'better performance' - software firewalls are ALWAYS a bottleneck. Just use a router :-)

Re:Obvious

[spacefight]

A router does nothing to protect you from other hosts within the network.

Re:Obvious

[Heembo]

Personal firewalls do not protect you against virus', anti-virus products do that. Personal firewalls protect your from hackers and worms, primarily. And good personal firewalls do egress filtering, which MS firewall does poorly at best.

How do you know you've never gotten a virus?

[rufusdufus]

Whenever someone brags they have never gotten a virus, especially just after blithely disabling some security feature, it raises a big red flag. The question is: what is it that makes you think you've never had a virus/been compromised? You havent noticed anything? Perhaps McAffee or Norton didnt find anything so you assume you are clear? Sadly my friend, it is very possible your machine has been compromised by a virus or worm and you are simply unaware of it. The worst kinds of malware are not detected by virus scanners; in fact some are not even detectable in any way.

Why should you care if it doesnt appear to affect you? Well, it may actually effect you if its a keylogger tracking everything you type and collecting information about you for identity theft. Worse, for the rest of us anyway, your machine could have been co-opted by a bot-net that is used by criminals to extort money from web sites. What they do is secretly root thousands of unprotected computers operated by people who 'have never had a virus' and then use them to do a distributed denial of service attack against commercial websites, demanding money from them to stop.

In order to limit the power of these criminals, everyone must firewall and patch their machines. This may not even be enough though! What people really need to do is occasionally completely reformat after booting off a cd so any rootkit will be erased.

Re:How do you know you've never gotten a virus?

[Orlando]

...in fact some are not even detectable in any way.

What rubbish, if it's on the machine it's detectable. May not be easy, but you'll find it eventually if you look hard enough.

Re:How do you know you've never gotten a virus?

[Anonymous Coward]

Well, if I *have* been rooted, its pretty benign. I never see any unwanted or malicious traffic if I sniff my local segment...or did it root all my other machines too? And also know how to effectively modify Ethereal AND snort to only show the legitimate traffic coming and going from my machine?

Damn, now i'm paranoid! Where is that XP CD again....?

Re:How do you know you've never gotten a virus?

[jimicus]

In theory, yes. But you'd need to reboot the OS into some kind of diagnostics otherwise you're asking the OS to attest to itself - and if it's been trojaned, you can't trust the OS because the first thing any sensible trojan will do is cover its own tracks.

In practise, if you want a 100% guarantee that any malware has been eradicated, the only solution is a rebuild.

Re:How do you know you've never gotten a virus?

[Anonymous Coward]

What rubbish, if it's on the machine it's detectable

HackerDefender (http://hxdef.org/) is just begging to disagree with you there. Quite a popular rootkit a few years back where I work, where there were a bunch of Windows 2000 machines which got cracked. The only reason we knew there was anything wrong with them was:

a) We were warned of increasing levels of network traffic
b) When it came time to install SP4 on them, it wouldn't go on (due to the rootkit blocking all access to anything called "ftp.exe", thus the SP couldn't install correctly)

However, had this been a home machine then almost certainly nothing would have been detectable, since there's no one to monitor traffic levels, and I don't think most users would read too much into it if a patch failed.

Re:How do you know you've never gotten a virus?

[Jackmn]

What rubbish, if it's on the machine it's detectable. May not be easy, but you'll find it eventually if you look hard enough.

Not while you are booted into the compromised OS. You have to scan your machine from some read-only media to know with certainty that you are not infected.

Re:How do you know you've never gotten a virus?

[frinkacheese]

>In order to limit the power of these criminals, everyone must firewall and patch their machines. This may not even be >enough though! What people really need to do is occasionally completely reformat after booting off a cd so any rootkit >will be erased.

Oh come on folks, somebody mod this funny!

He can not really be serious. You don't need to re-install to get rid of rootkits, you need to re-install just to make it work.

Sheesh.

Re:How do you know you've never gotten a virus?

[Fred_A]

Whenever someone brags they have never gotten a virus, especially just after blithely disabling some security feature, it raises a big red flag.

Yes, such as "Have you been using that Symantec crap again that took me hours to remove last time ?"

Re:How do you know you've never gotten a virus?

[dc29A]

Whenever someone brags they have never gotten a virus, especially just after blithely disabling some security feature, it raises a big red flag. The question is: what is it that makes you think you've never had a virus/been compromised?

I use a few precautions on my Windoze machine.

- Have a virtual machine that runs a naked copy of XP for testing "suspicious" attchements.
- I use a virtual machine as my SSH server, if it's compromised, erase VM, rebuild from backup, patch or secure.
- I never use my PC under an administrator account, the only exception is patching or new hardware installed.
- I keep my systems patched.
- Router/Firewall protects my home network.
- I treat every mail attachment as virus.
- Use an alternative browser, right now it's Firefox.
- I deactivate useless Windows services, my laptop keeps running with about 9 windows services.
- Know what each process running does, it's easy to know once you deactivate the 124523452 useless Windows Services.
- Avoid IE, Outlook Express like the black plague.

All this paranoia saves me the pain of running a software firewall, antivirus and antispyware/adware. No I haven't installed an antivirus or any scanning tool (in the last 12 or so years), but I never seen anything suspicious running.

Re:How do you know you've never gotten a virus?

[AcidLacedPenguiN]

what? That's overkill!!! the only way I solve my virus/malware problems is by removing the hard drive and nuking it from orbit, it's the only way to be sure!

Re:How do you know you've never gotten a virus?

[ehrichweiss]

Sad but sooo very true...and funny.

Re:How do you know you've never gotten a virus?

[Anonymous Coward]

Actually, having read that again a few hours later (I'm the same AC who wrote this comment), I guess what I wrote is pretty much irrelevant. If the files are on the machine then they are indeed detectable, just not while you're booted into the compromised OS.

Given that the rest of this thread seems to suggest booting from "uncompromisable" read only media like a CD and running scans, my comment above is wrong. Obviously if you're booted from a known-good CD then HackerDefender will never be able to run and cloak itself, and will therefore be detectable.

Re:How do you know you've never gotten a virus?

[Anonymous Coward]

Using VMs like that is basically a good idea, but you should be aware that it is entirely possible for malware to detect it's running in a VM and act accordingly e.g. not launch its payload or even try and exploit the VM. Professional AV / malware researchers no doubt have special private VMs designed to be harder to find, but standard ones like VMware and VirtualPC are trivial, just examine the hard disk indentifier string or numerous other dead giveaways.

Hypervisor VMs like "blue pill" could be much more difficult to detect, although I hear the blue pill PoC itself is somewhat overhyped and can easilly be detected e.g. by just scanning memory.

Re:How do you know you've never gotten a virus?

[Anonymous Coward]

Or, you could use a system that runs no services by default whatsoever, and be very careful about what you open. It works just as well.

