Problem with Win XP SP2 Firewall

I was playing around with this before I ditched SP2... uninstalled it 'successfully'.. though upon rebooting all my apps were "not responding" so I had to format but that's another story. Anyhow, time to get on topic.

I noticed that the SPI firewall isn't really so 'Stateful'. I made a list of a few "exceptions" as they're called.... being programs that are allowed to recieve inbound traffic on their listening ports. One of these "allowed" apps was the newest version of Yahoo! Messenger [ver. 6.0 Build 1671]. Anyhow, I specified this particular program as an exception and then changed it's "scope..." to only allow ip's and subnets that I CHOSE to to communicate with the program on my end. So, basically, I restricted the access to the program from the outside WAN to only allow the ip's that were required to connect to the service (the msg servers) and a few other ip's that were required to retrieve roomlisting info from the Yahoo! webservers and such.

When this program is launched, it opens a socket and listens on TCP :5101 by default which is the application's P2P port for PM's -- allowing for potential 'direct connections' only to the people contained on your buddy list. This port was listening, and the rules were applied that nobody but those certain ip's could communicate to me through Messenger. I had a friend that was on my buddylist pm me to test whether or not his ip (being a class A 24.* ip) would be stopped from making a direct connection to me on :5101. As his ip wasn't on the allow list I figured that it would be rejected or I would be prompted that his ip address was trying to make a direct connection to me on TCP :5101.

Conclusion: It didn't happen and the connection was allowed through, regardless of my "scope..." settings. If this firewall was truly 'stateful' it wouldn't have allowed a full 3-way handshake to be performed with a machine that WASN'T on the allow-list for accepting inbound traffic (let alone full connections) regardless of the application's listening socket for the application. The problem here is the application is 'trusted' so much as an "exception" that it appears that no further stateful inspection is done (if so very little) once the exception status is granted for the app. Too bad I didn't file-a-bug on this one. It's a pretty big one. I guess if I cared enough to have them fix it I would have but I won't ever be using it again. Anybody hoping to rely on this for future security... I wouldn't hold your breath.

everytime i have used the firewall there is an option for "local subnet" or "all IP's"... i just wish there was not a default selection and it forced you to make one (default is local subnet)

We talked about this on a similar thread the other day and came to the same conclusion. I think it was Negative who said, if memory serves correct, that it blocks inbound but not outbound communication, making it only half effective at best. It also really doesn't like Zone Alarm.

But we really shouldn't have had our hopes up about this anyway. After all, it is MS...

Quote:

---

everytime i have used the firewall there is an option for "local subnet" or "all IP's"... i just wish there was not a default selection and it forced you to make one (default is local subnet)

---

Yeah, I agree there too. Weird though as my "default" was different than yours. The default for my SP2 RC2 Firewall (not RC1, I've never even used it) here was "Allow All IP's". Scary thought. I restricted to the local subnet and now that I think about it I believe that that might've actually worked. Can't really remember for sure. If allowing only specific ip's and subnets as inbound traffic to the exception-listed applications actually worked then I might actually think it was alright. It would still be pretty bare-bones but would be something that I could cope with.

Quote:

---

We talked about this on a similar thread the other day and came to the same conclusion. I think it was Negative who said, if memory serves correct, that it blocks inbound but not outbound communication, making it only half effective at best. It also really doesn't like Zone Alarm.

---

It'll actually block or 'attempt' to block outbound traffic but only if the application ISN'T already on the "exceptions" list. Once it's on there full outbound as well as inbound traffic is allowed to traverse to the application unless set differently... half of which I know doesn't even work. SPI FireWalls are supposed to compile tables for all of the connections that they monitor with connection-based info pertaining to each individual connection... monitor these for changes within the actual stream it's self with the ability to validate the actual packet's payloads unlike Static Packet Filtering... compare the packets to ones previously passed before them... and only allow connections if there's a corresponding entry in their tables that matches the connection attributes to the connection that you initiated first and not the other end. If all of that was taken into account to rate this supposed SPI Firewall... it would for sure get an "F". This might as well be labeled only a Static Packet Filter cuz that's all I've seen it as for the most part.

So what were they thinking anyway? The XP "firewall" already sucked, so why did they only take a half-butt attempt at improving it? Just to have the appearance of "Hey, look! See, we have a firewall now! We're really good, really!"

