Personal Firewalls

There's quite an interesting thread in the groups at GRC relating to the ability of certain malware to "kill" any running PF. Here's a copy of a post by Kevin McAleavey (one of the developers of BOClean):-

The full thread can be found in the grc.secuirty.softare group (article ID 3CB348C3.7EC44E73@cybrsolutions.com).

The above, when coupled with the results of the results of the "Firewalls -v- Leak Tests" study at PCFlank, rather makes you wonder as to whether there is a great deal of benefit to be had from a PF.

Was Steve Atkins right all along?

 

This is another excellent example of why relying on a firewall or IDS to compensate for user incaution is inviting grief.

The cold fact of computer security life is this: the overwhelming majority of cases of malware on a computer are the result of incaution, or unfamiliarity with the dangers, when opening email or newsgroup attachments; files received via ICQ, KaZaa and other file-sharing apps; pirated programs downloaded from "warez" sites or obtained on floppies or CDs; etcetera, etcetera.

Viruses don't miraculously appear on a computer. They must be installed there, and in 99.999% of the cases it's done by the user through ignorance of or indifference to basic security precautions.
[hr][/hr]
Re the "leak test " programs, here are the results based on my installation this evening of BlackICE PC Protection, version 3.5.cbq, a major upgrade over BI Defender.

The new BI has an "application protection" function that instantly flags any program on the machine that wants to launch or to connect to a network, but is not on its approved list. Because of that:


Outbound: it wouldn't run because the system has no PACKET.DLL file, and the source the OB website recommended wasn't responding.

GRC's Leaktest: BI PCP caught it.

Firehole: BI PCP caught it.

TooLeaky: BI PCP caught it.

Yalta: BI PCP never let it get to the classic/advanced screen.

All of these resulted in an "unknown application" alert. In order to let them actually try to get to the net, I'd first have to give them permission to run at all. And, protecting one's computer is predicated on being told when an unknown application is attempting to run, let alone get out and phone home.

Out of curiosity, I did approve FireHole. As soon as I clicked Start, the old reliable 95-era Cybermedia Guard Dog flagged it and said it was trying to launch Opera.

To my mind, the new power of BI is going to make it a lot harder for malware to escape detection.

 

BI PCP sounds to be quite interesting; it's quite a few years since I last dabbled with BID and, at that time, was not overly impressed with the product. Time maybe to take another look.