Slashdot Mirror
MS Security Patch Blocks Net Access For ZoneAlarm Users
An anonymous reader writes "Users of Check Point ZoneAlarm security products, including the extremely popular, free-of-charge software firewall, have discovered that a Microsoft security update released on Tuesday has blocked their internet access. The firewall manufacturer is 'investigating the issue,' and so far the workaround seems to be to uninstall the recent DNS spoofing vulnerability fix MS08-037 (KB951748), and not reinstall it until Microsoft or Check Point have come up with updated versions of their products."
Kevin Smith on Prince
Set Zonealarm's security level to "medium".
Crap! Here come the phone calls asking for tech support...I think I'll turn off my phone for a bit...
So that what was causing the issue. I spend almost an hour trying to figure out what went wrong. Funny thing is she suggested it was ZA. Uninstalled and got net back online. I demand a refund for my wasted hour!
If you're reading this article from a machine in question, you're not broken.
Now please don't call me asking if it's something you should worry about.
"It is a miracle that curiosity survives formal education." -Albert Einstein
Obscure the computer from the internet and its secure!
Good idea MS!!
Crackin' Wise - Blogging about whatever we want
I'd agree with you there. Otherwise you have to attribute it to really poor M$ QA, which is just slightly less believable.
Part of the hardcore faithful who believed in Apple long before it was cool again to do so
This patch was not designed to patch a Microsoft flaw, but instead a vulnerability in nearly all implementations of DNS. So far over 100 vendors have patched their products and coordinated the release of this workaround. If zone alarm is broken because of this change they need to adjust their product to work with this change, not the other way around.
I've taken this snippet from: http://isc.sans.org/diary.html?storyid=4687 which explains things in a little more detail. Full details won't be disclosed until Blackhat in vegas this August.
The root cause is a fundamental, well known, weakness in the DNS protocol. DNS uses UDP, a stateless protocol. A DNS server will send a request in a single UDP packet, then wait for a response to come back. In order to match request and response, a number of parameters are checked:
who sent the response? Was it the DNS server we sent the request to?
for this particular response, do we have an outstanding request?
each request uses a unique and random query ID. The response has to use the same query ID.
The response has to be sent to the same port from which the request was sent.
Only if all this matches, the response is accepted. The first valid response wins. If an attacker is able to guess the query id and the source port, the attacker is able to send a fake response, which will be cached by the DNS server.
Remember that you are unique, just like everybody else.
Why not take this time to try out something new?
But this is Slashdot.. ofcource it is Microsoft's fault.
From articles I've read on the subject, a LOT of the personal firewalls for Windows PCs are having this problem.
Dude that was such a cool breakdown of the situation. I love it when people do that - someone did that the other day with the post about the gpcode virus and how it does it encryption etc and it was an eye opener.
http://projectleader.wordpress.com
Why are we assuming that this is a defect in the Microsoft patch, rather than a defect in the security software? I think it's much more likely that the software firewall application (which tend to be pretty skeevy in general, see Norton Internet Security) is inappropriately blocking access than that Microsoft screwed up the patch. From my (admittedly vague) understanding of the issue, I'm guessing that the firewall software whitelists outgoing UDP requests from port 53, and the new randomized ports are being blocked, preventing DNS queries from succeeding. I know blaming Microsoft is fun, but blaming even crappier software vendors is more fun :)
Get rid of ZoneAlarm and use a decent firewall!
I am glad to read this message. My license expires in 23 days and I was going to throw away Zonealarm and purchase other product. I will uninstall the darn MS patch. Thanks MS! You did it again!
Microsoft should have tested this security update with all the popular firewall software and notified the developers of the firewall software itself. Then Microsoft and the affected software companies should have sent a notification of this issue to registered users of their software.
Zone Alarm certainly counts as popular firewall software
If Microsoft did not test this against zone alarm , than that is pretty shabby QA on the part of Microsoft. If they did, and did not find the issue than it is still pretty shabby QA.
If this was tested and the makers of the software notified, than it was pretty bad on the part of both Microsoft and the third party developers not to notify users and ISPs of this impending issue.
Basically, this surprise for ISP's and users never should have occurred.
We have a Cisco ASA at work for a large enterprise and about 2 hours after I applied the patch to our DNS servers running BIND, they the ASA device blackholed the DNS servers. Wasn't a fun day really.
If you're joking it's not funny, and if you're serious you're mistaken. MS has a history of doing stupid/evil things, but they're smart enough to know where the line is. MS can only dance around the law so much. Consider: As the usefulness of the exploit fades, a sneaky "Data mining" company could make even more money selling/abusing the knowledge of what MS did. Best MS could do is claim it was a (number of) rogue employee(s), but even so it's an unnecessary loss and risk. It won't bring in enough cash to even be noticeable compared to their OS or office software incomes, and it won't somehow stop their sliding market share in either market. But it could potentially cause them to bleed millions or even billions if they fail in delegating the blame to a couple of pawns.
"A witty saying proves nothing." - Voltaire
You should have uninstalled Pista.
Ahh the great security blanket called the software firewall. I like to use the following analogy in regards to them. Having a software firewall on your computer is like having a security guard in your bathroom. If something gets to the guard it's too late, your network is already compromised.
