Cable Forum - View Single Post - Merged: Windows XP SP2

mart44 · 12-05-2004, 08:31

Regarding the new SP2 firewall, I have read articles saying that it blocks outgoing information, yet Microsoft's own description of it doesn't say it does. Microsoft page. The relevant part being: 'Windows Firewall is a stateful host-based firewall that discards unsolicited incoming traffic'. It doesn't mention anything about blocking outgoing information.

True that permissions can be configured in the new firewall to allow or disallow some services access to the Net, but what if something nasty did get onto the computer (perhaps via script on a web page)? Would the new firewall block any information it might send out to goodness knows where? It seems to me that it wouldn't.

I notice that one of the changes made by SP2 is to prevent script from being run on IE unless you specifically give it permission to do so. Perhaps this is to do with stopping the possibility of attack occurring from that direction and because the firewall won't block anything from getting out if something nasty does get in.

It seems to me that people relying on the new firewall for protection, while using a browser that allows scripts, could perhaps be vulnerable to things getting onto the computer, which might then result in information being sent out through the firewall.

For instance: The first thing I noticed after installing SP2 was that my own homepage bought up a notice at the top of the page saying: 'This page has been restricted from running active content that might be able to access your computer. If you trust this page, click here to allow it access on your computer'. The reason for this message was because the page contained a mouseover script. On the grounds that any page triggering this warning would scare visitors away, the script has now been taken out.

Firefox produces no such warning and just runs the mouseover script. Presumably this could mean that if anything did get in via script, I'd be left somewhat vulnerable by the new firewall. Even though Firefox is reputed to be a browser not so prone to security breaches, I don't feel inclined to rely on the new firewall if info can pass out through it.

I ran the SP2 firewall for a while and the only time I was asked if a program could access the Net was when I opened my web editor. This has a file uploader included so it needs access. Other than that nothing has asked. When running ZoneAlarm, a whole lot of programs on my computer ask for access. So, I can only assume that the new Windows firewall not asking permissions for the same programs means that it is allowing two-way communications without any input from me...and would do so for anything. If everyone else is getting asked permissions for everything (as per ZoneAlarm), then maybe there's something wrong with my installation of the firewall.

If this is the norm though, then I don't see the new firewall is any better than the original version other than it having the feature of being switched on by default.

Thoughts?

12-05-2004, 08:31	#99
mart44 Inactive Join Date: Jan 2004 Location: South of England Posts: 253	Re: [Merged] Windows XP SP2 Regarding the new SP2 firewall, I have read articles saying that it blocks outgoing information, yet Microsoft's own description of it doesn't say it does. Microsoft page. The relevant part being: 'Windows Firewall is a stateful host-based firewall that discards unsolicited incoming traffic'. It doesn't mention anything about blocking outgoing information. True that permissions can be configured in the new firewall to allow or disallow some services access to the Net, but what if something nasty did get onto the computer (perhaps via script on a web page)? Would the new firewall block any information it might send out to goodness knows where? It seems to me that it wouldn't. I notice that one of the changes made by SP2 is to prevent script from being run on IE unless you specifically give it permission to do so. Perhaps this is to do with stopping the possibility of attack occurring from that direction and because the firewall won't block anything from getting out if something nasty does get in. It seems to me that people relying on the new firewall for protection, while using a browser that allows scripts, could perhaps be vulnerable to things getting onto the computer, which might then result in information being sent out through the firewall. For instance: The first thing I noticed after installing SP2 was that my own homepage bought up a notice at the top of the page saying: 'This page has been restricted from running active content that might be able to access your computer. If you trust this page, click here to allow it access on your computer'. The reason for this message was because the page contained a mouseover script. On the grounds that any page triggering this warning would scare visitors away, the script has now been taken out. Firefox produces no such warning and just runs the mouseover script. Presumably this could mean that if anything did get in via script, I'd be left somewhat vulnerable by the new firewall. Even though Firefox is reputed to be a browser not so prone to security breaches, I don't feel inclined to rely on the new firewall if info can pass out through it. I ran the SP2 firewall for a while and the only time I was asked if a program could access the Net was when I opened my web editor. This has a file uploader included so it needs access. Other than that nothing has asked. When running ZoneAlarm, a whole lot of programs on my computer ask for access. So, I can only assume that the new Windows firewall not asking permissions for the same programs means that it is allowing two-way communications without any input from me...and would do so for anything. If everyone else is getting asked permissions for everything (as per ZoneAlarm), then maybe there's something wrong with my installation of the firewall. If this is the norm though, then I don't see the new firewall is any better than the original version other than it having the feature of being switched on by default. Thoughts?