The fact is, by analyzing software long enough, you should be able to see things out of the ordinary. Not necessarily meaning it is, in fact, a trojan horse. Some things you might want to look out for:
- A full movie that is 16k.
- Executables in email attachements
- Web sites that redirect to executables
- Anything ActiveX (please use a browser that doesn't go anywhere near this)
- Extra plug-ins from a source that isn't well-known (basically, anything like an ActiveX control that can execute code on your computer)

Re:How do you know you've never gotten a virus?

[Orlando]

So it's detectable.

Is Telstra not one of the biggest?

[N Monkey]

The biggest ISP's in Australia supply a USB only DSL modem when you sign up.

My parents signed up with Telstra and were offered either a free USB or a (single port) ethernet modem. Naturally, I told them to choose the latter.

Re:Is Telstra not one of the biggest?

[Kangburra]

and had your parents not asked you what would they have got?

Re:Is Telstra not one of the biggest?

[N Monkey]

Given that
(a) My brother has a Mac (so USB drivers might not exist) and
(b) my parents had an "ancient" laptop (now deceased) at the time,
  they might still only have had the option of ethernet anyway. I must admit, I was pleasantly surprised that there was the choice.

Re:Is Telstra not one of the biggest?

[Kangburra]

What used to really annoy me, was people with USB and ethernet on their modem who had (kindly) been set-up using the USB port by a mate (who knows about computers!).

Re:Is Telstra not one of the biggest?

[Mike89]

Why did that annoy you?

Re:Is Telstra not one of the biggest?

[Linker3000]

Eliza? That you?

Re:Is Telstra not one of the biggest?

[Mike89]

Eliza? That you?

... no ...

Re:Is Telstra not one of the biggest?

[Anonymous Coward]

Presumably because the USB modem typically requires extra drivers (which may not be available for your OS), and USB drivers typically use more CPU than Ethernet drivers and are less stable.
Typically a modem with an Ethernet connection can be plugged into any PC with an Ethernet connection and it just works.
Opting for a USB modem only makes sense if:
1/ Your PC cannot support Ethernet for technical reasons such as not having a spare card slot
2/ You don't currently have an Ethernet port on your PC and you're too poor or tight to shell out $10.

Re:Is Telstra not one of the biggest?

[jawtheshark]

I'm not the guy that posted that he was annoyed, but I would also be.... Why? It is very simple: USB is only good for HID or Mass Storage Devices. For anything else: you're dependent on drivers. Not so with Ethernet. Ethernet "just works" on every computer that has a NIC, and no computer made in the last 4 years lacks one. That is why I can connect my OpenBSD machine to my ADSL connection with an Ethernet Modem (not Router... I jumped on the DSL bandwagon very early). With USB I would have been screwed and so I chose to pay more for the Ethernet version. (Which incidentally was intended for Macs because of the lack of USB drivers for the Mac, but I didn't tell them I didn't have a Mac)

Always keep in mind: USB is only good for HID (Human Interface Devices) and Mass Storage Devices... It really is that simple.

Re:Is Telstra not one of the biggest?

[araemo]

It isn't even really GOOD for mass storage devices. W/ USB 2.0 it's not BAD anymore, but it certainly isn't good at high-throughput synchronous IO. It's not bad for flash drives, as they tend to be slower anyways.

Re:Is Telstra not one of the biggest?

[jawtheshark]

:-) I skipped out on USB 1.0 and USB 1.1, that's why I probably never had any big problems with them.

Re:Is Telstra not one of the biggest?

[Anonymous Coward]

Always keep in mind: USB is only good for HID (Human Interface Devices) and Mass Storage Devices... It really is that simple.

Please categorize the following as either HID or MSD:

* Scanners
* Printers
* Cell Phones
* Cheap Webcams
* Graphing Calculators
* External Sound Cards (mainly for laptops)
* External TV Cards and Video Cards (mainly for laptops)
* PDAs
* Fuel Injection Tuners
* Digital Circuit Tools (logic analyzers, function graphers, etc.)
* Hand Warmers
* Every other stupid (read: niche) USB device you've ever seen

Or make some contention for why all of these things are better off

A) Not existing (k fine, got me on the handwarmers)
B) Using 25 year old Serial or Parallel, which many notebooks don't even have anymore
C) Using firewire, which is undisputably less common than USB

How about, if I already have a LAN that I wish to segregate from the Internet, and I have a USB port and no qualms about the 0.007% speed compromise or the drivers which affect my life on an order of 0%, a USB modem makes perfect sense? Perhaps all of the scenarios you can think of may not require USB to exist. Now consider all of the scenarios you can't think of.

Incidentally, I have an ethernet cable modem hooked up to a WiFi router.

You want to know how I got WiFi on my laptop which already has used up card slots? Betcha can't guess...

More rational, isn't it?

Re:Is Telstra not one of the biggest?

[jawtheshark]

I did not say that this stuff didn't exist. I said that all of these (except those that need USB for power only, like those fans, warmers, etc) will need custom drivers and that there is no common protocol. That's the problem. I buy a scanner it will not work unless I install their drivers. If it were true "Universal" Serial Bus, the operating system should support it right out of the box for at least the basic features.

All those devices you mentioned are neither HID or MSD. I didn't say you can't use anything else, but you cannot use anything reliably because you cannot take your USB Ethernet device, plug it into another computer and expect it to run without changing the OS (e.g. install drivers). You can with both HID and MSD.

So, don't be so sarcastic. I know USB can be used for other things, but I was talking about something completely different: Interoperability. You might have heard about that one.

pah

[Anonymous Coward]

Real FPers use Refresh. You kids and your toys...

Re:Obvious

[Anonymous Coward]

You should use the antivirus. The viagra & rollex offers that you send to 1000000 mailboxes every day take more CPU cycles and bandwidth than antivirus. Plus, A/V is something you avare of.

How could you be this wrong?

[SanityInAnarchy]

How is this new?

RTFA. It's new because it is a specific attack that's just been discovered. If you still don't think it's new, look up the word "specific" in a dictionary and see if you can figure it out. Hint: No one is claiming that it's a new kind of attack.

Any attack worth its salt disables the firewall first thing.

The hell it does. Are you sure you know what a firewall is?

Most attacks these days would completely ignore the firewall, and look for a way around it. Once inside, the only point to disabling the firewall would be to send spam, I guess, and the smarter ones would, again, attempt to go around it, so that a sneaky admin would still see their firewall supposedly working, and wouldn't see any suspicious rules to allow that particular app to connect.

In fact, I can't really think of any firewall-disabling attacks that make any sense. Even if we're talking about a big, corporate firewall, disabling it would be downright retarded -- the admin will be onto you in a heartbeat, and if it's any kind of decent firewall and you have the kind of access it takes to disable it, you almost certainly already have a tunnel as far in as you can go.

(Note: Almost. I can imagine some strange networks and situations where you'd be right, but you're still wrong, because we're talking about a single attack on a single Windows computer.)

Now, this attack is actually new and of a somewhat rare kind -- it disables the Windows firewall, which means it could potentially allow other attacks. It's amazing how stupid it is -- this attack should not work -- but it is not, by itself, a real danger.

