Personal Firewall?

[Craig]

hummingbird skrev:



So what? Having this feature in a personal firewall is nonsense IMNSFHO.

For a layperson such as myself, having a tool monitor /outgoing/
connections is another way of familiarizing myself with regular traffic
and spotting anomalies. Nonsense? Perhaps for the packet-sniffing
cognoscenti...

If you want to block outgoing traffic...

It's possible that you're either mis-reading or mis-interpreting.
"..(M)onitor outgoing connections..." does not mean "...block outgoing
traffic."

Having such a tool at one's disposal is hardly, as you put it in your
NSFHO, "nonsense."

-Craig

 

[JP Loken]

Now that sygate was bought out and they are scrapping it, what other
options are there Freeware/Open-Source wise?

Sunbelt Kerio Personal Firewall 4.2.3.912 (Freeware/Shareware in one)
http://www.sunbelt-software.com/Kerio.cfm
Comodo Personal Firewall (FREE for 365 days)
http://www.personalfirewall.comodo.com/
CORE Force
http://force.coresecurity.com/
Zone Alarm Free
http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp

And I liked Sygate too, darn always the good ones that die young.

(e-mail address removed) (pull the .xxx to email me)

There are many others.

I'm just now trying out R-Firewall.
Looked promising, but has some peculiarities. One example: My main
browser(K-Meleon), was involuntarily blocked. Firefox and IE, on the other
hand, has been allowed all the time.
For a while I was also getting a lot of warnings about non-existent
changes of some of my applications.

 

[george1234]

Sygate is still availble on Simtel. I see no reason to drop it.

I'm with you.I've been running sygate for over a year now, and it is
easy and good.The thing it does best is capture requests to connect
exterior sites

 

[David]

[...]

There are many others.

I'm just now trying out R-Firewall.
Looked promising, but has some peculiarities. One example: My main
browser(K-Meleon), was involuntarily blocked. Firefox and IE, on the other
hand, has been allowed all the time.
For a while I was also getting a lot of warnings about non-existent
changes of some of my applications.

Do you have an address for it, please?

 

[Ron May]

hummingbird skrev:

So what? Having this feature in a personal firewall is nonsense IMNSFHO.
If you want to block outgoing traffic, you do this at some point outside
the computer(s) that might generate the traffic. Trusting that a piece
of software running on your computer can do anything to stop outgoing
traffic if the computer somehow gets compromised is optimistic at best.

And even if it could be trusted, what would it matter? How can blocking
outgoing traffic prevent your computer from being compromised in the
first place?

The way I look at it, stopping unexpected and unapproved outgoing
traffic with a firewall ADDS a layer of security to anything else you
should be doing to practice "safe hex." I fail to see what the
advantage would be in using a firewall that DOESN'T have the option to
block outgoing traffic as opposed to one that DOES.

 

[BoB]

None of the above will run on Win9x.

The only one which will run on Win9x bur it has become so bloated as
to almost completely useless. I've gone back to running a very early
version to control outgoing content and I use SmoothWall as my gateway
to prevent unrequested incoming attacks.

LOL.

Kerio 2.1.5 works fine on Win9x. I've used it for years. It's also
unsupported but that's not terribly important for firewalls. Same
applies for Outpost and Sygate, I imagine.

BoB

 

[JP Loken]

På Fri, 24 Feb 2006 00:01:23 +0100, skrev David

[...]

There are many others.

I'm just now trying out R-Firewall.
Looked promising, but has some peculiarities. One example: My main
browser(K-Meleon), was involuntarily blocked. Firefox and IE, on the
other
hand, has been allowed all the time.
For a while I was also getting a lot of warnings about non-existent
changes of some of my applications.

Do you have an address for it, please?

Sorry. Forgot.
Not surprisingly, it's
http://www.r-firewall.com/

 

[antoine]

Sorry. Forgot.
Not surprisingly, it's
http://www.r-firewall.com/

Thank you JP for this information about a firewall which isn't yet well
known.

 

[David]

På Fri, 24 Feb 2006 00:01:23 +0100, skrev David

[...]

There are many others.

I'm just now trying out R-Firewall.
Looked promising, but has some peculiarities. One example: My main
browser(K-Meleon), was involuntarily blocked. Firefox and IE, on the
other
hand, has been allowed all the time.
For a while I was also getting a lot of warnings about non-existent
changes of some of my applications.

Do you have an address for it, please?

Sorry. Forgot.
Not surprisingly, it's
http://www.r-firewall.com/

Thanks. I'll investigate.

 

[MLC]

venerdì 24 febbraio 2006 David ha scritto:

Thanks. I'll investigate.

Please, let us know what you testers think about it.