Yeah, MS's claim to fame for this supposed "Supercessor" dubbed 'ICF 2' was that it will now monitor BOTH traffic directions.. unlike the original ICF that only monitored inbound and not any outbound. What they won't/don't tell you is that the outbound and inbound monitoring is only good until the exceptions are made... then apparently anything can go as I've found out. I'll stick to Sygate Pro or OutPost Pro for my application-layer firewall and my router w/ NAT + SPI firewall for my network-layer. Both layers are covered, work seemlessly together and they'll actually alert me of, and/or disallow, unsolicited connection attempts!

Nice. Yeah, I'm probably going to get reacquainted with Sygate when I get home tonight.

Whoa, calm down -all- of you. Microsoft takes steps towards security and improving the stability of the operating system by giving you more fine tuned controls over the outbound checking... and you bash them for it?

You sit there and joke about Microsoft and it's lack of security with your friends, and now they do something about it... and you continue to joke about them?

The entire SP2 package is going to break a -ton- of 3rd party programs because it is now enforcing a ton of OS level security. Shared memory for example, is now under strict OS control rather than being open to applications. The firewall may not block outbound, but it sure as hell does a good job of blocking inbound. Could it be better? It sure could be. But there is a level of balance they have to find so that they won't have a few billion people screaming about how they can not connect to the internet when sp2 is released.

Seriously guys, reread your posts. Be happy they are taking steps to improve security, and understand that steps towards security happen one step at a time for the sake of stability, and thus to fine tune things it will take them time (just as it did Linux). But don't continue to bash Microsoft on a "damned if you do damned if you don't" just because it's an old habit.


edit: And if you really want to know, instead of gossip, the facts behind ICF 2, I suggest reading the whitepaper about the deployment of ICF along with it's settings:

http://www.microsoft.com/downloads/d...displaylang=en

Oh, thanks a lot pooh, you just completely ruined my posts! Geez! Ruin all my fun... ;) I guess I can see that point, at least it's a step forward. But as a lame attempt to argue with the master here, my point is that it's Microsoft -- Surely they can whip up something far superior, you'd think? Why aren't they? Sure, it's an improvement, but we all know they're capable of doing more, so what's holding them back?

Quote:

---

Why aren't they? Sure, it's an improvement, but we all know they're capable of doing more, so what's holding them back?

---

The real question at hand is "Is the normal public ready for that big of a step?"

Imagine them placing a stateful inbound and outbound firewall that has popups as to program control to the internet (a zone alarm clone). Think of how many people who use the Windows OS are not currently at a level of computer knowledge to deal with what will happen next.

AIM suddenly won't connect. MSN won't transfer files. Not all websites work now. IRC won't work. Video conferencing won't connect. A billion things that involve having a firewall and configuring it to allow certain programs and services, is beyond the reach of what the public is ready to handle.

So, rather than crippling the entire Windows OS userbase, they are little by little teaching them how things work. By showing them the beginnings of security, people will get "used" to that level.. thus allowing MS to add another leve lof security as time goes on so they can get "used" to yet another level of security.. and so forth and so on.

We know they could patch up a firewall to destroy the skills of zonealarm and kerio, so why not? Because they would rather begin the steps towards better security gradually rather than an enourmous drop of it and lose their userbase (in which the people who would know how to deal with it are a very very small minority.)

"A journey of a thousand miles or a thousand days starts with a single step" - Tao Te Ching

I'm not blaming them for anything... I just pointed out that it doesn't provide (any, imo) outbound filtering. If I'm correct, it isn't supposed to do outbound filtering, so there's no reason to blame MicroSoft.
A simple example is the DivX codecs I use. It installs Gator, and I simply block all outbound Gator traffic. I can't do that with the Windows Firewall, unless I'm overlooking something.
To me, that's enough reason to keep on using another firewall that does have outbound filtering. I'm downloading Open Office right now, so I can read that whitepaper :)

Quote:

---

To me, that's enough reason to keep on using another firewall that does have outbound filtering. I'm downloading Open Office right now, so I can read that whitepaper

---

Now I can agree on that :) Certain things call for outbound filtering, but as I said in the post just above yours (we probably posted at the same time lol ) the public isn't ready for that level of complication in security. Soon though.. soon. :) Enjoy that read, and good to see another fan of OO!

Good point Pooh, good point.

