Personal Firewalls Mostly Useless, Says Mail & Guardian 303
hweimer writes "More and more security researchs come to the conclusion that personal firewalls are ineffective in controlling outbound traffic. An article in the Mail & Guardian online mentions a test that 'showed that the software often causes more problems than it solves. Not one of the six firewall programs the magazine tested, regardless of whether commercial or freeware, could prevent all attempts from the test programs at establishing outgoing connections between the PC and the internet.' Simple PoCs are available, too."
misleading headline (Score:5, Informative)
The article's about personal software firewalls, not personal hardware firewalls. Furthermore, the fact that personal software firewalls are useless and buggy is not really a new discovery. [google.com]
Re:misleading headline (Score:5, Insightful)
The firewalls are still very useful in preventing attacks due to OS vulnerabilities (like the Windows RPC issues). Anyway that is the main aim of personal firewalls, and the article does not have anything about the effectiveness of the firewall for inbound traffic.
If you want a secure outbound firewall the best bet is to use a dedicated gateway machine with the firewall (I use my very old laptop with BSD on it as a gateway)
Re:misleading headline (Score:5, Insightful)
Actually, you to end with forgot ", On Windows". As you probably already know, you can set a BSD system's "securelevel" such that firewall rules, both in kernel and on disk, can't be altered without a reboot. You could hypothetically write a program that patches a BSD machine's boot sequence with one that unprotects the firewall configuration, alters it, changes the backup file so that the user won't get an email notification later on that details the differences, then resumes normal operation - all while hoping that the user or administrator doesn't notice the spontaneous reboot - but there aren't too many of those running around today.
Re:misleading headline (Score:5, Informative)
For a few bucks, you could buy a small linksys dedicated box. That box - in addition of doing the job fine - pumps up less power than a laptop will ever do even in their lowest consumption settings. In a few month, the cost of the Linksys box will be recouped on the electric bill. And it is smaller and heats up less.
My view on the problem at least.
Re: (Score:3, Insightful)
The one major problem is that he'd no longer be running BSD. It's not trivial to migrate a working firewall config from one OS to the other, as I painfully re-learned when I replaced my FreeBSD host with a WRT54G. It's more or less equivalent featurewise, but the setup is completely different. I particularly missed the PF (BSD firewall) configuration, which is as close as such things can get to being considered beautiful.
Re: (Score:3, Insightful)
Re:IP Tables (Score:4, Informative)
Notes: I believe for stateful packet inspection, the kernel needs ip_conntrack and a few other things in it. Most distro kernels have this but it's worth double checking. From there, it's learning the IP tables syntax which isn't hard after going through one of the many examples out there. Once you get logging going, check out intrusion prevention systems!
http://www.google.com/search?hs=3PG&hl=en&lr=&cli
Re: (Score:3, Interesting)
openSuSE 10.1 actually makes it sickeningly easy to configure a firewall, subnet masquerading, DNS merging, and port forwarding. It took less than an two hours to get it all working (including dial-up and DHCP network alteration of the DNS forwarding.) IIRC it took almost two days to get it working with RedHat 5.2.
I realize it's not a fair comparison, as there is over 5 years of dev work in between the two, but the point is you don't need much knowledge, just a spare dual-nic box that'll run one of the
BSD firewall tutorial (was Re:misleading headline) (Score:5, Informative)
The response I get (yes, I'm the guy who wrote the tutorial) is that people find it quite useful.
The fact that it includes a few tips on how to give spammers a hard time helps too I guess.
Re:misleading headline (Score:4, Informative)
I'll offer a suggestion. Install FreeBSD on any old computer with two NICs. You'll find the installation as easy as any Linux system, the routine maintenance probably easier, and the documentation [freebsd.org] far superiour.
Sit down to read the pf FAQ [openbsd.org] on OpenBSD's site. It's well written and comprehensive so read from the first page to the last page. Make some coffee and then read it again.
# cd
# echo 'pf_enable="YES"' >>
# echo 'pf_rules="/etc/pf.conf"' >> etc/rc.conf
Edit
You'll find pf far less verbose than iptables, ipfw, etc., and easier to learn and to use for that reason among others. There's also lots of additional tools available for pf that will help as well.
