Does Your Personal Firewall Leak? Does It Really Matter?
- 8
- Add a Comment
Steve Gibson, author of the best disk recovery and maintenance utility on the planet, Spinrite, developer of the first anti-spyware program, OptOut, and recipient of the People’s Choice Podcast Awards in the Science/Technology category for his Security Now! podcast with Leo Laporte of Twit, wrote the first firewall “leak test.” It has been downloaded 6,715,096 times and continues to be the most downloaded application on his site.
What’s the point? Why should you care what’s going out from your PC? Steve says:
… the real point of personal firewalls… the reason that people still install additional firewalls, even when they’ve got, for example, XP’s firewall built in, is they want to know who is sending data out. They want control over which applications are being permitted to use their Internet connection. And you can argue that that’s a really useful thing.
The problem is, it’s not that useful if you’ve already been infected with malware beyond letting you know that you’ve been infected. And if you’ve been infected, you can’t trust your machine again anyway. Sunbelt Software, purveyor of the Kerio Personal Firewall has this to say:
The key assumption of “leak testing” — namely, that it is somehow useful to measure the outbound protection provided by personal firewalls in cases where malware has already executed on the test box — strikes us as a questionable basis on which to build a security assessment. Today’s malware is so malicious and cleverly designed that it is often safest to regard PCs as so thoroughly compromised that nothing on the box can be trusted once the malware executes. In short, “leak testing” starts after the game is already lost, as the malware has already gotten past the inbound firewall protection.
The real purpose of a firewall is to keep bad stuff from getting onto your machine in the first place. If some malware has made it past your inbound protection, does it really matter if your firewall prevents that malware from accessing the Internet? You’ve already been compromised. Time to format your hard drive and reinstall your OS…
Steve Gibson makes a good point:
… hackers are using everything at their disposal to… get into people’s machines by having… themselves invited into the machines [see my article How to Secure Your Computer: Maxim #1]. And once there… there are ways around outbound [blocking] through every firewall, which is not to say having a firewall there that’s doing the best job it can is still not better protection than none at all.
I don’t use a personal firewall. I keep Windows firewall turned off. I use a firewall appliance that is locked down about as hard as it can be and I don’t originate connections to any sites that I don’t trust.
So, use a personal firewall if you will, but realize that if malware is trying to make a connection to the Internet and your personal firewall informs you of the fact, it’s already too late.
Cheers!
The Geek
Have a question? It can be about anything from cooking to science, whatever you’re interested in: Click here to Ask the Geek! Kenny “The Geek” Harthun has been playing with geeky stuff since 1965. He’s a Microsoft Certified Systems Engineer with Connective Computing, Inc. and loves to learn about anything and everything.
Tags: security, firewall, malware, firewall leak test
8 Comments
shausha
August 22nd, 2007
at 1:44pm
Of course this is presuming that everyone is as able as yourself in being able to setup a secure firewall appliance and secondly that everyone can afford one (and I do realise this could be smoothwall on an old PC) or even wants an additional piece of hardware running.
As to are leak tests valid - well yes they are but they aren’t the be all and end all of proving if your system is safe. For my part I do run a ‘personal’ firewall because I want to know which piece of software is trying to talk home and you’d be surprised at how many so called legitimate apps do that.
More importantly, I think, is that we the experts are always telling folks do this, don’t do that but we tell them so much it becomes nigh on impossible to remember what it was they were told. In the end, it is easier for the average Joe/Jane user to just install a known good personal firewall and still practice safe surfing to the best of their ability knowing a mistake will be caught.
Michael Robinson
August 22nd, 2007
at 7:29pm
You deleted a valid criticism of incorrect attribution?
:|
I’ll uh…go ahead and unsubscribe.
Dingo
August 23rd, 2007
at 5:29am
Something on the machine sending stuff to the ‘net may not matter to Americans, but then you live in the land of the ‘free’, along with a few less complimentary titles.
In Australia if your machine is spewing garbage onto the ‘net it is YOU the owner of that machine who is individually and personally liable for prosecution and possible damages claims. Doesn’t matter which a**hole originated that bit of malware or why.
So GOOD personal security software makes good sense - at least you get to know real quick some s.o.b. has compromised that flash bit of hardware and you can shut it down.
kiko
August 23rd, 2007
at 7:01pm
this is a rehash of a posting on the matousec site (firewallleaktest.com) of a reply from the makers of Kerio to them…one would think that the writers would at least glance at the cartoons at the bottom of the lockergnome feed….lol
kiko
August 23rd, 2007
at 7:11pm
also - good point Dingo - it might be too late for your own machine but not too late for everyone else to suffer from it - pretty soon he won’t be using antivirus either cause “they’s just fools who gets virii”…and they pretty soon he won’t be using Windows at all…lol
kiko
August 23rd, 2007
at 7:28pm
you are correct Michael - writer deletes all criticisms-rgardless..waste of time here folks
I-user
August 26th, 2007
at 3:45pm
Let’s hear it for good ol’ typewriters…Hip Hip Hooray…Hip Hip Hooray!!
Grannar Olice
August 27th, 2007
at 6:31pm
And Kerio [Sunbelt] ranks very low in leak testing.
The argument is spurious, saying that every thing which gets in and wants out is too smart to be prevented or detected by any firewall. There is all sorts of stuff out there of varying sophistication. Even with firewalls and antimalwares, people download or click on all sorts of things, or applications have vulnerabilities. If an outgoing is caught by the firewall and you are then alert enough to investigate it, you might remove some malware and prove the virtue of the firewall. This has happened to me. Something got by my firewall, antiviral, and limited user, I could not see an extra process or install, so I got an antimalware scan [don’t mean the Micro$oft product] and it found and offered to remove the offender.
Also, outgoing scanning shows you who wants to talk to whom and control that, and that in itself is a valuable part of your learning and computer management.
Each layer contributes something to the security, so if you can afford the resources, go ahead with an outgoing firewall.
OTOH, if you don’t want to have to make decisions and think about things [most of which will likely be false positives] I can see the virtue in the argument presented here.
To each his own, and a belt to Sunbelt, IMO.