Saying this is news is like telling people AIDs is linked to death.

I think you meant to say "AIDS". AIDS is not the plural of AID. AIDS stands for Auto-Immune Deficiency Syndrome. AIDS is singular.

Also, AIDS does not necessarily cause death. It just weakens your immune system ridiculously. Think of it like playing Halo without a shield, if such a thing was possible. People with AIDS have to be insanely cautious in order to simply stay alive, and to prevent spreading the virus to others, but it's entirely possible to live with AIDS.

So, basically, you're entirely wrong in every single thing you said. That's impressive! That's an accomplishment!

Re:How could you be this wrong?

[TheShadowzero]

Actually, you're right. I should have RTFA. I thought the discussion was about a virus.

I think you meant to say "AIDS". AIDS is not the plural of AID. AIDS stands for Auto-Immune Deficiency Syndrome. AIDS is singular. Also, AIDS does not necessarily cause death. It just weakens your immune system ridiculously. Think of it like playing Halo without a shield, if such a thing was possible. People with AIDS have to be insanely cautious in order to simply stay alive, and to prevent spreading the virus to others, but it's entirely possible to live with AIDS.

Jeez, give me a break. I forgot to hold down the shift key for the last letter. I know what AIDS is. Anyway, I didn't say AIDS causes death, as you seem to have thought. I said it was linked to it. Weakening your immune system such that relatively common illnesses may cause death seems like a link to me. Also, it's not that hard to avoid spreading AIDS to other people as long as you are informed. It's called abstinence, and plenty of people practice it.

Microsoft change the definitions to suit

[Centurix]

When they advertise that XP installations come with a firewall, they in fact mean that XP installations come installed with a wall of fire. The EULA clearly states that, somewhere near the bottom next to the pictures of cats and the sudoku puzzles, because no-one ever reads that far...

Re:Obvious

[surgicaltubing]

My Father's laptop got stung by this (i think) I tracked down two values in the registry for disabling AV and firewall. Now it's fckucked and the cpu is at 100%. Yum.

sir

[Anonymous Coward]

please step away from the keyboard until you have conquered your substance abuse problem

thanks

Rats

[Anonymous Coward]

So much for my plans for shutting my firewall off remotely from work...

Re:Obvious

[Spacejock]

I turned mine off when I discovered it was blocking the winsock control even though I'd given the application USING the winsock control full access. It also slowed down email retrieval by a factor of ten. I tested it several times, firewall on and firewall off, and proved it to my own satisfaction. So, out the window with that particular feature.

The Remedy

[excelsior_gr]

As it seems judging on the majority of the comments, the first thing an *experienced* user would do on an XP machine would be to deactivate the MS firewall and install a third party firewall.

But then again, which unexperienced user would set up a LAN with the - advanced I would say - specifications described in the article? So, no real need to patch there... I am suprised they ever found out about this thing. It is easy to forget that all these little Windows tools are for users that will do no more than the occasional browsing and multimedia playback.

For the record, I have iSafer always enabled .

Re:The Remedy

[Slashcrap]

As it seems judging on the majority of the comments, the first thing an *experienced* user would do on an XP machine would be to deactivate the MS firewall and install a third party firewall.

We obviously have a very different definition of experienced. Your's seems to include installing one of the invariably rancid 3rd party software firewalls.

How do you even begin to choose between ZoneAlarm, Kerio, Norton, McAfee and all the other alternatives? Do thorough research and pick the one that sucks the least amount of dead donkey cock least often? It's not exactly a pinnacle of excellence is it?

Wait, wait, wait

[kjart]

Windows has a firewall?

....sorry, please continue :)

Re:Wait, wait, wait

[Anonymous Coward]

Windows has a firewall?
No, not exactly... it is usually referred ta as a placebo for a firewall.

MS Cluster Service = ICS

[terminal.dk]

Please see here:
http://isc.sans.org/diary.php?storyid=1809

MS Cluster Service will not work without ICS running, it is used for internal NAT handling.

So the problem is much more widespread than small LANs using ICS.

Re:MS Cluster Service = ICS

[Anonymous Coward]

MS Cluster Service will not work without ICS running, it is used for internal NAT handling. So the problem is much more widespread than small LANs using ICS.

If you're running a cluster on a MS platform using MS Cluster Service, and are relying on Windows Firewall to filter your traffic for you, you deserve whatever fate that this vulnerability is going to deal you.

Re:MS Cluster Service = ICS

[outcast36]

MS Compute Cluster Service will not run without ICS. Compute Cluster Service is the MS Beowulf.

Your traditional HA clusters, file, print, SQL Server, Exchange DO NOT require this service.

In Soviet Russia ...

[Anonymous Coward]

... firewalls disable you.

Re:Obvious

[b100dian]

Personal firewalls protect your from hackers and worms
And also protects others from you:)

What if the attacker gets a PC on the LAN...

[Anonymous Coward]

What if the attack just gets a PC on the LAN to send the attack packet?

Re:What if the attacker gets a PC on the LAN...

[Anonymous Coward]

What if your aunt had nuts, and your uncle had tits?

Re:What if the attacker gets a PC on the LAN...

[Anonymous Coward]

Why then I wouldn't feel as bad about my uncle molesting me!

If they use ICS, then they deserve it!

[www.sorehands.com]

Come on people. Routers are cheap. It is better to use a hardware router instead of a Windows machine as a router. At home, I run a 300MHz Pentium II as a router. At the office, a router is used.

Everyone knows Windows is insecure. It only costs $30/$40 for a router. $29 for a D-Link DI-704P 4-Port Cable/DSL Router at outpost.com

Re:If they use ICS, then they deserve it!

[FFFFHALTFFFF]

Well, time of think. I agree with you, its to easy and cheap use a external solution, like a router. Now think about a dumb user who dont know how to share his connection using a router or whatever. The first step is search the way in Windows, then he finds ICS. Well, the doors are open.

Re:If they use ICS, then they deserve it!

[cciRRus]

The so-called routers (NATs) are only one-way firewalls. They block unsolicited incoming packets just like the built-in firewall in Windows XP SP2. Wouldn't it be smarter to rely on FREE 3rd-party firewalls that protect more than just WAN-level attacks?

Re:If they use ICS, then they deserve it!

[Anonymous Coward]

The only reason you'd need ICS turned on is if your sharing a dial up connection. Hence no Cable/DSL router is needed or wanted.

Re:If they use ICS, then they deserve it!

[Anonymous Coward]

300mh? Ha, I have a 100mh with 24 megs of ram and no hard drive. I laugh at your bloatware firewall!

How to disable the Windows FW in 2 lines of VBS

[Anonymous Coward]

Fortunaltey for all V(irus)B(uilding)S(script) coders, Microsoft gave us all a very easy way to silently disable the firewall at any time...

Set objFirewall = CreateObject("HNetCfg.FwMgr")
objFirewall.LocalPolicy.CurrentProfile.FirewallEna bled = FALSE

Re:How to disable the Windows FW in 2 lines of VBS

[cortana]

What's you point? That's only a problem if you can run that code as a non-administrator...

