Slashdot Mirror
'Leak' Test of 21 Personal Firewalls
mork writes "Matousec.com, as part of a larger analysis of personal firewalls on Windows, has conducted a thorough leak test of 21 pieces of firewall software. Leak tests imitate common methods used by trojans or spyware to send your information from your computer. Windows Firewall XP SP2 fails every test, so the fears that the days of third party firewall software was over seem groundless. Surprisingly the two top programs are both freeware." From the article: "Some firewalls totally failed tests made against their default settings but their results on the highest security settings were much better. Kaspersky Internet Security 6.0.0.303 is the product with the biggest difference between the default settings score and the highest security settings score. Another such product is Safety.Net. Some products like BitDefender, F-Secure, McAfee, Panda, etc. include antivirus engines. The sad and funny thing in once is that lots of them mark leak-testing software as viruses or malware."
Windows Firewall XP SP2 fails every test, so the fears that the days of third party firewall software was over seem groundless.
The fears aren't because MS figured out how to build a good firewall; the fears are based on supposed "features" in Vista that would make it very hard/impossible for third party vendors to access parts of the OS needed to build good security software without first going through MS for some kind of certification. Not only that, but as MS integrates other security into Windows, like anti-virus, it may become very difficult to install third party AV and firewalls because the built-in AV wouldn't allow it.
Now, I'm not sure how much of these fears were grounded in reality, but I'm pretty sure they had nothing to do with some perceived accomplishment of the built-in Windows Firewall.
This may seem obvious to me.... but the leak-testing software's imitating how a virus or trojan sends messages to the net, right? Wouldn't that of course mean that anti-virus software is going to mark it as malware?
I mean, the anti-viruses must be matching either the behavior of the program itself, or the signature of that data-sending bit. Of course they'll think it's a virus.
+++OUT OF CHEESE ERROR+++ REDO FROM START +++
Yes, but how many of these firewalls run on Linux?
I've really only seen Linux firewalls based on iptables/ipchains. I use one, called TuxGuardian (try Google/SourceForge if you want a link) that seems to work well.
What is "sad and funny" about catching a program that uses the same techniques as malware, techniques which are outside the range of normal software, and flagging it as potential malware?
It's also annoying to see a firewall listed as a failure because it's a firewall and not a host-based IDS.
I'd also argue that the host-based IDS programs are being sold for a purpose that is not their best use. Once a system has malicious software on it, expecting a process on the same machine to protect you and itself is, um, optimistic. Sure they try to defend themselves but that puts them on the wrong side of an arms race.
What they're best for is monitoring and control of "legitimate" software. I have Zone Alarm set to prompt me every time a program tries to run IE6, and to block media players from phoning home to whisper about what I'm watching.
What's important is a firewall stops incoming traffic, to prevent worm attacks.
Stopping outgoing traffic is for the obsessively insane.
[sarcasm] Ok, so let me get this straight. I am stupid enough to allow something to be installed on my system like a trojan or malware, but I'm supposed to be smart enough to secure my system to prevent them from getting back out? [/sarcasm]
I have used firewalls that let me control my outbound. I've found them to be a pain in the ass because I have lots of things that need to get out. And of course every time I update one of them I have to update my list. Try using a Firefox nightly and changing it at least once a week and you'll soon be tired of that. I protect my system by scanning things I download, running A/V, and occasionally verifying my system with an automated spybot check.
Leak tests imitate common methods used by trojans or spyware to send your information from your computer.
This is the least important piece of security I care about on my PC.
If there is a trojan already running on my PC, then I have already lost the war. It is irrelevant if it can communicate directly with an outside server or not. It could send data in a PLETHORA of undetectable ways aside from this (could send stealth emails from my default email program, could post data stealthily in a hidden frame it sets as my browser start page, etc etc).
The goal is to not get the spyware and virii on your PC in the first place. Once it's there, you're already screwed.
I notice that there was no column in there about how aggravating the installed firewall rendered your system. How many of those firewalls are going to try to pop up a dialog box on a game that just went full screen and freeze the game (so you can't even alt-tab out) until you click on a box you can't even see? I mean I could have designed a firewall that would easily pass their tests with 100% reliability, it's called "unplug the network firewall", and it's very simple to install, just reach behind your computer, find the ethernet cable, and pull it out. Viola! Perfect Score!
One thing that struck me about Windows Firewalls as compared to Unix firewalls is that Unix firewalls are focused on keeping malicious traffic out of your machine. Windows firewalls are designed to keep malicious traffic from getting out to the internet. In the end, it's no surprise that the results are a mixed bag, once your system is compromised you really can't expect these firewalls to save you. It's a lot like the antivirus market, where you have a constant arms race between the virus writers (do people write honest to goodness viruses anymore?) and the antivirus companies.
My final complaint is that programs like ZoneAlarm Pro are exceedingly resource hungry for what they do. ZoneAlarm takes over a minute to start on my fairly modern laptop, whereas everything else in the system takes about 30 seconds or so total. Why does a firewall need 24 MB of resident memory?
I read the internet for the articles.
Because moderation should not be based on whether you agree/disagree with the comment or with something it implies. Moderation should be based on whether the comment is valuable to the thread. In this case, it had some information in it (from Microsoft directly) which clarified something. Some people found that Informative.