Hmm...well maybe they could have the firewall default or have a basic configuration mode for those non-savvy users, then have an advanced config available for those of who know what to do with it? Wouldn't that be a way to better fix the problem? I dunno, just an idea...I guess that's neither here nor there though, since MS doesn't take my advice. ;)

Absolutely, they could do a whole lot more.. I mean afterall, they've got bazillionz of $'s and happen to be the largest software corporation in the world. You'd think they'd be able to get simple **** like that right especially @ Release Candidate 2... hell there was even one before it.

Pooh, seriously do you work for them? Their attempts to tighten up security now come too late.. they've had YEARS to do that.. but according to them, opted for compatibility and technology and whatever... I wasn't bashing them... poking fun maybe. But should I bash them? Could I? Am I allowed to? Of course. I use their products, their OS's. I bitch about them b/c they always act like they're improving something or bettering it and they do it half-assed. Example A: http://www.securitytracker.com/alert...n/1010550.html <- that MS router vuln is a whole 2 days old! That's progress for them. Usually it's every day and not a whole every-other that there's some IE vuln posted or some XP security flaw. I've read plenty of the technical details and whitepapers on this sort of stuff. Have you even ran ICF 2? I have so this is why I feel I'm more than entitled to comment on the subject. Don't take things so personal. MS isn't that gr8... they don't care about you so why stick up for them and some of their sorry products (not that they all are)? :rolleyes:

Well, Pooh wasn't taking up for them per se, he just has a LOT of experience working with this stuff (which one can gather from his many previous posts). I take what he says very seriously. I think you both have good points, and I'm kinda somewhere inbetween you two. I think all in all, Microsoft products are decent. After all, I use Windows, and heck, unlike most pros, I use FrontPage. But on the other hand, they have the resources to produce some really kick-butt stuff, so I think they're falling short of their full potential, seemingly out of complacency due to being the undisputed leader in the market.

So, in a sense, you're both right.

Quote:

---

well maybe they could have the firewall default or have a basic configuration mode for those non-savvy users, then have an advanced config available for those of who know what to do with it? Wouldn't that be a way to better fix the problem?

---

Having certain ports open and allowed that the user may not be using anyways? Come on, that's one of the first rules of security, to never do that.


--rolls up his sleeves--

Quote:

---

Absolutely, they could do a whole lot more.. I mean afterall, they've got bazillionz of $'s and happen to be the largest software corporation in the world. You'd think they'd be able to get simple **** like that right especially @ Release Candidate 2... hell there was even one before it.

---

Did you even read my above post as to why they could not release this to the public? Please do so, before continuing, and you will see why they can not do this.

Quote:

---

Pooh, seriously do you work for them?

---

I am a beta tester for MS, and a long time user (Windows 1.1a). I feel that as a user and tester I've gained a decent perspective on how and why they do certain things.

Quote:

---

Their attempts to tighten up security now come too late..

---

Security enhancements can never be too late. If your statement was fact, linux kernel 2.4.2 should have stayed with the trojan someone slipped instead of Linus removing it and improving upon the security of the CVS controller.

Quote:

---

But should I bash them? Could I? Am I allowed to? Of course. I use their products, their OS's. I bitch about them b/c they always act like they're improving something or bettering it and they do it half-assed.

---

You could, but should you? Is your expience with them on the OS level so deep that you can say what can and can now work on a large scale distrobution with millions of end users that most likley have never even heard the term firewall?

Quote:

---

Example A: http://www.securitytracker.com/aler...un/1010550.html <- that MS router vuln is a whole 2 days old! That's progress for them. Usually it's every day and not a whole every-other that there's some IE vuln posted or some XP security flaw.

---

Oh here we go.. don't make me pull out the vunerabilities sitting in Linux distros and the kernel that have been sitting around for months. Every OS has problems, each get to it in their own time.

Quote:

---

I've read plenty of the technical details and whitepapers on this sort of stuff. Have you even ran ICF 2? I have so this is why I feel I'm more than entitled to comment on the subject.

---

I wrote the review on it:

http://www.enterpriseitplanet.com/se...le.php/3318441
http://www.antionline.com/showthread...hreadid=255170

Quote:

---

they don't care about you so why stick up for them and some of their sorry products (not that they all are)?

---

Becuse based on my personal experience with them, I know better.