Re:How to disable the Windows FW in 2 lines of VBS

[genooma]

/etc/init.d/iptables stop

of course, is lees likely that someone is running as root in linux than someone running as administrator in windows, but you get my point.

Re:How to disable the Windows FW in 2 lines of VBS

[BoneFlower]

Windows makes it very hard to run as a non-administrator.

The problem is limited accounts are too limited. Great for an office system where you aren't installing or configuring things anyways, but being a primary user of a home PC it's too much trouble. Procedures to let individual apps run as admin, or to temporarily assume admin powers for a task, are crap. Windows might be easier than *nix in many areas, but running as a limited user and only assuming admin powers when actually needed- that isn't one of them.

In my opinion, this is the biggest security issue for Windows NT series OS's. Fix this, and add to the setup program(even for preinstalls) a step that sets up a limited user account, and Windows XP security will improve significantly.

Re:How to disable the Windows FW in 2 lines of VBS

[mythosaz]

Or in one shelled command.

netsh firewall set opmode mode = DISABLE

Or, if you insist:

CreateObject("Wscript.Shell").Run "netsh firewall set opmode mode = DISABLE"

But what's the point? ZOMG! You can turn off features in Windows from scripts and command lines? You don't say.

While the article does it's best to hide it, the simple matter is that this is a bug in the ICS service that could allow firewall to break. So, if you're on the inside of a lan, and a Windows machine running ICS is your gateway to the outside world, you could possibly cause the ICS service to crash, taking Windows Firewall with it and exposing the machine to the outside world.

It's a bug that needs fixed, no doubt -- but hardly critical.

And again...

[Klaidas]

Malicious code can damage your computer. New bugs can be found on a patched system. News at 11.

Use a secure firewall

[Bunyip Redgum]

Use a proven firewall such as OpenBSD which can both act as a firewall and provide NAT dhcp etc for the LAN.

Unlike windows OenBSD has suffered "Only one remote hole in the default install, in more than 10 years!".

Oh and version 4.0 is due out tomorrow - see http://openbsd.org/40.html

Re:Obvious

[Kenyon]

LOL. Either you're joking or you're insane.

Re:Because, of course, Windows Firewall is awesome

[Anonymous Coward]

Considering the number of security alerts concerning ZoneAlarm compared to the ones concerning Windows Firewall I would not be so proud...

But we are on slashdot so surely anything marked windows is worse!

Re:Obvious

[ajs318]

You've most probably been been buying crap routers. D-link, Belkin, Linksys, Netgear - for chuff's sake, they might as well be branded "Barbie (or Action Man) My First Router". Treat yourself to a nice ZyXel router, and you might forget you even have a router in your network.

Re:Obvious

[Anonymous Coward]

I'm not joking. Perhaps you're just clueless?

Show me a router 150$ that can handle bittorrent + ed2k on 10mbit 24/7 (on top of "regular" stuff), and I'll show you flying pigs.

Yeah, I saw a couple nice ones that might have sufficed, but I didn't want to spend the 600$+ they were asking for (that was a sonicwall) when just installing a small app on a already running box with a spare NIC I had laying around works even better (for 600$ less).

Why Does Windows Get All the Press?

[RAMMS EIN]

Why does Windows get all the press? It's not fair! I want to see some coverage of stupid holes in Linux and the free BSDs!

Re:Why Does Windows Get All the Press?

[mackyrae]

Find one and start bitching. If it's not fixed within a week of your public bitching (which must be online, not to Aunt Sally), then complain about how insecure *nix is.

Re:Why Does Windows Get All the Press?

[freedom_india]

Yeah man i agree with you. Windows hogs all the press nowadays !!! I have been sitting with my Mac OS X and Brickhouse for over 11 hours on the net and all i find is so far stupid attacks against IIS, etc., which no way is making my Mac sick. I even went ahead and browsed seriall.org, etc., but they seem to install ActiveX which my Mac sadly refuses to even recognize....
One site went ahead and tried to download an .exe file when i went to it...Safari stopped and asked me whether i want to download...: and i said "yes". Sadly after that download, Mac didn;t know what to do with .exe and when i double-clicked on it, it provided me with a Open With dialog....
Stupid Mac...

I WANT MY FIREWALL DISABLING VIRUS On My Mac !!!!

Re:Why Does Windows Get All the Press?

[Anonymous Coward]

http://www.securityfocus.com/brief/161
http://www.eweek.com/article2/0,4149,1530875,00.as p
http://news.zdnet.co.uk/software/0,1000000121,3911 7586,00.htm

Re:Why Does Windows Get All the Press?

[Anonymous Coward]

First link: Ubuntu - six months ago - issue patched AT THE TIME OF ARTICLE PRINT - so says the article.

Second link: Linux - two YEARS ago - issue patched AT THE TIME OF ARTICLE PRINT - so says the article.

Third link - Linux - THREE YEARS AGO. I won't even mention that the holes were definitely patched quickly. Again, three years ago.

DUDE, STOP TROLLING.

Re:Why Does Windows Get All the Press?

[Anonymous Coward]

From parent:

I want to see some coverage of stupid holes in Linux

What could be stupider than Ubuntu storing the system password in plain text?!

http://www.securityfocus.com/brief/161

Re:Why Does Windows Get All the Press?

[Abies Bracteata]

What could be stupider than Ubuntu storing the system password in plain text?!

http://www.securityfocus.com/brief/161

Pretty stupid blunder.... but it applies only to version 5.10. Plus, it was already fixed by the time that securityfocus article hit the press last March.

Re:Obvious

[toadlife]

Yep.

My old gateway with two 3com 3c905 and FreeBSD laughs at the measly bit torrent connections I throw at it. Before I set that up a few years ago, I had similar experiences with consumer grade networking gear.

Re:Because, of course, Windows Firewall is awesome

[Anonymous Coward]

But we are on slashdot so surely anything marked windows is worse!

Squeal, fanboy! Squeal!

Re:Obvious

[Anonymous Coward]

What makes you believe that a (home) router, which is a small microcontroller with some dedicated firmware running on it, will outperform a modern PC that has 10-20 times more CPU power available?

Re:Obvious

[Propaganda13]

Actually, he's probably partly referring to the routers flooding their wireless connection which happens with Zyxel routers too.
http://www.tomsnetworking.com/lans_routers/charts/ index.html?chart=124
You set up a p2p like bittorrent that is willing to use a lot of simulataneous connections and it floods your router and your connection drops.
Of course, it does sound like a lot of routers(1 a month?) to go through so if he's returning a lot of dead routers, a possible power problem in the home is possible.

Re:Oblivious

[Anonymous Coward]

Heh you replace it with one of those commercial backdoors do you? Umm whatsitcalled .. phone-home .. phone-alarm-something ...

http://en.wikipedia.org/wiki/ZoneAlarm#Version_6.0 _spyware_controversy

Too late buddy, you already installed *windows*.