$ cd
Google for all the rest.
A final comment. Using this approach gives you a secure firewall with all the unixy goodness you'd expect, not to mention logging, SSH, NTP synchronisation, etc that you may want to use as well. And earning the right to sneer at everyone using those plastic Linksys NAT boxes doesn't hurt.
Re: (Score:3, Insightful)
If you insist on having more storage to install programs, one can always use a network mount.
In any case, there's nothing to sneer at about these little devices.
Re: (Score:2, Informative)
Question (Score:4, Interesting)
Re:Question (Score:5, Informative)
Re:Question (Score:5, Interesting)
For a skilled user (which these aren't marketed to anyway), there is value in anlyzing what your software is trying to open outbound connections to, if you tell your PFW to alert you. In the hands of a skilled user, this is good information and the PFW is a good tool to analyze what software you may want to ditch or restrict. Again, this isn't the demographic most PFW vendors market to. You can't use a tool like this without a basic knowledge of how TCP/IP works. Then again, maybe that should be required knowledge for any user who connects their computer to the Internet. We need licenses to show we are competent enough to drive cars, and this is the "Information Superhighway" after all.
Re:Question (Score:4, Insightful)
Software firewalls 'solve' the same problem as antivirus software. They attempt to disallow stupid users from doing stupid things.
I disagree. Software firewalls on Windows attempt (and usually fail) to add granularity of control for end users.
For the most part, if people don't install unknown/untrusted software on their PCs, and use safer alternatives for online stuff (gaim, firefox, sylpheed vs. aol's own messenger, MSIE, Outlook) along with practicing safe online computing in general, personal firewalls add the same value as antivirus software. None.
This depends a whole lot upon your definition of "trusted." In any case, this is just another example of tools being designed without taking users into account. For most users the point of a computer is to run software they want. They don't know what software is secure and I'd argue no one does as everyone has to trust others. I don't know if Firefox has a backdoor that will be enabled next week. I haven't audited all the code. I doubt you have either. Whether it is Firefox, some shareware, an executable some friend sent via IM, of just something the user thought was data but the extension was hidden on, users who don't run untrusted data are missing a huge portion of the functionality they want from their computer. More important yet, they expect that functionality. It is not that they are stupid, they just have reasonable expectations that are not being met.
For example, most users never want any programs except their e-mail client to be able to read their e-mail address book. I mean what kind of stupid machine would let "nekkid_pics.jpg(.exe)" read my friends e-mail addresses and send a whole bunch of e-mail to them without asking me first? Who wants their computer to do that? And yet, almost all modern OS's just let any old program or program disguised as data to absolutely anything they want without asking the user or even informing them. That is what is stupid.
Then again, maybe that should be required knowledge for any user who connects their computer to the Internet. We need licenses to show we are competent enough to drive cars, and this is the "Information Superhighway" after all.
If I drive poorly, a bunch of kids could get run down and killed by a ton of metal. If I run random executables someone might get spam e-mail. Perhaps you see how the negative consequences of the former warrant licensing while the latter almost certainly does not?
The real problems are twofold. One, computers are very poorly designed and don't behave as users expect. Two, when computers don't meet people's fairly reasonable expectations and instead are hijacked by spammers, people like you blame the users instead of the crappy OS's. Fix the software first, then if the problem persists you can blame the users.
Re: (Score:3, Insightful)
Re:misleading headline (Score:5, Insightful)
1) Web browser and javascript bugs - nothing to do with hardware or software firewalls.
2) email issues, people going to bad sites etc. - nothing to do with hardware or software firewalls.
3) People should not run as administrator (or root) - wow, really.
4) People should stay up-to-date on patches - wow, totally amazingly obvious.
As you can't control people, they will always do these things. Good software firewalls show-up issues after they have made these mistakes, when rogue software tries to get out.
They also failed (or I missed it) to mention that software firewalls are good when you have multiple computers behind a hardware firewall - basically and infected computer will be blocked infecting other computers e.g. netbios etc.