Microsoft isn't stable enough! waaaa

-----They build in controls to stabilize memory, hal, defragging etc. Puts alot of companies who made those products out of busines...

Microsoft is a monopoly they have too much power there should be more competition. waaaa!

Microsoft doesn't do enough about backups and business continuity. wwaaaa!

-----Microsoft builds in backup ability and enhances it. Putting companies out of business in the process.

Microsoft is a monopoly putting the little guy out of business and forcing us to use their products, by eliminating competition. WAAAA!

Microsoft doesn't do much about security it doesn't have a built in firewal and patch management is shotty. WAAAAAAAAA!

----Microsoft builds in some basic firewalling, no one (with exceptions of course) bothers to enable it or learn it, and they will keep enhancing it, putting more and more people out of business including Zone Alarm eventually and all those patch management companies.

Ohhhh Microsoft is a bad company they keep putting little companies out of busninesss!!!! Why don't they stop??? Waaah.

Microsoft doesn't do anything about virus protections. Waaaa.

----They build in virus protection putting virus companies out of business fueling more anti-corp feelings to the same people who complain and in addition adding to the unrest to belief that the world "order" orchestrates virus infections to further their product line, only now it's Microsoft which is the big bully anyway... and well.... I was attempting some fun. :D

Quote:

---

They build in controls to stabilize memory, hal,

---

HAL? God I can see it now when it is implimented..

"Hello user. How are you feeling today? What are you doing Dave?" -power in the house goes out and suffication is imminient.

Quote:

---

I am a beta tester for MS, and a long time user (Windows 1.1a). I feel that as a user and tester I've gained a decent perspective on how and why they do certain things.

---

I had you pegged for a 'MVP'.

Quote:

---

Security enhancements can never be too late. If your statement was fact, linux kernel 2.4.2 should have stayed with the trojan someone slipped instead of Linus removing it and improving upon the security of the CVS controller.

---

Quote:

---

Their attempts to tighten up security now come too late..

---

Notice how I said "their"?

Quote:

---

Oh here we go.. don't make me pull out the vunerabilities sitting in Linux distros and the kernel that have been sitting around for months. Every OS has problems, each get to it in their own time.

---

Pooh, did you ever think that maybe there's too many distros available to count and that the OS's are opensource and that 99% of the developers don't actually get paid for their work like Micro$oft'$ employee$ do? I don't know too many Linux devs on the payroll. Wait until the next gen of Windows desktop OS's come out and try to be even more Unix-like... wait till many more Windows users use their XP, Longhorn etc. boxes to run servers and nextgen software. It'll be a doozy then. Vuln Valley is what it'll be called.... forget the Silicon.

Geez, you guys take this stuff hardcore seriously huh? I think it's fair to say, reiterating my previous point, that their products are decent, they just could be better. Every product could be better, granted, but c'mon, we know MS can crank out considerably better stuff, they have the best brains in the business. MS obviously doesn't suck, but there are definately some issues.

But this is an old debate, isn't it? All we're missing are the usual linux guys to jump into the fray. :D Like I said, both sides have good points, we just need to give credit where credit's due while at the same time making our criticisms.

And as long as we have stupid users, even the best stuff will get screwed up...

Quote:

---

Their attempts to tighten up security now come too late..

---

No new security implimentation is too late. You will eventually realise this.

Quote:

---

I don't know too many Linux devs on the payroll.

---

Like the entire Redhat and Suse staff?

Quote:

---

Wait until the next gen of Windows desktop OS's come out and try to be even more Unix-like...

---

Like Longhorn family 40xx? I beta test those as well and posted a review of it here also. It's security implimetation is amazing.

Did you have any documentation to back up your "facts and figures"? Do you have any experience with Microsoft directly to assume what and why they do things? Or is your entire point of posting antims thoughts only because of a stereotypical "micR0$0fT 1$ ev1L" attitude that gets passed around to people who would rather complain and cry than learn how to make the OS do exactally what they want?

You want security in Windows? Learn how to do it. Want their software to work better? Learn how to use their software. Am I a windows zealot? No, slackware is my primary operating system, but I made sure to spend enough time in multiple OSes so I could understand not only the companies and communities behind them... but so I could make sure I knew what I was talking about when it came down to it.