ICS users are enemies of earthkind!

[Anonymous Coward]

A person who uses ICS is even more guilty against mother Earth than SUV owners. ICS requires the gateway PC to run even if you use only the client PC and this means 250Watt or more excess electric consumption. An ICS user fills the air with CO2 emitted from coal powerplants that make electricity. If you dont buy a 20$ ADSL router that runs off 12 Volt wall adapter and runs your net sharing on 10Watts or less then you are a pollution terrorist, a cohort of fossil fuel barons.

I hope all ICS users get hacked to death and their mangled bodies displayed on spikes to educate the masses on the importance of conserving resources.

Re:ICS users are enemies of earthkind!

[Anonymous Coward]

Not if your gateway PC is a dual core machine. I waste 600W when I go this, and kill more than twice as many trees as you claim.

outside!

[leuk_he]

according to this sans article the DOS attacks comes from outside.

If i understand it is with a corrupted DNS reply packet.

Re:outside!

[arth1]

according to this sans article the DOS attacks comes from outside.

If i understand it is with a corrupted DNS reply packet.

It still shouldn't be a big deal, because with any firewall, if it goes down, the underlying system will default to blocking all packets, right? Right?

Regards,
--
*Art

Re:Obvious

[Anonymous Coward]

Hell yes, I sit at a wireless internet helpdesk at my university. I think 75% or something of our visitors use Windows firewall. There must be lots and lots of people using it.

It does if you use AOL

[Anonymous Coward]

or similar windows-only ISP. Or if you aren't ready to jump through the hoops of convincing them that the DSLAM head is broken and not that you're running Linux that is causing your connection to fail.

Suddenly noone is using wireless?

[db32]

So I see dozens of comments about "Its no big deal, you have to be on the lan". Am I the only one that hasn't forgotten how common wireless networks are and how trivial it is to gain access to most of them?

Re:Suddenly noone is using wireless?

[walt-sjc]

Most people with home wireless lans use wireless routers with the built-in firewall instead of an access point, switch, and a PC with ICS, so I wouldn't expect wireless networks to be a major issue in this specific issue.

Re:Suddenly noone is using wireless?

[Anonymous Coward]

Are you for some reason setting up all the wireless users in your neighborhood with access to the internet through Internet Connection Sharing, in which case they are already behind your firewall? Even without this exploit, if that's your setup, you were screwed long ago. Yeah, it's an exploit, but even considering wireless it's still no big deal. But on the anti-MS side, it is a crappy firewall, people should dig deep for that $40 it costs to get a hardware one that is better. And ICS is pretty crappy too, but I haven't tried to use it in several years now. XP just doesn't make a good firewall or router.

Re:Suddenly noone is using wireless?

[Anonymous Coward]

If you read more carefully, you also have to have ICS (internet connection sharing) on (and I'm assuming actually sharing the internet with the other computer). This is definitely not a wireless issue.

Re:Suddenly noone is using wireless?

[Anonymous Coward]

Why would you be using ICS if you are logged on to a wireless router?

Re:Suddenly noone is using wireless?

[walt-sjc]

Why would you be using ICS if you are logged on to a wireless router?

Exactly.

Re:Suddenly noone is using wireless?

[cmburns69]

So I see dozens of comments about "Its no big deal, you have to be on the lan". Am I the only one that hasn't forgotten how common wireless networks are and how trivial it is to gain access to most of them?

You say that as if leaving your wireless access point open isn't it's own security risk...

Re:Suddenly noone is using wireless?

[db32]

Why would you assume the people who this is going to hurt have a clue in regards to network engineering in any fashion. I frequently see ICS and such turned on when there was no reason. Or if you want it simplified...cable/dsl modem -usb-> PC -> ethernet -> WAP OR cable/dsl modem -usb-> PC -> built in wireless. You have obv havent fired up wireless stuff in an airport recently...tons of nonsense wireless settings.

Re:Suddenly noone is using wireless?

[db32]

Doesn't have to be left open. You can crack WEP keys relatively easily...just need enough packets. Thank god for bittorrent and other sharing stuff. Not hard to catch enough packets when people d/l so much stuff :) Also, you should never trust an open network is accidental...I mean i could open mine up just to watch what you do on it :)

OT

[hummassa]

Eliza? That you?

Do you want to talk about Eliza?

Re:Obvious

[dc29A]

Does anyone actually leave windows firewall on anyways? Its one of the first things to go when I have to use windblows xp.

For friends and family (until recently) had no choice to leave it on but turned off. Computer browser stopped or simply wouldn't work and when Joe Clueless tries to access his pr0n^H^H^H^H^Hwedding pictures on other PC the Computer Browser service wouldn't access the other PC. For some reason firewall had to run (even if turned off) for Computer Browser to function properly. I think this "feature" has been fixed as an SP2 post fix.

Also, my sister doesn't have a router, she uses a dialup for her net so I left firewall on. It's primitive but it does the job.

What are you talking about?

[140Mandak262Jamuna]

in fact some are not even detectable in any way.

Are you talking about viruses and worms that afflict computers or some kind mystic God? If they are not detectable in anyway, even you might be hosting malware and would not be aware of it. Right?

Re:What are you talking about?

[AliasN]

If they aren't detectable in any way.. annoyances, popups, mysterious things happening to the computer, increased traffic..

Then.. why worry about it?

Re:Because, of course, Windows Firewall is awesome

[ben there...]

Considering the number of security alerts concerning ZoneAlarm compared to the ones concerning Windows Firewall I would not be so proud...

Yeah because there are so many vulnerabilities in ZoneAlarm. </sarcasm>

WRT65GL

[coder111]

I have a Linksys WRT54GL router (http://en.wikipedia.org/wiki/WRT54GL). It uplinks via 36-54mbit (depending on conditions) wireless connection, and acts as a router for a network of ~10 computers with quite heavy p2p traffic. It is stable and rarely slows down. Of course, I run a custom linux firmware on top of it (HyperWRT Thibor, original firmware sucks quite bad).

Oh, and it cost me ~70 USD.

--Coder

Re:WRT65GL

[Loconut1389]

seconded- I run several incarnations of WRT54G including the GL, SL54GS and GS (all with OpenWRT or DD-WRT) and have no stability problems at all.

Caveat: I had one 54GS running DD-WRT that seemed to bomb off the face of the earth every 30 minutes without provocation or traffic- switched to OpenWRT and don't have a problem any more.

Re:Obvious

[KDR_11k]

Because you can't meaningfully implement NAT on a single-machine "network"?

Your choices

[BeeBeard]

You have a few options:

1. Run Windows natively but unplug your CAT-5 cable or disable your networking devices under the device manager. Having no internet access under Windows fixes this and many other problems nicely.

2. Are you really sure that the graphics applications you use require Microsoft Windows? I think that you would be very surprised by how good the support is for most Adobe products, including Photoshop, using WINE.

3. Run Windows and your graphics applications in a virtual environment using VMWare. Unless your graphics applications require advanced, DirectX-based rendering or some such thing (unlikely), then this will work great too.

