XP's "firewall" - why the bad press?

Ok, just what IS just so bad about XP's firewall?

It seems that ANY security product that comes out always gathers comments like: "Security? Bah, that piece of crap _________ (fill in the blank) isn't worth it..."

I'm hearing the same about XP's built in "firewall" -- I know it's not a *real* firewall. And yet, any scans I run against it seem to indicate that it's pretty decent. Am I missing something? I read in another thread someone actually recommending not bothering with it and disable it.?.? Why? Isn't something better than nothing?

Cheers!

One thing that I know about it is that it has no ability to limit outgoing traffic. This could be considered a serious problem if a trojan is on your system. Your system could also be more likely to be used in a DDOS attack, because of this inability to limit outgoing traffic. Thats the most that I know about the XP firewall, hope it helps.

Well for starters it doesnt filter anything outgoing wich is juts as important as incoming with all the trojans and stuff floating around out there. Another thing is that if you have another software firewall they will conflict with each other and then you've got an even bigger hole in your security. That and the fact that it is comepletely unconfigurable. its either on or off. that is a big problem to me.

maybe is because it's not a fully featured firewall, it only carries very basic functions
you cannot tweal its setting as you would with a commercial firewall and dont have as much control of whats going on

Quote:

---

it's not a fully featured firewall

---

Correct, for one, it has no idea about connection state, second, it is very limited in that it only allows for port and protocol filtering from the "outside" and not much else.

i wouldn't consider it a firewall, lacks too much needed functionality of basic software based firewall. i wouldn't be surprised to see ms coming up with their version of firewall soon, but firewall and security goes hand in hand, and it would all depend on what your needs are.

-w0rm3y

One thing I would like to add to this discussion is that it doesn't report ports as 'stealth' instead it reports ports as 'closed'. Sygate reports all none used ports as 'stealth' for example.
If you use a nmap scan on it, wheter it be a syn scan or one of the other scans., it reports the host as being 'up'.
Why is this bad ?
If a port is in the state closed and you send a packet to it it will respond to that packet. For example with a 'res' packet. The packets contain overhead that can give information on the system.

Another thing is that you get no information. It does not tell you what is happening.
And being unable to block outgoing connections is just plain bad.

In my opinion you can better use a (free) third party firewall like sygate, kerio zonealarm or outpost.
Like mentioned remember to disable the built in firewall if you choose to use a third party one.

Well, Noodle about the stealth mode I'm not sure to fully aggree.
There one information that is given to the attacker: A firewall is being used btw him and the target.
What type of information does the rst will give to the attacker the TCP seq? I hope every one got a stack with no predictable seq number!
Is there another sensitive information?

What I'm sure of, is that for a firewall that protect a LAN i'd rather go with a rst spoof reply from the firewall in order to hide as much as possible my firewall. And to avoid the attacker to possibly guess what is the firewall ruleset and then guess what is the network topology and server protected.

But this had been already discussed here

Quote:

---

Originally posted here by Networker
When a firewall is protecting a port (e.g. FTP port ) the firewall will drop any related frames. That's what we are expected from the firewall!

Now, in the case there is no firewall & If you start a scan using TCP with ACK flag your are expecting the target to answer you with a TCP packet with the RST flag (read the TCP rfc for more details!).
The trick is that when a firewall is in the middle, it will simply drop the packet and you'll never get the TCP RST packet back.
That's a simple way to detect what port is protected or not. (Nmap will do it for you, have a look in the manpage!)
Of course some constructors knows about it and implement counter measure:
- A simple one is to answer a TCP RST from the firewall, but you can still detect the firewall action thanx to the IP source (the one of the firewall)
- The ultimate mitigation is when the firewall is able to spoof the target IP for answering the RST packet.

I hope it help, ;)

---

For example if you are running one or two services on you computer the prediction of the OS will be much easier.
We are talking about XP here and it uses a predictible sequence. This way the attacker would find out what OS is being used in no time. With this information the attacker can expand his attack.
If you are using one of the BSD's for example the sequence is complete random.
So if you scan a box with nmap -O on a XPfirewall protected box and only one service enabled you will find pretty soon the box is running XP. Where if you are using sygate (for example) you would not discover this.
This may not sound like a big deal but if you have someone that is truly attacking you it makes a difference.
Knowing the person uses XP strikes out many things.
Would he be using Internet Explorer ?
Would he be using Outlook Express ?
This gains many oppertunities for the next stage of attack.

To add to the previous post. Xp comes with this firewall but is still highly vulnarable to attacks because the default install enables port 139, 445, 5000 and they will be reported as being open to the scanner. The user gets a fake sence of security.
IMO it is better to have no security then to have a fake sence of security.

Yes! Yes! -------------->>>> "M$"

Ms asumes everybody is a buddy, so no one will do such things like that.

With the WinXp Firewall you dont have many setting and cant configure it right for you
One that works alright is Norton Antivirus

okay netcrasher two things Norton Antivirus isnt a firewall. It has NO firewall functions. hence the name antivirus. okay that rant is over. NEXT with win xp you only have 2 possible setting ON or OFF thats it. Maybe somebody should read a little closer to whats being said next time????????

Ok, I think I get the idea. Personnally, I also use ZoneAlarm while mobile and behind my FW box at home. Love the stealth of ZA, gotta have outbound checks, etc..


It looks like we can all agree that it's not a real *firewall* per se, M$ should be calling it "security enhancements" not a "firewall." Even Red Hat's iptables GUI is called "Security Configuration" -- not "Firewall." But hey, Windows 3.1 was a "multi-tasking o/s" too, wasn't it?


Still, if you need something, but it's better than nothing.

Anyone know any reason NOT to use it? (As long as it's not soley relied upon and doesn't lend to a false sense of security.)

Quote:

---

Anyone know any reason NOT to use it?

---

I think that many of the reasons above should suffice, don't you? It lends little control to properly secure your environment. It has no ability to track connection state, it has no concept of inside vs. outside, it is used for securing ports (and I use that term lightly), it cannot analyze packets thoroughly (other than the protocol), it has no protection for outbound connections and the list goes on. Do yourself a favor and look into something more robust. You'll be happier in the end. I'd look at IPTABLES in any RH distro, or look into an appliance like Cisco PIX, etc.

Hope this helps.

--TH13

ZombieMann and netcrashxx you CAN configure XP's firewall to a certain extent... go to properties of the connection > advanced > settings> services and you can configure there what ports to let open - it's not true to say that the ICF is either off or on.

having said that - the reasons not to use the thing have already been stated several times so I'm not going to reiterate them again...

Z

ZomBieMann77

Im not an idiot...There are more then one Norton
-Norton Antivirus
-Norton Cleansweap
-Norton Ghost
---Norton Personal Firewall

netcrashxx the error in your message ios that you said that the WinXp firewall does not have the same functions as Norton Antivirus <---..

Quote:

---

Originally posted here by Mykol


Why? Isn't something better than nothing?

---

Not when that something is more exploitable than not having an extra app running with holes.

Thanx Noodle to provide real good posts!

You're right fingerprinting is a real pain and should be mitigated!
As just as a little conclusion to our discussion, i'll say that securing a PC with embedded s/w don't give full satisfaction. I believe that i'll definitly go for a firewall in the middle when possible (a old PC will do it).

BTW I'm not windows expert but didn't Microsoft understood the danger of predictable TCP sequence number...
Is there a ptach to upgrade the TCP/IP stack???