And that's the best way to go about things...Master the major OSes. Resolve the issue yourself. I'm happy with my XP machine now that I have it secured my way. You can secure an MS box as well as a linux and make a linux box as insecure as an MS one.

But really -- if a new super-Windows came out that was completely invulnerable, what would happen to our careers? ;)

Quote:

---

Like the entire Redhat and Suse staff?

---

Amazing, a whole 2 teams out of how many?! They get some cookie-cutter pay compared to what the closed-source MS employees receive. Talk to Michael Abrash sometime (one of MS's lead game software devs), he'll give you the 4-1-1 on that.

Quote:

---

You want security in Windows? Learn how to do it. Want their software to work better? Learn how to use their software.

---

Learn how to do what? Double-click my way through a complicated gui with buttons, text fields, and listboxes? My XP Pro box is about as secure as it can get... which varies day to day thanks to all the vulns found and posted courtesy of MicroSoft® OS's being flimsy and not well-thought out in terms of actually being "secure" in many aspects. Enabling NetBios over TCP/IP by default... Remote Desktop by default... UPnP by default... filesharing by default... DCOM and RPC services waiting to be exploited -on by default... IE MS-ITS: URL handler vulns (not counting a zillion others + some)... yada yada yada you get the point.

Quote:

---

Am I a windows zealot?

---

Apparently...

Quote:

---

Learn how to do what? Double-click my way through a complicated gui with buttons, text fields, and listboxes? My XP Pro box is about as secure as it can get... which varies day to day thanks to all the vulns found and posted courtesy of MicroSoft® OS's being flimsy and not well-thought out in terms of actually being "secure" in many aspects. Enabling NetBios over TCP/IP by default... Remote Desktop by default... UPnP by default... filesharing by default... DCOM and RPC services waiting to be exploited -on by default... IE MS-ITS: URL handler vulns (not conting a zillion others + some)... yada yada yada you get the point.

---

No, I don't get your point. IF you have problems of security on that level, then it is user error, not OS error. Here's my documented proof:


http://www.antionline.com/showthread...hreadid=255353
http://www.antionline.com/showthread...hreadid=255443
http://www.antionline.com/showthread...hreadid=255266

Quote:

---

Apparently...

---

Right, because having my servers and primary computer run on Linux has to indicate that I've got the coodies for Windows.


This guy isn't worth my time, as it smells like a bad troll here to bash MS and stir things up, looking at his post history.

Your are right Angelic, this is old debate. Poo takes a very serious approach as you can see. The issue I always bring up is the "point and click" argument. That is all most understand of windows. In fact it can be just as raw as linux. The command line is equally if not more powerfull. That's all. And I wouldn't bring Longhorn into the equation. I would now like to beg and gravel for a copy? Poo you listening.... :D From what I have seen of it, and it's still a long way off - like 2006 or so... I am not sure Linux can hold it's water unless it takes a whole new direction in large scale data storage, considering hard drives out pace Moores law. How can it compete with WINFS and it's SQL like file system. Not sure but I am wondering. Before anyone slams me, I have 4 personal linux boxes and only 2 Wnidows. Work is a different story, it's like 50 to 1.

Oh and HAL was not of the 9000 variety. :D Hardware Abstraction Layer.

"I cannot allow that Dave."

Quote:

---

No, I don't get your point. IF you have problems of security on that level, then it is user error, not OS error. Here's my documented proof:

---

ROFL! If thinking that helps you sleep at night....

Quote:

---

Right, because having my servers and primary computer run on Linux has to indicate that I've got the coodies for Windows.

---

You've got a stiffy for gui environments and auto-installations. This didn't need to be reconfirmed. You must really like Windows.

Quote:

---

This guy isn't worth my time, as it smells like a bad troll here to bash MS and stir things up, looking at his post history.

---

Oh I'm sorry your highness, I don't waste my time writing lame tutorials and reviews to 'impress' people on public BBS's. I actually go out and apply my knowledge instead of garnering it all up and expressing it through a rough-draft in notepad.

Yeah I'm a troll. You've got me pegged. Take a look at this thread's "history" since you're such the historian and you'll notice that it was 'A' okay until you accused angelic and myself of "bashing" MS then crying about it cuz you're a beta-tester who's striving to be a MicroSoft Valued Professional. :D Please man, go read some E-Books or something.

After reading this thread, I wondered if I had anything positive to add. Though I'm still not sure, I will attempt to none the less.