Good computer security is a layered concept. From incoming hardware firewalls, IDS, software firewalls on individual computers, user training, security audits etc. I wish people and organizations writing articles would finally learn this. There is no 'magic' one solution.
Re:misleading headline (Score:5, Insightful)
Re: (Score:3, Interesting)
Now, I didn't RTFA, but it seems the whole point it is trying to make is that software firewalls AREN'T doing just that.
.Re: (Score:3, Insightful)
[OT] Re:Link to "printable" version of stories! (Score:5, Interesting)
Told you so (Score:4, Interesting)
Re:Told you so (Score:4, Insightful)
Blocking outbound connections silly (Score:2)
Blocking outbound connection from a computer is pretty silly initiative in any case. Firewalls are for blocking inbound connections and for enforcing policies between networks (e.g, between the home network and the internet). Only in the latter case does blocking outbound traffic matter, and only as a last ditch "woops, I forgot to restrict this service so now I'm broadcasting sensitive information to the world!" sort of thing. It certainly doesn't hinder worms and their ilk much. And don't get me started o
Re: (Score:2, Informative)
Blocking outbound traffic has been very useful for spanking people who think running Kazaa/eMule/BitTorrent/etc. at work is a good idea. Or for blocking access to outgoing SMTP so users have to use the corporate mail box, etc..
Re: (Score:3, Insightful)
Re: (Score:2)
For stopping, sure. But for the initial wave, wouldn't a DDOS just use a commmon, open port like 80 or 443? Here I am assuming a external firewall, as a software firewall on the rooted (!) box itself is presumably disabled.
Re: (Score:2)
Firstly, that is negotiating traffic between networks (here, the office LAN and it's internet connection. I'd be a bit surprised if it works, but maybe it takes out some of the more stupid employees. For my money, just saying "please don't do that" seems to be a better idea in this
Re: (Score:2)
Besides the good old network-2-network firewalls, there are the "Personal" firewalls regulate which application are allowed to connect. Those are what the article are talking about. If you do not agree with the terminology, I can understand, but I think that rabbit is rather out of the box.
And using proxies is just about the only way if you want to only have one type of traffic, provided that the inside people have no conspirators (including themselves) outside the firewall. If they do, you have lost whate
Re: (Score:2)
Mac OSX has an interesting feature that should at least alert a user that something fishy is happening. Any executable trying to run the very first time, triggers a dialog that asks the user if that should be allowed. It adds the warning that the program could be malicious. Then the smart users may cancel the starting of that program.
Re: (Score:2)
What's trying to get out is usualy more important to me than what's trying to get in because it gives clues as to what has gotten in and what's not programs aren't behaving like they work for me instead of somebody else.
"Why home firewall software is a leaky dyke" (Score:4, Funny)
Re: (Score:3, Funny)
Re: (Score:2)
can she cast magic missile?
Re: (Score:3, Funny)
Not really. That's where the gay nerd comes into play, hehe ;-)
Outbound Traffic? (Score:5, Insightful)
Without a personal firewall, users have a huge issue with inbound traffic when it comes to security, especially in the Windows "territories." I'll never forget the day that I left open an unpatched WinXP box after a fresh install. I watched all of the script kiddies and automated worms go at it from my passive OpenBSD monitoring box. That machine was hacked in under ten minutes just because I left it there, open to the Internet. So, useless? No.
Re: (Score:2, Informative)
You could have put that OpenBSD box inline as a firewall (pf is cool) and still done monitoring. Then your XP box would have been safe.
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:2)
Inbound traffic can be filtered using the OS-supplied firewall (yes, even under Windows). No need to buy questionable TCP/IP stack replacements.
Re: (Score:2)
Inbound traffic can be filtered using the OS-supplied firewall (yes, even under Windows).
Most personal firewall products predate the awe-inspiring wonderfullness which is the Windows Firewall. And architecturally, 3rd party software firewalls are comparable to the "integrated" Windows one. (What, you think maybe Microsoft is giving their own firewall developers better hooks into the OS than 3rd-party developers have? While MS has that history, I think they're being too closely watched after numerous high-
Re: (Score:2)
It lasted a whole 10 minutes? (Score:3, Interesting)
Basically the story is that I had managed to fry my home machine, didn't have a second computer at the time, but hey, looks like I got enough older parts for one (or a couple of them.) Stupidly enough, the firewall program (Sygate was my favourite at the time) was among the few things I had never backed up, but otherwise I could have a computer to play with in an hour or so.