Thanks,

 

[Morten Skarstad]

Craig skrev:

For a layperson such as myself, having a tool monitor /outgoing/
connections is another way of familiarizing myself with regular traffic
and spotting anomalies. Nonsense? Perhaps for the packet-sniffing
cognoscenti...


It's possible that you're either mis-reading or mis-interpreting.
"..(M)onitor outgoing connections..." does not mean "...block outgoing
traffic."

Very possible. If it clears anything up, my personal interpretation of
this was something along the lines of "inspect (outgoing) traffic for
the purpose of deciding whether or not to allow it".

Having such a tool at one's disposal is hardly, as you put it in your
NSFHO, "nonsense."

If you are referring to tools for logging and/or analyzing traffic I'd
agree with you. But they hardly give you added security by themselves;
They merely provide additional foundation data for you to decide on what
security precautions to take. Besides, AFAIK there are programs out
there way more useful for this purpose than any personal firewall
application available.

 

[Morten Skarstad]

Ron May skrev:

The way I look at it, stopping unexpected and unapproved outgoing
traffic with a firewall ADDS a layer of security to anything else you
should be doing to practice "safe hex."

Oh my, the "l"-word...

Blocking outgoing traffic adds a big fat layer of nothing. It's the
right solution to the wrong problem. It's like putting a padlock on a
wall. It's like training your dog to fetch the newspaper every time a
burglar breaks your window.

If your computer wants to send anything it is not supposed to send, it
can only be assumed that your computer is compromised. If your computer
is compromised, you can not trust the software running on it. That
includes your operating system, that includes your applications, and
that includes your Chinese firewall.

I fail to see what the
advantage would be in using a firewall that DOESN'T have the option to
block outgoing traffic as opposed to one that DOES.

Now, I could tell you that not installing an extra firewall would mean
not putting the burden of extra anti-ware on your computer. I could tell
you how security precautions, no matter how dysfunctional, tend to lull
people into a false sense of security, thus making them loosen up on the
attack vectors that actually _do_ matter. I could even throw you the one
about how increased number of software running on your computer would
increase the total complexity of your system, and thus potentially
introduce _new_ attack vectors. But guess what, it being weekend and
all, I thought I'd be nice to you. So fine, you win: There are no
advantages to having a one-way firewall over a two-way one. Happy now?

Then again, I can think of no advantages to having a computer without an
airbag compared to having one with. So you better get one.

 

[Doc]

Ron May skrev:

Oh my, the "l"-word...

Blocking outgoing traffic adds a big fat layer of nothing. It's the
right solution to the wrong problem. It's like putting a padlock on a
wall. It's like training your dog to fetch the newspaper every time a
burglar breaks your window.

Seems like you don't really understand 'monitor outgoing traffic'.

If your computer wants to send anything it is not supposed to send, it
can only be assumed that your computer is compromised. If your
computer is compromised, you can not trust the software running on it.
That includes your operating system, that includes your applications,
and that includes your Chinese firewall.

Its not about your computer sending anything its not supposed to send,
or being 'compromised'.

Take email as an example. A lot of 'experts' say that one should ONLY
read email in plain text mode because an HTML coded email needs to
access the web to download page content (ie OUTBOUND connection), and
that could lead to nefarious code being executed on your computer. So
what if you subscribe to some newsletters that are in HTML format, and
you WANT to read them in HTML ? Do you change your email settings to
allow HTML, read that newsletter, and then remember to change your
settings back again ? Thats a lot of pi$$ing around. Or do you let your
firewall look after you ? Set it and forget it. My email client is left
in HTML mode BUT my firewall blocks all OUTGOING access EXCEPT to the 5
or 6 websites that I have allowed.

I totally agree with you Ron. Being in control of MY computer and where
it goes on the web is in my best interests. Anyone without outbound
monitoring would be really surprised to learn of the number of programs
that try to access the web, usually for innocent reasons like checking
for latest versions etc.

Now, I could tell you that not installing an extra firewall would mean
not putting the burden of extra anti-ware on your computer. I could
tell you how security precautions, no matter how dysfunctional, tend
to lull people into a false sense of security, thus making them loosen
up on the attack vectors that actually _do_ matter. I could even throw
you the one about how increased number of software running on your
computer would increase the total complexity of your system, and thus
potentially introduce _new_ attack vectors. But guess what, it being
weekend and all, I thought I'd be nice to you. So fine, you win: There
are no advantages to having a one-way firewall over a two-way one.
Happy now?

Then again, I can think of no advantages to having a computer without
an airbag compared to having one with. So you better get one.

What a load of garbage.

 

[David]

Ron May skrev:

Oh my, the "l"-word...

Blocking outgoing traffic adds a big fat layer of nothing. It's the
right solution to the wrong problem. It's like putting a padlock on a
wall. It's like training your dog to fetch the newspaper every time a
burglar breaks your window.