Security is certainly not limited to technology. It touches everything from Marketing all the way to politics and law. If you watch the behavior of software vendors, you'll see that not everything is driven by our IT-centric existence.

Without writing a novel, my point is that as long as A) The vendor is improving a product and B) Gives you the *option* to configure a product to meet your needs, there is no reason to bitch. That is what the Vendor's feature request site is for.

He was hardly bashing us, just making a counterpoint. We do that a lot around here, you can't take it personally.

To add to TH's post, C) You can also buy another product, and not even the mighty MS is immune to losing customers to competitors such as Linux distros.

Quote:

---

Without writing a novel, my point is that as long as A) The vendor is improving a product and B) Gives you the *option* to configure a product to meet your needs, there is no reason to bitch. That is what the Vendor's feature request site is for.

---

Point taken. However, in this situation, the configuration (being 'Scope...') of the product (being XP SP2 RC2 SPI FW) doesn't work to suit anyone's needs. As a matter of fact it gives XP SP2 users a false-sense of security to be honest. Had I not tested this certain (broken) feature, and just taken MS's word for it, I could have very well ended up a victim and would have never even suspected anything to be wrong. This thread wasn't supposed to turn out this way, I didn't want it to atleast... but I'll be damned if some kid is going to try and lecture me and then tell me what's up because he thinks that I'm bitching about MS and bashing them too much. He (that MS beta-tester guy) chose to open the thread, read the posts and reply to every one of mine for the most part. His beliefs are off-the-wall and his facts are opinions. It couldn't get much worse than that. Concluding the erratic behavior, this is squashed. I've wasted too much time replying to this dude. He's got tutorials to write and I've got servers to pentest.

Quote:

---

Originally posted here by pooh sun tzu
The real question at hand is "Is the normal public ready for that big of a step?"

Imagine them placing a stateful inbound and outbound firewall that has popups as to program control to the internet (a zone alarm clone). Think of how many people who use the Windows OS are not currently at a level of computer knowledge to deal with what will happen next.

AIM suddenly won't connect. MSN won't transfer files. Not all websites work now. IRC won't work. Video conferencing won't connect. A billion things that involve having a firewall and configuring it to allow certain programs and services, is beyond the reach of what the public is ready to handle.

So, rather than crippling the entire Windows OS userbase, they are little by little teaching them how things work. By showing them the beginnings of security, people will get "used" to that level.. thus allowing MS to add another leve lof security as time goes on so they can get "used" to yet another level of security.. and so forth and so on.

We know they could patch up a firewall to destroy the skills of zonealarm and kerio, so why not? Because they would rather begin the steps towards better security gradually rather than an enourmous drop of it and lose their userbase (in which the people who would know how to deal with it are a very very small minority.)

"A journey of a thousand miles or a thousand days starts with a single step" - Tao Te Ching

---

Not to get back into another one of our glorious "conversations", hehe, but wouldn't what you say mean that it's a complete 180 from what MS has already done, and that's provide "ease of use over stability and security"? Not trying to start anything, but MS has been lax across the board over the years when it comes to security and stability and while I'm extremely glad that they're trying to improve OS stability and security, by no means should that mean that their attempts break 3rd party programs who're inherently better at their single task than MS is, aka Sygate, Outpost, and ZA being better at firewalling.

MS users of today are not going to become "used" to what MS is doing. They want to point-and-click all day, nothing else. Go to any major business, any home, anywhere an internet connection is present and you'll find MSN and/or AOL (or any other major ISP) along with three different IM clients, and various other things that allow the user to do what they want to do, and that's IM, email, and surf the web while burning cds and listen to music.

I, for one, while glad that MS is doing things to make sure security and stability are a major issue to handle, will not tolerate them removing my ability and choice to use a third party program that will do things better than MS. MS' own registry cleaner doesn't do as good a job as others. Their firewall is years behind major vendors like ZA, Sygate, and Outpost, vendors who've spent years perfecting their own code to do one specific thing. By no means is this post meant to serve as a MS-bashing attempt, but they can improve in other areas. Remove the old code, rewrite it to be better, get rid of bloated things like the games in Office, things like that. MS can go a LONG ways to improve a lot of things without worrying about firewalling (as you would know more than me), and I hope they do so.