Now I co
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
Why?
Yeah, it'd be nice to stop the stupid user stuff with outbound attacks and such... but most of that threat is better mitigated through the use of malcode-analyzing proxies and other filtering systems (we quarantine email attachments, haven't had a 0-day in years, use centralized ad and malcode blocking for web browsers, etc).
The REAL threat that we could actually get benefit from using PFW softwa
If it's in it's already too late (Score:5, Insightful)
Not one of the six firewall programs the magazine tested, regardless of whether commercial or freeware, could prevent all attempts from the test programs at establishing outgoing connections between the PC and the internet.
First, nothing is perfect. Second, if some nasty program/spyware/adware got in, then it's too late already. The best thing is to prevent them getting in to begin with. Besides, most people don't know the difference between what should and should not be allowed to have access. I do some tech support for friends and family and it really gets annoying after the fifteenth call, "Should I let FooBar21.exe access to the Internet?" I finally went with the policy of disabling any sort of outbound filtering in whatever firewall I setup for people I will be "supporting."
Re:If it's in it's already too late (Score:4, Informative)
Sure it takes more time, but the only real reason I even use a firewall is to keep winamp and media player from phoning home.
Re: (Score:2)
Annoyance (Score:4, Interesting)
Re: (Score:2)
I find it very interesting when I install some software and
my ZoneAlarm pops a window showing me it's trying to phone home.
(Adobe is the worst when it comes to this.)
Windows should be have a built-in white-list for outgoing network connections,
including a help link to a web page (or a wiki) showing what propram is sending what to where and why!
Re: (Score:2)
Re: (Score:2)
Yes, and I took the time to train/configure the firewall. Now it will warn me about a new app trying to make connections for the first time, but that's a rare enough occurence that it's no problem at all (and is of course entirely expected).
Users are clueless about it
Yes, most users are - but they generally don't care about outbou
Simple (Score:5, Insightful)
Not running Windows, but instead running either a proprietary platform or (preferred) something unix-based. The simplest is a simple one-way NAT (outbound connections allowed, inbound connections impossible without a specific, intentional mapping). These of course only protect against active outside attacks, and not against trojan/virus emails or websites visited from the PC. The most effective method of avoiding those is to avoid use of and remove (to the extent possible) all Microsoft email clients and web browsers from the PC.
Re: (Score:2)
Re: (Score:2)
*BZZZZZZT* wrong.
i CHOOSE to use windows. 90% of what i do on a daily basis could be done in either. with a decent amount of extra effort, i could probably get that last 10% working under linux. but in my opinion, linux just isn't there yet. xp, warts and all, allows me to be more productive. yes, i have a linux partition on my laptop (that doesn't get much use). and i have linu
Re: (Score:2)
Re: (Score:2)
The funny thing is that just this last weekend, a friend of mine discovered that his home Linux server had been hacked. Someone managed to break in remotely and get root.
So while using something other than Windows makes you safer, it most definitely does not make you invulnerable.
Oh, and less of the "drivelling masses", thanks - some of us choose to use Windows for
A firewall is a *device* (Score:5, Insightful)
Besides that, the most useful purpose of these things isn't against trojans that someone's running because they're an idiot, it's software such as media players insisting on phoning home (for example, the "Microsoft Windows Media Configuration Utility" connection attempt that occurs when WM9 tries to update itself).
Re: (Score:2)
What do you think a unix-based (or for that matter proprietary) firewall is based on - software.
If you mean "Running a firewall on the system you're supposed to be protecting" is a bad idea, I'd generally agree. But if you're most concerned about blocking incoming connections, that's less of an issue.