If your computer wants to send anything it is not supposed to send, it
can only be assumed that your computer is compromised. If your computer
is compromised, you can not trust the software running on it. That
includes your operating system, that includes your applications, and
that includes your Chinese firewall.

And, by knowing that my computer is compromised, I can fix the problem
without having my personal details scattered all over the world. It is
the ability to stop the communication that is important.

Now, I could tell you that not installing an extra firewall would mean
not putting the burden of extra anti-ware on your computer. I could tell
you how security precautions, no matter how dysfunctional, tend to lull
people into a false sense of security, thus making them loosen up on the
attack vectors that actually _do_ matter. I could even throw you the one
about how increased number of software running on your computer would
increase the total complexity of your system, and thus potentially
introduce _new_ attack vectors. But guess what, it being weekend and
all, I thought I'd be nice to you. So fine, you win: There are no
advantages to having a one-way firewall over a two-way one. Happy now?

An outgoing firewall is merely an extra string to the bow and should
be treated as such.

 

[Morten Skarstad]

Doc skrev:

Seems like you don't really understand 'monitor outgoing traffic'.

I replied to that assumption in another post, you may want to read that.

The post I replied to in this case, however, clearly said "stopping
unexpected and unapproved outgoing traffic".

Take email as an example. A lot of 'experts' say that one should ONLY
read email in plain text mode because an HTML coded email needs to
access the web to download page content (ie OUTBOUND connection), and
that could lead to nefarious code being executed on your computer.

Not quite. The reason to be careful with HTML mails are these:

1) They can _contain_ malicious code. They may or may not also try to
download additional code to your computer, but the point is that to do
this they must already contain code designed to do this. Most e-mail
clients are designed not to execute such code, but holes do sometimes
get uncovered and exploited, causing worms to spread by mail. However,
apart from the e-mail message itself, this has nothing to do with
downloading stuff to your computer.

2) Spammers send out HTML mail linking to external images (not code).
These images (or more correctly, the way they are linked) can uniquely
identify individual recipients. The purpose of this is to verify active
e-mail-addresses. Meaning that if an HTML mail contains <img
src="http://www.spam-my-ass-please.cum/special-offer.gif?ID=Doc"> and
you (or your e-mail client) allows this image to download, then their
webserver will log this, and they will know that you read your mail.
This makes you a target for more spam. Technically this is a privacy
issue rather than a security issue, but you're right: Requests for such
images should not be let out of your computer. Plain text is one way to
do this. Another is to view mails as HTML, but not download the images
from untrusted sites/senders.

Then of course there is the fact that a lot of HTML mails tend to be
butt ugly, but maybe I'm just too picky

So
what if you subscribe to some newsletters that are in HTML format, and
you WANT to read them in HTML ? Do you change your email settings to
allow HTML, read that newsletter, and then remember to change your
settings back again ? Thats a lot of pi$$ing around. Or do you let your
firewall look after you ? Set it and forget it. My email client is left
in HTML mode BUT my firewall blocks all OUTGOING access EXCEPT to the 5
or 6 websites that I have allowed.

Now I'm curious: What e-mail client are you using? Thunderbird handles
these situations just fine. There are two different modes of HTML, and
you can choose which senders to allow referencing to external
pictures/objects in the HTML. SquirrelMail is more strict, and shows no
external pictures whatsoever, but apart from that HTML renders just fine.

I totally agree with you Ron. Being in control of MY computer and where
it goes on the web is in my best interests. Anyone without outbound
monitoring would be really surprised to learn of the number of programs
that try to access the web, usually for innocent reasons like checking
for latest versions etc.

Well, I do see your point. I just guess I'm not that peculiar about this
"innocent" traffic as you are. Here's why:

1) It's just that: Innocent, benign, harmless, and maybe even useful. I
want my AV to download the latest virus signatures. I want Windows
Update to grab the latest patches for my OS. I want Firefox to be fit
for fight.

2) Innocent traffic can usually be disabled inside the innocent programs
causing it in the first place.

3) Programs fitting neither of the above 2 (adware, spyware etc) crosses
the innocent-line in my book, and is not wanted on my computer in the
first place.

Again, I'm curious: Which specific applications do you find it necessary
to prevent from making outgoing connections?

 

[Morten Skarstad]

David skrev:

And, by knowing that my computer is compromised, I can fix the problem
without having my personal details scattered all over the world. It is
the ability to stop the communication that is important.

Which is my point exactly. Except, if your firewall is running on your
computer, and some sort of malicious code pwns your computer, who is
then in charge of your firewall? And can disable it at will?

 

[Lou]

David skrev:


Which is my point exactly. Except, if your firewall is running on your
computer, and some sort of malicious code pwns your computer, who is
then in charge of your firewall? And can disable it at will?