I want to go to SP2, I really do. But from what I read and what the past record has shown, it seems to be that MS wants to force people to use their products which are inferior in nature to others. They've got the budget, they've got the staff, why not make a superior product and make me, a poweruser of MS products, say "Wow, I really like this!"?

Since I chimed a little on the elimination of 3rd party software.... It doesn't remove your choice, but when faced with: Hmm should I renew my 2 thousand dollar backup program or just use microsoft's. Then I could spend that on something else. Or should I renew an expensive license for ***********, when Active directory does the same thing, built in. Or should I buy defraggers and install them all over the network, or use the one built in. Or should I spend money on deploying remote administration, or click a switch and use the one built in. Should I renew spam filtering or just buy Exchange 2003. Hell I just saved 20k for other projects. That is the point, not from a single user standpoint but from a business percepective. I could go on and on with more real world, real time examples. Is Microsoft business partners turning their cheek and not worrying, no I don't think so. In fact I have seen some pissed off people in various mail listings from those same companies I used in my example. At one time Netscape was years away from Internet Explorer. And at one time there was a company that built basic utilities, one for memory management, one for navgating the hard drive, etc. All gone now.

I have no problem with a business aspect wanting to save money since businesses don't see anything other than the bottom line ever, but I do have a problem when that means using products that aren't as good as any given third party vendor's product.

Give me a reason, whether as a business or individual, to save money and use an integrated tool (which would be costly nonetheless, I don't see IIS coming free with XP or Exchange with the default 2003 server install) and have it be as good as or better than someone else's utility and I'll switch no problems. Don't, and I won't.

Open source and GPL for life!

lol, GNU rules. But here is an example and I am not talking about specialized servers IIS will never be free. Although it once was in an earlier form. It was part of early server packages or at least a web server was. Here I am, my licence is up for backup software I use at the enterprise level. The issue is, I need to backup files, put them on tape, be able to find them and then in the event of data loss, restore them. You can build in all the bells and whistles you want, but that is what I need. Low and behold MS built in a very good backup program that can be controlled and monitored with a little effort. And it backs up Exchange easier and faster than the 3rd party program I have. So there is one. Another is *********** vs. doing the same things in Domain Security Policy. Others are patch management. Hope that helps. :D

On a personal level, not much. I used to use memory tools and TCP.IP tools that are in a box now with a host of other utilities that have been tweaked into the OS. But then again I have a ton of GNU stuff that is wayyy better. I am pretty much just a gamer on a personal level. Oh I did replace a logger with some stuff MS released or added I should say.

No, you guys, that's not what I mean :) The only 3rd party applications SP2 will break are those that break the basic fundamental rules of secure programming.

If a program calls nonspecific memory areas that are shared with another program, they will break. If a program makes calls to APIs which conflict with system security, they will break.

It isn't about MS only products but about the programs not having been coded properly. zonealarm breaks because it's poorley coded, and uses shared memory instead of designating it's own (highly insecure, and the source of most of it's past exploits). Kerio still works, sysgate still works. A lot of 3rd party programs will work because the companies didn't try to take shortcuts. This is why I've been encouraging people to read the white papers rather than listen to the gossip. A lot of rumors are getting spread about the security patches forcing MS only products, when it's the exact opposite. They want to educate those who do want to program for the Windows enviroment that they need to start programming properly.

Don't get me wrong, I'm all for OSS and the GNU. But we can't confuse Windows now forcing security (VERY similar to grsecurity and SELinux kernel patches for nix) with trying to force it's own products. It still encourages 3rd party development by releasing APi information and the likes, but they won't tolerate hazardous coding any longer. Linux did this a few months ago as well, and people understood :) Microsoft is just finally catching up to this feature.

Well, after a while of blaming my computer troubles on MS, I am back to saying I am a Windows fan.

Personally, I would rather have Windows stick to being an operating system, and leave the rest to third party apps. But in reality, that would suck for Microsoft.

If a company blindly installed sp2 on their office's pc's, and all their software lost their connections to the internet, then it's their own fault for not testing it out on a lab pc.

If a company doesn't properly update their machines, and are pummeled by sasser, blaster, then it's their own damn fault.

BUT-
When that office is looking for new servers, and they have the choice between linux servers, and MS servers, they are going to think back on their experience with the sp2 install. They are also going to think about the Sasser / Blaster takeover. Whether the decision maker knows he screwed up the sp2 install and updates or not, the linux option is going to sound pretty good after he hears that linux is invulnerable to these viruses.