Ideally you'd never get any malicious (sp?) software on
ZoneAlarm? (Score:5, Informative)
Re: (Score:2)
ZoneAlarm + broadband router = happiness (Score:5, Insightful)
For example, every time I play a media file in Windows Media Player, it tries to connect to the Internet not once but twice - once when Media Player fires up and once again after it's fnished! Excuse me? Exactly what is Media Player trying to figure out? Well, whatever it is, it's none of their damned business. Check "Remember this setting", click "Deny", and done.
Every time a process tries to act like a server, ZA also notifies me of that as well. It's a bit of a pain when I fire up a game server for the first time and the pop-up balloon interferes with the screen (whoops), but again it just shows that it's at least doing what it's supposed to do.
ZoneAlarm has its share of issues, but it clearly goes with the attitude of "better safe than sorry". There have been some rare times where the program itself doesn't start, for whatever reason, but its service gets started. On those rare occasions I've noticed that the service, if it can't communicate with the control daemon, or whatever you want to call it, it just blocks all network access. It could have just allowed everything instead and there'd be no way of knowing if it's working or not. Personally, I'd rather have it block all access. Not only does that let me know that there's a problem, but it's certainly keeping the PC's network connection secure.
Using a hardware firewall for inbound and ZA for outbound connections makes perfect sense as far as I'm concerned. It's not trouble-free, but they've been getting better at its stability over the past several revisions from what I can tell.
Re: (Score:2)
Media player is probably either doing some sort of licence check or an ID3 tag look up (or both).
Re: (Score:2)
Depending on your settings, it's probably opening a connection to the server to retrieve media info from (on startup) and reporting anonymous* usage data (on shut down). Both of these things can be switched off in the options settings. I don't guarantee that
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Personally, I think their tests are sort of flawed for showing holes in the firewall itself. I've used ZoneAlarm for a while and think it does a great job.
Which software? (Score:3, Interesting)
Re:Which software? (Score:5, Informative)
_Kaspersky Internet Security 6
_Trend Micro PC-Cillin 14 Internet Security
_Symantec Norton Internet Security 2006
_Zonelabs Zonealarm Internet Security 2006
_McAfee Internet Security Suite 2006
_Computer Associates eTrust Internet Security Suite r2
_Panda Platinum Internet Security 2006
_Softwin Bitdefender 9 Internet Security
This is all I could find from the german site PC Progressionell
Purpose of a personal firewall (Score:5, Insightful)
I recommend that people use both a hardware and software firewall, the hardware firewall protects you from the Internet in general. The software firewall protects you from the other computers on your local network.
But when it comes down to it, a firewall is as strong as it's weakest link, which is almost always the enduser. Running as admin while browsing, downloading software from untrusted sources, don't blame the firewall for user stupidity.
So sorry (Score:2)
Yeah, what a drag that their software is not completely immaculate. Let us know when you code the world's first perfect application, sparky.
And how exactly does "not perfect" translate to "useless" again?
They just didn't have enough firewall. (Score:5, Funny)
Re: (Score:2)
Little Snitch (Score:2, Informative)
But I would swear by a nifty little app (for mac), Little Snitch [obdev.at] which does seem to block both outgoing and incoming traffic perfectly.
Little Snitch for Mac OS X (Score:4, Informative)
Bad article, no donut (Score:4, Informative)
The article expounds on the dangers of Javascript, but fails to mention ActiveX. I suspect the author had heard about "scripting" being a security hole and assumed incorrectly that the other person was talking about Javascript. JS is inconsequential compared to ActiveX when it comes to actual risk.
Additionally, when it claims that AV software essentially supersedes any firewall in terms of protection, it fails to consider the security nightmares in Windows. Specifically, through the trust relationships, you can modify registry settings and execute code on computers without your viral code ever touching the disk on the machine by doing it remotely from another computer. Because memory scanning is essentially ineffective, modern AV programs cannot effectively protect against this, which is why most security companies suggest combining AV with a Firewall. Plus, there are regular buffer overflow exploits that have the same effect: Code running without touching the disk. Where do they come from? Over the wire. Code Red and Nimda are good examples of attacks that were stopped by even the most basic firewalls. Safe browsing had no effect whatsoever on whether a user was infected.