I think firewall pgms do have internal protection against this obvious
possibility

 

[Morten Skarstad]

(e-mail address removed) skrev:

I think firewall pgms do have internal protection against this obvious
possibility

You better think again, then.

Consider this: Does your firewall program have protection against _you_
turning it off? Does it have protection against _you_ instructing it to
allow traffic to and/or from certain IPs/ports/programs/whatever? Does
it prevent _you_ from deleting and/or editing registry keys and/or files
on your computer? Does your firewall have protection against _you_
shutting down or freezing running processes?

If you cannot answer "yes" to any of the above: How is a firewall
supposed to protect itself against any malicious code that is likely to
be executed with _your_ privileges?

Put simply: It can't. It's not even supposed to do this. The firewall is
supposed to block/monitor/filter/whatever traffic running on your
network interfaces. That's it. It's not supposed to prevent you from
launching malicious code or causing irreparable damage to your system.
That's the job of your OS (through privilege control) and any
anti-malware (antivirus, antispyware etc) you may have watching over
your system. If malicious code slips by any of the above, your precious
personal firewall is royally screwed.

Start doing some reading. Viruses disabling local security software is
nothing new.

 

[Ron May]

I just guess I'm not that peculiar about this
"innocent" traffic as you are. Here's why:

1) It's just that: Innocent, benign, harmless, and maybe even useful. I
want my AV to download the latest virus signatures. I want Windows
Update to grab the latest patches for my OS. I want Firefox to be fit
for fight.

2) Innocent traffic can usually be disabled inside the innocent programs
causing it in the first place.

3) Programs fitting neither of the above 2 (adware, spyware etc) crosses
the innocent-line in my book, and is not wanted on my computer in the
first place.

I'm afraid I still don't understand your preference for a one-way
firewall over a two-way firewall, which is really what this discussion
has been about.

While firewalls vary in terms of system overhead for any number of
reasons, I don't think a significant difference can be demonstrated
between one-way and two-way versions alone, so that's not the issue.

"Teaching" a firewall what you want it to do is is largely a matter of
initial setup in the first few days of use. After that, you're only
dealing with new or updated software that wants to connect to the
outside world. If (as above) you feel there is a "useful" purpose to
allow it, you click "yes." If you feel the traffic is "innocent,
benign, (or) harmless" AND you want to allow it, you also click
"yes." On the other hand, there are about a dozen or so programs on
my system that I have blocked. None of them are suspected as being
malicious, but I WANT TO DECIDE when or if to allow them to connect,
so I click the "no" button and move on. Since it's a question of
yes/no (and occasionally "just this time,") complexity or workload
burden can't be an issue.

I agree we're talking MAINLY about preferences rather than thwarting a
serious security threat, but by extension, since all but a MINISCULE
amount of internet traffic is "innocent, benign, (or) harmless," your
argument against a two-way firewall could be made against having ANY
firewall at all.

Lastly, (and here's where I think you're missing the point) you seem
to suggest that OTHER precautions need to be taken INSTEAD of using a
two-way firewall. What I'm saying (as are others in the thread) is
that OF COURSE you take all the other precautions, but IN ADDITION, an
outgoing firewall provides an occasional alert that you might not have
received otherwise, and more importantly, gives you the OPTION to
decide how you want to handle it, INCLUDING things like drilling down
into a program's preferences and disabling the option to "check for
updates every 15 minutes." <g>

 

[Ron May]

(e-mail address removed) skrev:


You better think again, then.

Consider this: Does your firewall program have protection against _you_
turning it off? Does it have protection against _you_ instructing it to
allow traffic to and/or from certain IPs/ports/programs/whatever? Does
it prevent _you_ from deleting and/or editing registry keys and/or files
on your computer? Does your firewall have protection against _you_
shutting down or freezing running processes?

If you cannot answer "yes" to any of the above: How is a firewall
supposed to protect itself against any malicious code that is likely to
be executed with _your_ privileges?

Put simply: It can't. It's not even supposed to do this. The firewall is
supposed to block/monitor/filter/whatever traffic running on your
network interfaces. That's it. It's not supposed to prevent you from
launching malicious code or causing irreparable damage to your system.
That's the job of your OS (through privilege control) and any
anti-malware (antivirus, antispyware etc) you may have watching over
your system. If malicious code slips by any of the above, your precious
personal firewall is royally screwed.

Start doing some reading. Viruses disabling local security software is
nothing new.

And using a ONE-WAY firewall instead of a TWO-WAY firewall is going to
better prevent that scenario? How????

OF COURSE you take the other precautions. That's a given. You're
missing the point. See my more detailed response elsewhere in the
thread.