I work for an ISP in Tacoma WA, and Software firewalls cause many more problems then they solve. I don't care which company makes it.
If you are really concerned about security then you will have a dedicated hardware firewall. These are inexpensive and common, even built into most SOHO routers.
So I know there will probably be flames, but if you write software firewalls, remember that the overwhelming majority of people who use them don't usually know they have one, and just ignore those little messages and click allow on everything until they actually read something and say "msimn.exe, what's that? I'm gonna block it!" And then they call me because their e-mail doesn't work.
I'm a happy pessimist. I expect and prepare for the worst, when it doesn't happen I am pleasantly surprised.
Microsoft starts new ad campaign about how great Vista is now and XP suddenly fails. Good one, Balmer.
Can you recommend a hardware firewall that pops up a little window and tells me which application is asking for access to the Internet, and asks me if I want to grant it permanent or temporary permission? Oh and it also has to do checksums on the binary to make sure it's really the program it says it is.
The software firewall is the last line of defense. It's supposed to work with your hardware firewall, not as a replacement to it.
I'm fairly sure that I've just installed this patch. BUT, I haven't rebooted yet. (I'm using ZA, obviously). How can I stop the process of the patch being applied before I reboot so I don't fritz my computer? Thanks
FGD 135
...or instead of complaining to Microsoft, you can disable ZoneAlarm and enjoy having your connection work again. Cheap firewalls failing to perform exactly how you'd like them to is an old, old story.
Given the ridiculous profusion of budget 'security' software swarming around, it hardly seems fair to lay the blame on M$ when ZoneAlarm is the only program that this patch appears to conflict with.
Of course, if ZoneAlarm wasn't proprietary, we could go see where they screwed up. Maybe you should go harass them for being closed-source instead?
"We have to go forth and crush every world view that doesn't believe in tolerance and free speech." - David Brin
And what do Slashdot readers have to say? In about equal numbers:
OK geniuses. What, realistically, is the industry supposed to do in order to stop doing this sort of thing?
I don't know what the answer is. If I did, I'd be lining up staffing, capital, etc. But I'm 100% sure that it is not:
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
...or instead of complaining to Microsoft, you can disable ZoneAlarm and enjoy having your connection work again.
Touché. I'd mod you up. Anyway, now that you mention it... the point of zonealarm is that the default firewall that comes with Windows is terribly insecure. It's interesting how a proprietary OS ends up spawning a lot of proprietary firewall and antivirus software.
My point? No point, it's just interesting to see how proprietary spawns proprietary... as if they were living beings.
Did an update, and all of the sudden, no internet. Removed the update and the internet was back.
Didn't realize it had anything to do with Zonealarm.
Technoli
The may be a big headache for somebody at an ISP who needs to help out users, but as somebody who uses ZoneAlarm, I find it to be very useful.
I've got an actual firewall in my router, but that only protects me from what comes in. And I run Linux, so that counters most other random garbage. But, on occasion, I use Windows and ZoneAlarm is very handy because it alerts me when any program is trying to send data out.
*This* is where software firewalls in Windows shine. So many programs in Windows phone home or access the Internet for completely unknown reasons. So, I block it. If it breaks and I really need that particular program, I can unblock it. It's hard to measure how much this really helps, and, of course, I'm sure there are ways to transmit in Windows without the firewall knowing about it. Still, it's nice to be able to say apps X and Y, you get to access the Net. Everybody else has to ask first.
Elrond, Duke of URL
"This is the most fun I've had without being drenched in the blood of my enemies!"-Sam&Max
Well I've almost never had issues with ZA over quite a few years. I'd rather have the malicious probes wasting my fast, underused network bandwith than have the hassle of setting up and maintaining yet another piece of equipment. (Especially anything to do with networks!)
Also, wouldn't it be a bit much to have 3 devices (cable modem, firewall, router) to run a network that has only 2 computers attached? Or even worse to landfill a perfectly adequate router to get one with a firewall that I clearly don't actually need?
It's bad if an *outbound* software firewall is your ONLY form of defence. But it is an INBOUND firewall too and it does a damn good job of that, considering. I've had people back in the dial-up / USB broadband modem days who used it exclusively as a defence and there were no problems at all. They frequently got attack probes aimed at them and they all bounced off harmlessly. For five minutes work and a free download, it's much better value for money than trying to put a hardware firewall into computer novice's homes, with their 56k's and Speedtouch's.
But its main use is to turn off things that ask for the Internet that cannot be otherwise turned off, and does so without requiring TCP port rules etc. It also alerts even the knowledgeable user to strange Internet requests ("Opera is acting as a server"... is it? Why? Oh, I've hit an IRC address and it's trying to act as an IDENT server). If I could afford it, I'd put it on every Windows PC in the schools I work in (if I could move them off Windows, I would do that too) - it has an especially nice, centrally-configured network version so you can stop ANY program on ANY client that does happen to get executed from accessing the network/Internet unless it's on your whitelist - perfect for stopping a virus outbreak in its tracks.