Finally, the article fails to take into consideration the thought that goes into the automatic rule creation most firewalls come with now. Developers understand that users demand convenience and security, and work to find a good match of both. To this effect, most modern desktop firewalls will use signature based rules (so that a malicious program has to do more than just be named after a trusted program) to create a basic rule that allows that program outbound access. The ports are not being just "left open" willy nilly, they are connected to known programs and watched. Some firewall programs even watch for threadjacking malware that would inject itself directly into trusted programs, that gives even more protection.
The author of the article should reevaluate his or her knowledge of internet security. It is likely that the increasing ease of use has been interpreted as a drop in protection, but this is not the case. A secure system is one that uses a heterogeneous mix of disk and network protection.
Result of Fundamental Flaw (Score:3, Insightful)
I don't mean everyone should study the TCP/IP stack and fully grasp ports and such, but seriously....you can't just show someone what a car does & explain the controls and then expect them to be able to drive properly & safely. It takes training & study.
The same is true with computers. I'm not suggesting an 'internet license' or anything, but I would recommend that high school core classes at least provide the basics of the underlying fundamentals of computing. Until someone understands what those firewalls are for, they will never reach a truly useful state.
Brad
Which Six? (Score:4, Informative)
No kidding... I've found them useless in practice (Score:4, Informative)
The problem is that this trains users to ignore the prompts and habitually click "allow" or "deny" (usually because they find out the hard way that stuff breaks when they click "deny"). The result is far worse than if there were no attempts to control outbound access, because most of these firewalls (Zonealarm in particular) use similar techniques for *inbound* traffic too... they will prompt the user when a program opens a listening port, and if they hit "allow" will enable global inbound traffic to that port, creating a hole that otherwise wouldn't have been there.
This happens regularly in practice- I've seen it over and over again with my small business consulting clients. Although technically an outbound software firewall with program control could be a good last-ditch effort to block malware that has managed to get installed and running, on a practical basis they cause more problems than they solve.
-R
Duh (Score:2)
Once malware is running on your PC you should assume it can do ANYTHING it wants, including disabing firewalls/antivirus, etc.
Heck, Windows Firewall has an API to allow programs to add themselves as exceptions (probably because if it didn't programmers would just use 100 different non-forward compatible methods to do it).
How about configuring the software first? (Score:3, Insightful)
This means press install, press next, next, next,next, OK and done I have my own personal protection!
If you take the time to tune the software firewall, i'm pretty sure you would have much better results.
And spam filters are not 100% effective... (Score:2)
That said, many of the software personal firewalls ARE actually quite good. The people using them just need to understand the potential ramifications. Education of basic Internet security combined with good Web browsing and file handling practices can go a whole lot farthe
Virtual firewalls on virtual machines (Score:2, Informative)
If I want to block all outbound traffic (Score:2)
Winpooch (Score:4, Informative)
It's not gonna save me from a worm itself, but it will tell me when I have a worm or rootkit making outbound connections.
And it allows me to use ClamWin to do on access scanning, tells me whenever an application tries to change the registry or system files, and provides a simple method to determine most of the potentially damaging processes running on my machine.
Best of all it's opensource.
Marketing (Score:2)
I use a personal software firewall on all my Windows machines for two reasons: one, to prevent worms and such from getting a foothold on my machine, and two, to prevent phoning home of "non-malicious" software that has no real reason to be connecting out. I've run a bunch of programs over the years that attempt to connect to some remote machine for some unknown pu
Personal firewalls quite useful (Score:3, Interesting)
So says an article linked by an article linked by an article that I can't really read. Pardon me if I am not convinced.
I'm quite content with the personal firewall I have. It stops lots of outbound connections from applications that like to phone home. If there is an app on my system that searches for IE windows and uses them to surrepticiously send data out -- I'm already f*d. Fortunately, my firewall blocks IE so I'm not vulnerable to that one. (It could use Firefox though).
All of them? (Score:2)
Biggest problem with personal firewalls (Score:4, Interesting)
Better than nothing (Score:4, Insightful)
My view has always been using a combination of things that help is th ebest idea. Using a router that has a hardware firewall + a software firewall + antivirue + a secure browser(firefox) is a decent way to keep safe. This won't stop everything, but it's better than surfing around with no protection. Also add not doing stupid things to that equation for maximum protection.