So...

Windows is implenting a firewall in sp2 to prevent worms from attacking their machines regardless of the vulnerability (given its not in the firewall) and they are making it in such a way that it won't flood help desks everywhere with "my aim isn't working".

As for the yahoo messenger dealie-
Did you establish the "direct connection" or did they? AIM can handle Direct IM's with a AOL proxy server in its settings, and may be configured automatically with YIM to use a proxy if it can't make the initial connection? A good test for this would be to have a tcpview or netstat run on both machines to check it out.

Regardless, if you know how, get a hardware firewall and be done with it. Let windows be an operating system and let "trusted" third party software handle everything else.

Quote:

---

As for the yahoo messenger dealie-
Did you establish the "direct connection" or did they? AIM can handle Direct IM's with a AOL proxy server in its settings, and may be configured automatically with YIM to use a proxy if it can't make the initial connection? A good test for this would be to have a tcpview or netstat run on both machines to check it out.

Regardless, if you know how, get a hardware firewall and be done with it. Let windows be an operating system and let "trusted" third party software handle everything else.

---

He established it of course.. if I would've initiated that with any SPI FireWall then it would've been allowed through based on how SPI works... including it's use around NAT. Therefore, it would've been the same result everytime and not the firewall's problem. He sent the syn, I sent the syn + ack, he sent the ack... thus becoming 'Established'.

Yahoo! Messenger, which was what I tested around, is rich in P2P functionality so I figured it'd be a good environment to test out the firewall's capabilities. PM's can come through to you directly or indirectly (through the actual msg server that you logged into when signing onto the network). This didn't come from the msg server that I was signed into.. it came directly from his computer... no server at all was acting as the 'middleman'. If it had came through indirectly it wouldn't have been a problem as the msg server's ip address was on the exceptions for the application's "allow list". My friend's ip wasn't on that list.. and therefore shouldn't have been allowed through. We had a connection to each other... my end of the socket having the already listening TCP :5101 open for him to connect to + another random port allocated so multiple requests could be made on each end. He was connected to me @ remote TCP :5101 and I was connected to him @ remote TCP :5101 (both of us having different source ports). Both of our source ports were randomly allocated for the connection locally, in my case it was TCP :8419.

As far as netstat and tcpdump go, I had no use for them. I sniffed the whole session with CommView 4 and watched the 3-way handshake performed right in front of me. The session then followed without any alerts, blocking, disallowances etc. A 'PEERTOPEER' (no i didn't capitalize it, it comes that way) packet from the established PM session that was allowed through SP2's SPI firewall with my scope restrictions set to disallow:

YMSG...../.M....¶“Z*4À€my_friends_idÀ€5À€my_idÀ€13À€5À€49À€PEERTOPEER À€

À€ being the standard YMSG protocol argument separators and the rest is pretty obvious (keep in mind this is just one ASCII dump). I know this protocol very well. There's lots you can do with it. :D

Yeah, I use 3'rd party application-layer firewalls (Sygate Pro & OutPost Pro both off/on) as well as a hw network-layer firewall via my router with SPI + NAT.

Is Nortons Firewall and Antivirus 2004 Good for protection or is there a something better?

Rob4224, neither products are very good. eEye Digital found several vulns last month in their FireWall.. can't remember which ver. specifically though, maybe it applied to them all. http://search.securitytracker.com/cgi-bin/ts.pl

As for Norton's AV. Not very good. Misses a boatload of stuff. Kaspersky and Nod32 AV imo are probably the best suited for a Windows user. I run Nod32 on Win XP Pro and it's got the best track record you can get grabbing it's 27'th straight Virus Bulletin Award for detecting in-the-wild virii. Check it out: http://www.nod32.com/home/home.htm 30 day free trial too.

Rob, there are a KAGILLION threads that cover that topic. Do a search of AO, grab a drink, and get ready for a long read.

Heh heh, now my point;

Quote:

---

AIM suddenly won't connect. MSN won't transfer files. Not all websites work now. IRC won't work. Video conferencing won't connect.

---

And that's a bad thing? ;)

It's like natural selection in the cyberworld, suddenly all the uneducated users can't do jack. Hmm...Mwahahaha, let's do it! :D