Most importantly, however, it's fantastic as a basic Windows firewall for places where YOU CAN'T GET HARDWARE FIREWALLS. Say you have a wireless laptop that connects through your home network (a not-unusual scenario). The laptop is protected against Internet-based attacks but not against local wireless-based ones. So you either have to 1) rely on your wireless to be perfectly secure for the course of its life (WEP should have taught you that that is a silly thing to do), 2) Provide a hardware firewall on the laptop itself (means carrying another gadget like that USB stick that is a Linux firewall), 3) Using a VPN (which means forcing its use for everything Windows tries to transmit) or 4) using a software firewall. Zonealarm happens to be great at 3 AND 4.
For example, I have the following setup:
Windows laptop with wireless
Wireless access point
PC in the house with wireless card and OpenVPN
Internal network
Broadband connection
Everything past the Windows laptop is Linux and locked down (and I have Linux on a laptop to that connects in the same way). In my case, I use Zonealarm on the Windows laptop to MAKE SURE that nothing gets out across the (secured with WPA2) wireless connection except OpenVPN packets. This FORCES Windows to use OpenVPN (which it likes to avoid whenever possible, i.e. I plug another Ethernet interface into it and it changes routes etc.) for everything. I have an "insecure" network running behind the LAN but the only transit across it is via a secured VPN.
Without Zonealarm, you get hundreds of DNS, Samba, etc. requests coming out of the laptop, flying across the wireless, affecting speed, bandwidth and (potentially) security of the network. With a decent software firewall on Windows (or a decent TCP outbound firewall on Linux), I'm able to make sure that NOTHING but OpenVPN can talk to the wireless network - I could even turn off the wireless points encryption (or it be compromised, or obsoleted, or removed for incompatibility/speed/bandwidth/latency reasons) and it wouldn't matter because nothing but OpenVPN can talk out.
Without ZoneAlarm, Windows is VERY chatty on any external network, plus it's difficult (but not impossible) to make it use only ONE route (your OpenVPN tunnel) out of many possible routes without something like ZoneAlarm, especially if things change often (e.g. you put a second wireless card in, or plug in an Ethernet card etc.). I also found that Windows Firewall was absolutely useless for this, and presented problems using OpenVPN in the particular mode I wanted it to (UDP I think, but it's been a while since I've had to touch any config files for that).
With Windows Firewall, OpenVPN connections died before they could complete
Hey Bill, why don't you STFU and concentrate on giving away your ill-gotten gains? kthxbye.
At the bottom of the
ZoneAlarm have released an update to fix this. Check out there technical support page http://www.zonealarm.com/store/content/support/techSupport.jsp
you are clearly forgetting that disassembled code is still code. you could just as easily find out what zonealarm screwed up, it just takes more time. what's the difference between open-source and closed-source? comments and clearly defined coding structures.
i wrote a 3d engine when i was 12. i wrote cryptic comments, had a bunch of variables named d0 d1 d2 etc, and had function names like TheHackFunction. my friend saw my engine and wanted to use it for his game, so i gave it to him in the spirit of open-source. it took him a day to trace down a bug. he told me about it and i knew exactly what the problem was and i fixed the same bug (and 2 others!) in 15 minutes.
with that said, am i the only one that always keeps a copy of softice nearby to patch pesky 'vulnerabilities' in proprietary applications?
softice + closed-source apps FTW
...but why should the average computer user be running a DNS server?
So... what does that make my router's firewall? It's exactly the same as the one on my PC, and I'm pretty sure that's software.
No it is definitely NOT the same as the one on your PC unless of course you happen to be running OpenBSD and ipf on your PC.
The main difference is that your router is a device solely designed for networking. There are no other hooks into the OS that can easily breach your security as exist on your computer, which is designed to perform many functions other than networking. The firewall on your router was designed to work specifically with the exact hardware in that box.
The firewall on your router also exists outside of your internal network and acts as a gatekeeper between the internal network and the outside world.
I'm a happy pessimist. I expect and prepare for the worst, when it doesn't happen I am pleasantly surprised.
I think that a big "thank you /." is in order.
My roommate is a "somewhat savvy" user who knows to use a properly set-up firewall and to scan every downloaded file manually. She can also fix most of her own computer issues thanks to google. And she has spent most of the day trying to connect to our wireless router.
After several hours of futility she asked for some help. ipconfig looked mostly normal but the subnet mask was off by 1 (e.g. 255.255.254.0 rather than 255.255.255.0) and wouldn't reset through any method I know of, ping pinged both locally and on teh webz, and tracert ... well tracerted. Thought about dns but it tracerted to "www.google.com" and the 72.14.what.ever also hopped to www.google.ca just fine and wouldn't resolve ANYTHING, even local files in Internet Explorer or Firefox.
This might have had me breaking out the disk and hitting the old "repair install" back to a known good configuration (yes, I know... 'windows' & "good configuration" have only RARELY coexisted but stranger things are possible) then HOURS of updates to duplicate and diagnose the problem. Looking foreward to a fix that doesn't hose the net!
So again thank you slashdot, all of you, for saving me hours of updating incrementally to find the culprit!
Ever notice that Cobra Commander sounds an awful lot like Star scream?