Hope that helps!

Software firewalls suck

[Shados]

I feel for people who have no other options, but... software routers suck. That they are made by microsoft or anybody else. Hardware firewalls for the win. (which I guess in the end ARE just embedded softwares...still better at the end of the day)

Re:Software firewalls suck

[DarkShadeChaos]

At one point I had 'borrowed' a Cisco 2600 and used that for my home connection. That with a sensible access-list and NetFlow to easily check up on things seemed to work well for me :-D I also noticed how many russians liked to poke and prod at my router, grrr...

Re:Obvious

[Colde]

You got a point, but the wrong set of routers.

D-link, Belkin, and Netgear is crap and has these issues.

However, Linksys certainly does not. I have never had issues with Linksys routers. ZyXel is as crappy as the rest.

Bingo!

[KwKSilver]

Hey mods, mod parent up.

malicious data packet vectors

[Suicide Clown]

For a while I used Azureus as my BitTorrent client under WinXP. While downloading large video files, I noticed that my firewall, ZoneAlarm (free version) would fail intermittantly. The TrueVector service would fail and then would restart after a few minutes. This would only happen when I was using Azureus to download and upload.

So I tried using MS Virtual PC to run another copy of WinXP and run Azureus in that sandbox. Same problem.

I thought maybe I was being attacked via bad packets sent to Azureus but was told I was being way too paranoid.

I switched to a Linux virtual machine to run Azureus just in case.

Re:malicious data packet vectors

[Shadow99_1]

That's actually an issue that efects alot of free Firewalls in windows... They just can't handle the load from torrents very well and eventually fail or turn your computer into a slow POS and force you to restart... It's actually the reason I switched to using the crappy windows firewall, as it's the only firewall that only protects one way (which I know is a bad thing, but it's tracking a high number of inbound and outbound connections that causes the issue between most software firewalls and torrent software, so eliminating the extra load solves the problem). My linux box just doesn't have the storage space of my windows PC (the windows PC being for gaming is faster and has alot more space). Of course I sit behind a router, but routers don't stop everything (from having run ZoneAlarm and seeing the results pre & post router, the router cuts the number of inbound issues in half), so it still makes sense to run at least soem basic firewall protection on the PC itself...

Anyways... Most firewalls for windows just can't handle the stress of torrent software for any extended period, other than basic ones like MS's firewall...

Re:Obvious

[ajs318]

The smaller ZyXel routers use a traditional transformer power pack with 12V AC output. Judging by the temperature rise, the on-board regulator is most probably a switched-mode type. I'd guess this would be quite tolerant of power surges, just with the presence of a mains transformer (hefty inductance; doesn't like rapidly-changing current). The "surge suppressor coils" found in cheap, switched-mode power packs are laughable. A well-designed power supply should fail safely and protect the connected equipment, but cheap ones often aren't well-designed.

As for the wireless stuff, well, that's too bad. But your computer already needs one connection to the wall to get its power. Will one more for data kill you?

It's a matter of acting reasonably

[gelfling]

Sure you could build your own firewall appliance and shove it in a DMZ on your home LAN. And you could implement hardware dongles for wireless. And you could sandbox everything and so on and so on and so on.

But is that reasonable? Do you really have content on your machines that's so valuable that it has to be preserved at all costs? Is it really worth the time, effort and money to do so? Did you remember to back it up? People should take reasonable precautions such as a good software firewall, a real time AV scanner, a few spyware tools, a good registry cleaner, etc. Run them once or twice a month unless you see obvious artifacts of some problem. Keep the OS patched on a more or less regular basis but avoid chucking everything on all the time ASAP. Let someone else debug it. That should keep you running.

More than that you should evaluate the rationale for it, just like building a business case at work. If protecting the machines takes as much effort at using the machines, you might have missed the mark.

Re:It's a matter of acting reasonably

[burnin1965]

Sure you could build your own firewall appliance and shove it in a DMZ on your home LAN. And you could implement hardware dongles for wireless. And you could sandbox everything and so on and so on and so on.

But is that reasonable? Do you really have content on your machines that's so valuable that it has to be preserved at all costs? Is it really worth the time, effort and money to do so? Did you remember to back it up?

I tried backing up the cash I keep in my online banking account just in case my Windows box gets zombied and sends off my keyboard input to some h4k3r in russ14, but I learned from the FBI that backups are illegal.

Re:It's a matter of acting reasonably

[heybo]

Why go through all that BS and spend money on AV and all that? Why spend a weekend a month cleaning your PC? Just used a good router AND A GOOD OS!

Its not my fault you use windoze.

Re:It's a matter of acting reasonably

[gelfling]

Yeah that's fine. For some people.

Re:Obvious

[matt328]

This is true, but I don't think that's the point others are trying to make. In this particular case a router removes the need to run ICS, and consequently removes the threat from this exploit.

Re:Obvious

[InsertCleverUsername]

Windows firewall is a bad idea --it gives users a false sense of security and is, in reality, only half a firewall.

Last night, while surfing in IE6 (god forgive me), I got nailed with a trojan JUST BY VISITING a website! And this is on a rigorously patched XP Pro box. If not for ZoneAlarm (which, unlike IE, blocks outbound requests too) my system would have been compromised.

Where's the trust Micro$oft?

tards

[Anonymous Coward]

I cant wait till a journalist finally gets something right..

Its not "Internet Connection Service" its "Internet Connection Sharing" which hardly anyone has running anyway. They probably fudded it on purpose just to make their article sound more relevant.

(and /.'s captcha's are SO good that even I cant read them - round 2)

No news today

[Opportunist]

The MS firewall has never been secure. For a few reasons completely unrelated to the current bug.

1. It's configurable via the registry. I.e. write a few keys into the registry and your application has all rights to come and go as it pleases. And that's what malware usually does.

2. Its "warning" windows have a standard window handle and can thus be intercepted by programs and answered "correctly". Another standard tactic of malware.

3. It's attacked by every single halfway modern malware, since it's on every system by default. Every single piece of malware has to defeat it to be "complete". And every malware does. It's not really hard, usually it's enough to do 1. (by simply setting the keys accordingly) or 2. (by creating a thread that waits for the window to pop up and flick it away with the "ok, let it pass" message).

Relying on the Windows Firewall to keep malware out is like relying on a politician to resist bribery.

Re:Because, of course, Windows Firewall is awesome

[MtViewGuy]

The fact that ZoneAlarm can do bi-directional firewall control is the reason why I don't use Windows' own incoming-block only firewall.

Remember the average user

[UnknowingFool]

For this attack there has to be a number of factors in place, and most people here on /. seem to dismiss the likelihood of an attack because of these factors. But remember, the majority of the population aren't like people here.

1. Must be within the LAN
How many average joes run unsecured wireless? In my neighborhood that's lots of people.

2. ICS must be running
How many average joes have never even opened Services much less turned off unneccessary Windows services?

3. No other firewall is running.
How many average joes do not buy a third party firewall because one comes with Windows XP?