Trivial to Bypass (Score:4, Interesting)
Even without the user running as admin, it's fairly easy to create a program to bypass outgoing firewalls. Basically the trick is it piggypack your communications over an existing application that's trusted.
Nearly everybody is going to trust IE (or Firefox, or whatever browser) to access the network. All you have to do is figure out a way to use that program to do your communications for you.
I once wrote a proof of concept app (in VB no less!) that used IE to do exactly this. I setup a simple piece of server software that accepted requests via HTTP GETs and returned the response as base64 encoded text in an HTML body. When my app needed to access remote data I just used IE to request that data from the server and then base64 decoded it. I could have also done something like have the server software act as a proxy so I could request any remote data I wanted, even if it wasn't hosted by my server. It was trivial.
The best part was that *every* major outgoing firewall failed to detect this attempt, despite that fact they claim to be able to tell when one application is using another to piggyback communications. Perhaps it was the way the COM interface worked, I'm not sure... but it never failed and never prompted me to allow it to happen.
ISP's hate firewalls (Score:4, Interesting)
Incomplete is not always "useless" (Score:3, Insightful)
Mass-produced malware is usually not built for pride of workmanship. It is commercial software built to make money and is not a fraction better than it needs to be.
The right question to ask about effectiveness is what fraction of the spyware in circulation will be controlled by Zone Alarm and its kin. We accept a detection rate of 50-80% from antispyware programs. The threshold for a program like Zone Alarm should be higher because it has to be worth the hassles it causes, of course.
Those hassles are probably inevitable. If you try to control outgoing traffic you are trying to add a feature that should have been in the OS, namely a new permissions system. Turf wars with the OS and destabilization due to hooking deep APIs are certain to happen. Historically if you attempted to touch the Windows network stack (PGPNet, for example, and the Freedom software forced me into a wipe and reinstall) you broke it.
Outbound traffic controls are harder to subvert but less effective if you do them outside the client machine. How can a separate firewall box know whether a port is being opened by BitTorrent or by CoolWebSearch?
Idiotic article. Blame your tools. (Score:3, Insightful)
Yes, software firewalls have their problems. Yes, they do require some knowledge to use correctly (as does almost all software!)
Personally I use a hardware firewall for incoming, a software firewall for inbound, I do run as admin because Windows just isn't designed to be run well from an unprivlleged account. I use antivirus too though I do switch it off if my computer's going to be doing something CPU or disk intensive AND I'm not doing anything I consider risky.
Furthermore you can't test 6 bits of firewall software and extrapolate that they're all garbage from the sample.
Re: (Score:3, Interesting)
Re: (Score:2)
Sure - just run this little, umm, 'booster' script:
-- /dev/null > /etc/ipf.conf /etc/ipf.conf
!#/bin/sh
cat
ipf -Fa -f
wall "pwn3d!"
--
(...point is, if something bad is already in there, and it has the right perms, no firewall is going to save you. None.)
Re:misleading headline (Score:5, Interesting)
It also makes dynamic loading and unloading of device drivers impossible, which is why it doesn't make any sense for desktop system. Security can only be achieved through properly granting permission, not through outright avoiding granting permission. A scheme that is too restrictive will simply get turned off or worked around by the end users, and thus is not particularly useful, and indeed may actually be harmful to security because of developers making security assumptions that are no longer valid in such a situation.
Want to really improve security? Create multiple separate privilege sets in the kernel instead of a single "root". Make different executables setuid to a user with privilege sets that allow certain operations. Your kernel extension loader has sufficient privileges to load a kernel extension, but still can't write directly to kernel memory or listen on low numbered ports or access raw devices or bypass filesystem permissions. Your software that requires the ability to listen on low numbered ports doesn't get permission to bypass filesystem permissions or load kernel extensions. And so on.
Don't get me wrong, it's perfectly okay to have a "root" user, but no executable should ever be setuid root in such a scheme, and that root user should only be used for very limited administrative tasks.