Do not use free firewalls !

Johnny · 2006-06-19T14:45:42+00:00

´ve decided to uninstall zonealarm, and start using windows xp´s own firewall. There´s too much danger with other firewalls, and the commercial ones are 99%crap, and expensive. Firewalls - The Dark Side:Here's the catch that most free firewall vendors don't tell you about. Their software will prompt you when it detects an outbound connection (outbound connections happen regularly). Here's an example:Notice: svchost.exe is attempting to communicate with the internet. Should this be permitted? [Yes] [No]The majority of computer users have no idea if they should allow this or not. At first, the average user will choose [no] only to discover that they can no longer visit internet sites or have prevented needed communication.Want to guess what they'll choose next time they are prompted - [yes]. Chances are that one of the times, it will be spy ware trying to communicate and because they choose [yes], they set a rule that allows the wrong program to access the internet..

P

prophet 20 years ago

Thanks, I'll do that.

Normally I do, but not every program is as user-friendly. Take installers for example. All you see is a dialog with a progress bar, and somewhere during installation it wants to contact some server. And I'm talking legitimate installers here, not malware. For example installers for games or utilities. Even driver setups do it. Maybe it just wants to check for updates or something, but the point is that it's doing it without my consent. And if I didn't have a firewall running it would be doing it without my knowledge as well.

Point taken.

---- 8< ----

Well, consider me educated. You're right, control is a myth.

You'd rather I hooked my machine up to the net without any protection at all? :-)

Anytime an executable starts (either by a user, schedule or invoked by another process), there's a risk. I understand that. Even when my system is "protected" by firewall, AV and HIPS software.

Vote

S

Sebastian Gottschalk 20 years ago

Never seen that. WTF are you installing?

Argh. You don't need any packet filter for finding that out at all. And especially it's no reason to mess up your computer's security with a broken one.

Same as I do? Just shut down all unnecessary services and keep your system patched. And don't any totally broken software. The point is that there's no need for so-called protection if there's nothing broken to protect.

Vote

P

prophet 20 years ago

Well, anything using Windows Installer (msiexec.exe) for starters. At one point I found it annoying enough to make a rule specifically blocking that program from accessing the internet. I update my ATI drivers regularly, and each and every time the setup wanted to contact some server (can't remember which one, I blocked it a long time ago). Maybe they're simply keeping track of the number of people using the latest drivers, maybe they're using the information for advertising purposes. Who knows? It certainly isn't needed for a successful installation.

Another example is the setup.exe for MusicMatch, a program I need to upload music to my MP3-player (simply copying tracks doesn't work since it uses an internal database, without the correct entries MM puts in there the MP3-player won't play the tracks). There's nothing wrong with the program itself though, it has an automatic update feature but that can be disabled (which it is).

What would you recommend I use instead? Honestly?

You have a point there. A service/program can't be exploited when it's not running (or installed). Which leaves the matter of finding out what software is safe to use. I can live with that. But that makes me all the more curious as to what you recommend I should be using to monitor my system to make sure nothing bad happens, instead of using a PFW.

Can't argue with that. Very true.

Vote

S

Sebastian Gottschalk 20 years ago

Oh, well, those usually don't work for me because a lot of developers seem to forget setting RequiresAdministratorPrivileges=0. Usually msi2xml does the job as well.

Get a grip at group policies where you can explicitly disable automatic update checks on MSI installer.

Needing a program to put files on a MP3 player certainly is very wrong.

netstat? What about graphical versions like TcpView? Or with extensive logging capabilities like portqry?

Number one place should be the system log. :-) Especially with reasonable auditing settings (f.e. failures on privilege usage).

And not to mention task manager (or, for better comprehension, Process Explorer). You'll learn pretty soon which processes you're commonly running.

Vote

P

prophet 20 years ago

Thanks, I'll look into that.

Yeah, I know. I mainly use it as a portable harddisk these days.

Didn't know about portqry. I googled for it and found it on the MS kb. Looks rather handy :-)

That's sound advice, I admit. I think I'm going to dig deeper into it. It's another frame of mind really. Keep an eye on the software you use and configure your system properly instead of relying on some piece of software to handle it for you. Software that can be easily influenced (or even disabled) by malicious programs (which you should avoid running in the first place).

For what it's worth, I'd like to thank you for clearing things up for me. I obviously had a lot of misconceptions about -real- security :-)

Vote

V

Volker Birk 20 years ago

Isn't the user the person who should be protected and not protect?

Yours, VB.

Vote

V

Volker Birk 20 years ago

Sygate was no problem at all to circumvent, as the rest of those "Personal Firewalls". It took me some minutes to hack PoC code.

Yours, VB.

Vote

J

Johnny 20 years ago

Precisely, you HAVE to give it access, and who knows what it will do besides allowing you to browse the internet.

"Sebastian Gottschalk" kirjoitti viestissä: snipped-for-privacy@news.dfncis.de...

Vote

S

Sebastian Gottschalk 20 years ago

Well, normally it will only include its associated services network functionality. But in presence of malware, it will have some more services attached.

Vote