This attack can be mitigated easily for computer savvy people. Most people aren't that computer literate. Just my 2 cents.

Re:Remember the average user

[Anonymous Coward]

ICS is disabled by default. It's only turned on if a user sets up internet connection sharing using the Networking Wizard.

How about a secure OS for a change?

[freeweed]

Yeah, instead of closing exploitable network ports, let's throw another layer in front of them! That's sure to be foolproof!

Stay the course.

[megaditto]

You OpenBSDats just want to cut and run from Windows. We need to stay the course if we do not want the smoking router to become a mushroom CPU.

Stay with Windows, or the hackers win!

Re:Stay the course.

[Douglas Goodall]

Please! If you stay with Windows, the only person that wins is Bill Gates. Staying the course didn't work in the middle east, and Windows is a POS.

Putting the "average joe" into perspective

[ratboy666]

And, laying blame properly.

When you buy a new computer, it comes with XP. On the hard disk. Without a manual. Really.

My nanny just bought an Acer laptop. It did come with a "quick start guide".

Nothing about security. Although XP does pop up a dialog asking you to install anti-something-ware software. And natters about using unencrypted wireless links.

So for you points 2 and 3, the vendors are to blame. For point 1? I believe that the warning that you are using an unsecured wireless connection is probably just fine.

Generally, I'll blaim the vendors. Not only are MANUALS not packed, but even CDs are omitted on shipping. How is the "average user" supposed to know? Intuition? I guess they are supposed to read the fine dialogs, and resolve these issues at that time. I guess the vendors take the easy road and throw in "Norton Antivirus" to get rid of the nagging.

Ratboy

Switched back to Microsoft Firewall

[ubuwalker31]

I was a strong proponent of Kerio's free firewall. However, a fully patched Windows XP machine running Windows firewall works just as well. A "shield's up test" reveals no open ports using either system. However, Opening ports using Kerio has always been a pain in the ass. After having numerous issues with bittorrent and ssh using Kerio, I gave up. I now use a hardware firewall which is in my router and the built in WinXP firewall. Two firewalls are enough, IMHO.

Why aren't there any free/open-source/GNU easy to configure software firewalls for windows? Anyone know of any?

Re:Switched back to Microsoft Firewall

[clymere]

http://force.coresecurity.com/index.php

mods on crack

[ajs318]

Since when did "interesting" mean "shills for my favourite product" ?

ICS...

[NIN1385]

I've always known ICS to mean Internet Connection Sharing, not Internet Connection Service. I could be wrong though.

Re:Obvious

[Anonymous Coward]

It can do some good. Write your filtering rules to drop all TCP/UDP, port 137:139 like a hot rock! Who needs that protocol anyway. I haven't missed it in years.

Re:Obvious

[TheUnknownCoder]

What the fuck is going on with the Mods nowadays??? The guy has a valid point, not applicable to most of us, but a valid one anyway. And he's a flamebait now?

Oh, how I long for this kind of abuse when [meta]moderating...

Re:Obvious

[johnmorganjr]

Thank God for Linux based firewalls.

Bunched services

[PhotoGuy]

This is something about XP that really bothers me, and I consider a design flaw. Several services run together under each svchost.exe process. (Tasklist /svc will show them.)

I have something wrong with my system now, where one of those svchost processes (after while) dies with an unhelpful messages, killing a bunch of other services with it (including ICS/Firewall). They won't restart for me, either. I'm still in the process of disabling services and trying to identify the single one that is causing grief, and bringing others down with it.

And now, according the article, this same behaviour is used as a security exploit. I wonder if my services have been dying from this same exploit being attempted from the outside on my machine.

Ok....

[LordEd]

If firewalls are a sign of weakness, why does Linux come with a firewall built-in?

Re:Lack of testing? Dialup

[From A Far Away Land]

I guess you never use dialup? Dialup users get screwed on this bug, yet again.

Cool

[LongTimeReader]

I think that's cool, the stupid firewall that comes with XP causes more problems than I can count AND it always turns itself back on! Something to turn it off and keep it off would actually be a plus.

Bring on Vista!

[metamatic]

Thank goodness Vista will lock out third-party firewall software, and prevent these kinds of problems.

Oh, wait...

This is a non-issue.

[Hamoohead]

Who the hell uses ICS anymore? I used ICS once when I was on dialup. I quickly wired another phone line to my second PC and learned to live without concurrent connections. Dialup is fast on its way out anyway.

Re:Obvious

[xiong.chiamiov]

Uhm, we're not talking about getting a virus. Or do you not know the difference between, say, a trojan horse and a virus? Besides, windows firewall doesn't protect against outgoing connection attempts. So, you're probably all zombied up and don't even know it... and you're reading /. . Great.

My master will keep my data safe from intruders?

[jbn-o]

Sounds to me like part of trusting proprietary software to do a good job with security. Uninspectable, unmodifiable, unsharable software shouldn't be trusted to perform securely. You need software freedom.

Firewall

[MrCrassic]

I, for one, welcome our new Windows Firewall pwning overlords.

Seriously though, Windows Firewall is great for very general and basic protection, but it serves no match to free and more efficient [zonelabs.com] firewall software that is actually easier and more understandable to the user.

Re:Firewall

[Anonymous Coward]

"I, for one, welcome our new Windows Firewall pwning overlords"

New?????? Where have you been the last 20 years?

Re:Firewall

[Monsuco]

Seriously though, Windows Firewall is great for very general and basic protection

Well, Windows firewall can usually keep most attackers at bay long enough for you to update windows and then put a firewall on it, if your lucky.

personal firewall ..

[rs232]

None of these software firewalls are of any use as they can be disabled by the next exploit. What is needed is a firewall running on standalone embedded hardware. Of course with the use of RPC over HTTP and SOAP, a firewall is of limited use in this day and age.

Lame and unapplicable to the real world

[dave562]

So lemme get this straight. On a computer with Internet Connection SHARING (ICS) enabled, another host that has been trusted by the original host can screw with that host? Show me a real threat. You know, one that doesn't require me to explicitly give you access to my computer, or my internet connection. Are computers that just have ICS turned on vulnerable, or does the exploit only happen when launched from a computer that is already configured via ICS to share the connection of another computer?

And in other (non)news, a man unlocked his security door, invited a stranger into his home, and then that stranger then mugged him.

Re:Obvious

[Anonymous Coward]

Mods don't have a "-1 Poster appears to be an Idiot" option. Hence Flamebait.

Re:Obvious

[Kenyon]

I say there's not even enough electricity flowing through the network circuits of the router to cause it to overheat like you say.

My fellow mmm'ericans

[Anonymous Coward]

Why does open source hate our freedom?

Re:first post???

[AliasN]

That is not nearly the first post, not to mention it would have been a very stupid first post.

Nobody uses ICS. Nothing to see here, move a long

[fluor2]

Nobody uses Internet Connection Sharing (ICS) in Windows. Nothing to see here, move a long.

I'm much wittier

[Anonymous Coward]

I use Black Ice Defender.

