Ant
Sat Jul 12 08:22:54 PDT 2008
> On Fri, 11 Jul 2008 20:15:32 -0700, Phillip Pi wrote:
>
>> I like to block network programs that should be contact home or whatever.
>>
>>
>> On 7/11/2008 2:17 PM PT, Tom [Pepper] Willett wrote:
>>
>>> How do output blockages help you?
>
> Phillip Pi,
> please don't take this personally but it seems your understanding in
> relation to 3rd party (so-called) firewalls is very limited, to say the
> least.
>
> Your *best* option is to uninstall Kerio and activate the build-in f/w
> application of WinXP!
> For the average homeuser, the Windows Firewall in XP does a fantastic job
> at its core mission and is really all you need if you have an 'real-time'
> anti-virus program, [another firewall on your router or] other edge
> protection like SeconfigXP* and practise Safe-Hex**.
> The windows firewall deals with inbound protection and therefore does not
> give you a false sense of security. Best of all, it doesn't implement lots
> of nonsense like pretending that outbound traffic needs to be monitored.
>
> Activate and utilize the Win XP built-in Firewall; Uncheck *all* Programs
> and Services under the Exception tab.
> Read through:
>
> Understanding Windows Firewall.
>
http://www.microsoft.com/windowsxp/using/security/internet/sp2_wfintro.mspx
>
> Using Windows Firewall.
>
http://www.microsoft.com/windowsxp/using/networking/security/winfirewall.mspx
>
> PFW Criticism.
>
http://en.wikipedia.org/wiki/Personal_firewall#Criticisms
>
> At Least This Snake Oil Is Free.
>
http://msinfluentials.com/blogs/jesper/archive/2007/07/19/at-least-this-snake-oil-is-free.aspx
>
> Deconstructing Common Security Myths.
>
http://www.microsoft.com/technet/technetmag/issues/2006/05/SecurityMyths/default.aspx
> Scroll down to:
> "Myth: Host-Based Firewalls Must Filter Outbound Traffic to be Safe."
>
> Exploring the windows Firewall.
>
http://www.microsoft.com/technet/technetmag/issues/2007/06/VistaFirewall/default.aspx
> "Outbound protection is security theater?it?s a gimmick that only gives the
> impression of improving your security without doing anything that actually
> does improve your security."
>
> *In conjunction with WinXP SP2 Firewall use:
> Seconfig XP 1.0
>
http://seconfig.sytes.net/
> OR
> Configuring NT-services much more secure.
>
http://www.ntsvcfg.de/ntsvcfg_eng.html
>
> **Routinely practice Safe-Hex.
>
http://www.claymania.com/safe-hex.html
> Hundreds Click on 'Click Here to Get Infected' Ad
>
http://www.eweek.com/article2/0,1895,2132447,00.asp
>
> And, in future be more critical when reading advertisement driven
> publications (don't get blinded by all that hype)!
>
> Go to...
>
http://www.sunbelt-software.com/Home-Home-Office/Sunbelt-Personal-Firewall/
>
> ...and follow all the hype created by Sunbelt's *Marketing Department*.
>
> [quote]
> Still use the free Windows XP firewall?
> Unfortunately, this gives you a false sense of security. It only protects
> incoming traffic. But outgoing traffic, with your credit card info, social
> security number, bank accounts, passwords and other confidential
> information is not protected. The WinXP firewall will let it all go out.
> But... SPF will block that data if you buy the FULL version! You absolutely
> need a better, commercial-grade firewall.
> [/quote]
>
> Then read in...
> Windows Personal Firewall Analysis
>
>
http://www.matousec.com/projects/windows-personal-firewall-analysis/leak-tests-results.php#firewalls-ratings
>
> ...a more realistic view which obviously was drafted by the head of
> Sunbelt's *Operations Department*.
>
> Sunbelt Software - the vendor of Sunbelt Kerio Personal Firewall
>
> 2007-08-07: Here is the response we have received from this vendor:
>
> [quote]
> Sunbelt Software is committed to providing the strongest possible security
> products to its customers, and we will be working to correct demonstrable
> issues in the Sunbelt Personal Firewall. Users can expect these and other
> continuing enhancements for the Sunbelt Personal Firewall in the near
> future.
>
> However, we have some reservations about personal firewall "leak testing"
> in general. While we appreciate and support the unique value of independent
> security testing, we are admittedly skeptical as to just how meaningful
> these leak tests really are, especially as they reflect real-world
> environments.
>
> The key assumption of "leak testing" -- namely, that it is somehow useful
> to measure the outbound protection provided by personal firewalls in cases
> where malware has already executed on the test box -- strikes us as a
> questionable basis on which to build a security assessment. Today's malware
> is so malicious and cleverly designed that it is often safest to regard PCs
> as so thoroughly compromised that nothing on the box can be trusted once
> the malware executes. In short, "leak testing" starts after the game is
> already lost, as the malware has already gotten past the inbound firewall
> protection.
>
> Moreover, "leak testing" is predicated on the further assumption that
> personal firewalls should warn users about outbound connections even when
> the involved code components are not demonstrably malicious or suspicious
> (as is the case with the simulator programs used for "leak testing"). In
> fact, this kind of program design risks pop-up fatigue in users,
> effectively lowering the overall security of the system -- the reason
> developers are increasingly shunning this design for security applications.
>
> Finally, leak testing typically relies on simulator programs, the use of
> which is widely discredited among respected anti-malware researchers -- and
> for good reason. Simulators simply cannot approximate the actual behavior
> of real malware in real world conditions. Furthermore, when simulators are
> used for anti-malware testing, the testing process is almost unavoidably
> tailored to fit the limitations of simulator instead of the complexity of
> real world conditions. What gets lost is a sense for how the tested
> products actually perform against live, kicking malware that exhibits
> behavior too complex to be captured in narrowly designed simulators.
> [/quote]
>
> This is pretty eye-opening as well:
>
> Firewall LeakTesting.
> Excerpts:
> Leo Laporte: "So the leaktest is kind of pointless."
> Steve Gibson: "Well,yes,...
> Leo: "So are you saying that there's no point in doing a leaktest anymore?"
> Steve: "Well, it's why I have not taken the trouble to update mine, because
> you..."
> Leo: "You can't test enough".
> Steve: "Well, yeah.
> Leo: "Right. Very interesting stuff. I guess that - my sense is, if you
> can't test for leaks, a software-based firewall is kind of essentially
> worthless."
Huh? I don't want some of my programs to phone home like screen savers,
SopCast's ads program (sopadver.exe), PowerDVD7, TSReader, dxdiag.exe,
etc. All the listed are phoning to somewhere (e.g., home) and it is not
needed IMO. I only needed a simple firewall to manage incoming and
outgoing (big deal for me).
--
"I am afraid that I am convinced that a community of human beings is a
far more useful thing than a community of ants, and that if the human
being is condemned and restricted to perform the same functions over and
over again, he will not even be a good ant, not to mention a good human
being." --Norbert Wiener
/\___/\
/ /\ /\ \ Phil/Ant @
http://antfarm.home.dhs.org (Personal Web Site)
| |o o| | Ant's Quality Foraged Links (AQFL):
http://aqfl.net
\ _ / Remove ANT from e-mail address: philpi@earthlink.netANT
( ) or ANTant@zimage.com
Ant is/was listening to a song on his home computer: Nirodha - Shine
like the sun (ID: 55164)