Re:Obvious

[Anonymous Coward]

What the hell does a firewall have to do with you being retarded enough to visit a website and getting trojanned?

Re:Obvious

[Tim C]

As for the wireless stuff, well, that's too bad. But your computer already needs one connection to the wall to get its power. Will one more for data kill you?

No, but my girlfriend nearly did when I started laying bright yellow cat5 cable in the house...

Re:Obvious

[InsertCleverUsername]

> What the hell does a firewall have to do with you being retarded enough to visit
> a website and getting trojanned?

Well AC... Perhaps you should spend more time reading the title of the article ("New Windows Attack Can Disable Firewall") and less time attacking complete strangers. May we assume that you are also retarded since Slashdot is a website? It's not like I went looking for sites crawling with virii.

Please. Lighten up. I've already been punished for using IE6 and Windows.

Re:Obvious

[Zebidiah]

When installing Windows for friends and family I now just use the Windows firewall unless they are a little more savvy. If you have ever watched a user with zonealarm (for instance) they will always click on allow as they rarely, if ever, read what it is trying to tell them. Or they always click on 'Deny' and wonder why nothing works! They rarely seem to notice the 'always' checkbox. How can anyone get any enjoyment using a PC in this manner.

It is pointless having a firewall which monitors outgoing connections for a lot of users because of this. Last month I watched one of them click 'Ignore' (I think it was ignore as it kept repeatedly appearing every so often) when AVG caught a Trojan trying to activate. When I tried to point out what she had done she just shushed me as she was too engrossed with messenger! She never once read what it was trying to tell her. Her sound card drivers are kaput and it needs to be fixed but I just cannot be bothered to fix it.

If I install ZoneAlarm on anyone's PC these days I try to configure it for the programs they use. Unfortunately this means that I have to install everything to make sure that they have a working PC afterwards which is why I generally avoid it. I just stick on the Windows firewall, AVG, Spyware Blaster, Firefox and Adaware SE Personal (not that they ever run it). Funny how they are completely clueless about computers but if you put them in a limited account it is amazing how quickly it becomes one with full administrative privileges.

The only person who I've had any success with is my daughter.

Re:mod dowN

[Anonymous Coward]

wait a minute, its halloween, this is NOT a troll today.. (note goatse pumpkin)

Re:Obvious

[complete loony]

There's your problem then. Get some red or green cat5. It's all the rage in prague this time of year.

... or get rid of the girlfriend ;).

More than that, apparently.

[Grendel Drago]

In Windows, at least, there are class drivers for a variety of USB device classes.

Re:More than that, apparently.

[jawtheshark]

I see (and did not know), but does this mean that I can plug in a scanner and have it work without installing any drivers? That's what I look into a true "Universal" Serial Bus: it should provied at least a basic set of functions for any given devices. For a scanner that would be "acquire image", for a printer "print page". It doesn't help me if I need to install a driver. Point being: if it needs a driver, it will not work on non-Windows OSes. Well, you might get lucky, but you most certainly aren't going to be.

The only two kinds of devices that will work without installing drivers are HID and MSD. Sure, my Wacom (=HID) needed a driver, but *only* to get the additional features. It is perfectly usable without those drivers.

Re:Obvious

[InsertCleverUsername]

I hear you. Actually thinking while using a computer isn't for everybody.

With my parents and grandparents, buying a cheap router was about the best (almost) foolproof thing I could do for them. I still spend a day or two each year, when I visit, just undoing their damage.

Worthless article

[bruno.fatia]

This article is so worthless that I got around 15 full replies and 250 abrev.

Re:Obvious

[Douglas Goodall]

I have never had problems with NetGear, but I am having big troouble with Linksys. I will never buy another linksys product *ever*.

Article title is misleading...

[macraig]

... because the Windows "firewall" isn't a firewall.

Windows Firewall is still OK for most users

[Ken Erfourth]

I don't think Windows firewall is less secure just because a registry hack can turn it off. In order to perform that hack, malware has to be on the computer. The purpose of the Firewall is to keep malware off the computer. As long as it (and Windows Defender and a decent Antivirus program) are running on the computer, the malware won't be there.

On the other hand, third party firewalls tend to cause all kinds of problems for inexperienced users. Since Windows Firewall is ubiquitous, applications know how to play well with it (the flip side of the "all malware attacks it" scenario). Plus, if anything bad happens, you get to bitch about Micro$oft, and you'll get lots of sympathy. Who feels sorry for ZoneAlarm users these days?

It's a bonehead security vulnerability from Micro$oft (Again!), but it only affects a trivial number of users, and hasn't been exploited, probably because of the trivial number of targets. I don't think it is worth going ballistic over.

I'm a lot more worked up over the upcoming EULA restrictions coming up in Windows Vista. Looks like they're going to restrict how many times it can be reinstalled, and potentially, what kinds of upgrades they're going to allow you to make to your computer without paying for a new Vista license.

Re:Windows Firewall is still OK for most users

[Opportunist]

I'm not so worried about restrictions in Vista. I wouldn't be worried about similar restrictions in, say, BeOS or AmigaOS either. For the same reason: I won't use it.

Let's face it. Yes, doing without Windows will be hard for a good deal of the population. But it's neither the end of the world, nor the end of the computing world. Certain applications won't be available. Ok, I'll find a way around it. I won't be able to watch certain content. Ok, I can already do without the majority of current movies, I think I can do without them a bit longer. But, bottom line, what else will I be missing? I can still access websites, I can still read news, I can still connect to FTP servers, I can still telnet.

My life won't end just because I have to sever my ties with Redmond and move to Linux/BSD completely. Maybe it's less comfortable, but for sure it will be a lot more free.

Re:Windows Firewall is still OK for most users

[Ken Erfourth]

I agree. For myself (and my tiny business) I use Macintosh. Always have.

But my customers, who are largely casual home computer users, aren't going to learn something new. Or they're not going to pass up that Direct X only game, or that WMP-only website. So for them I have to have a solution that is easy for them to use, which provides a minimum requirement of security (their box won't get owned if they surf to the wrong website or open/download an infected email).

I always tell them when I set up their boxes that I'm making them safer, not safe. Customers with high security needs get ZoneAlarm and/or SpySweeper, and the same warning. Some of them I send away, because they want more than I can honestly provide. I don't claim to be a security guru. Offsite data backup on a regular basis is still the only truly effective protection.

Security is always a compromise between what would be perfect, and what the average customer can be expected to tolerate and maintain. The best antivirus in the world is useless if the license is expired and the definitions aren't updated. The best firewall is garbage if it blocks a site the user wants to see and they turn it off.

Something is better than nothing. And like it or not, Micro$oft is the one beast that everyone else (including Linux and Macintosh) have to learn to play well with. That's just brutish reality when I'm running a tiny computer service shop. I might like it if the world switched to Linux and Mac (I'd have a lot less business, though), but it doesn't look like it's going to do that soon. So I make the best of a crappy situation. YMMV.

Cheers.