Security Failures of the built-in Windows Firewall

A good firewall should monitor inbound AND outbound connections for malicious threats. I expect a firewall to stop malware before it connects to my system AND protect my personal information by stopping outbound connections from being established. Maybe I have unusually high expectations when it comes to my security online, while that may be true; Microsoft is light-years away from meeting my expectations.

The saying “you get what you pay for” seems to be true in the case of the free Windows Firewall. Microsoft’s Firewall is a part of the security features available within Windows Vista and Windows XP SP2. Millions of PC users rely on the Windows Firewall for protection against malicious viruses and hackers. While monitoring inbound connections for malicious attacks, the Microsoft Firewall may be reliable, but that’s where the reliability with this firewall ends.

Not all malware makes its way onto a system via internet connections. Malware can be installed on a computer system via DVD’s, CD’s, USB connections, software installations and other sources making it necessary for a reliable firewall that monitors outgoing connections at all times.

The Windows Firewall is set to a default setting to allow all outbound connections, pretty much letting cyber thieves broadcast out the user’s personal data or use the machine as a part of a larger botnet, if not just relay spam through the machine. Most home users are unaware that the Windows Firewall is allowing an open, outbound connection because the default settings recommend “allowing connections except when excepted”. As confusing as that statement is, this may seem ok until you realize in the default configuration, there are no outbound ‘block’ rules, only allow rules. In other words, even though the Windows Firewall outbound protection is on, it is not doing anything.

Relying on Windows Firewall is dangerous, but the regrettable truth is most home users will never realize what a complete failure the Windows Firewall is and how it is leaving them open to an attack.

For a firewall that will protect you from malware, monitor inbound AND outbound connections, try the Sunbelt Personal Firewall.

Networking with Strangers – A Social Disaster

Reasons why people accept friend request or follow people they don’t know on social networking communities:

– Just like in high school, Some people are looking for popularity

– Keeping up with the latest buzz across the interwebs

– Potentially finding Mr. or Mrs. Right.

– Easily getting a huge list of people on social networking communities for future spamming. Woot!

Reasons why people shouldn’t accept friend requests or follow people they don’t know on social networking communities:

Cyber Creeps - Underestimating the threat of an online stranger can be harmful. Cyber creeps can harass you not only online, but in person. 90% of the time people online use their real names and their location where they live or work, whether it is state or city. With those two pieces of information, anybody can do a simple google search about you.

Social Networking Buzz Can Sting – The latest buzz across social networking communities usually has some form of malware attached, your real friends would never intentionally send you malware, but a stranger wouldn’t be reluctant. Be aware of the strong possiblity that your computer could become infected with malware with just one click on a link from a stranger you’re following in Twitter.

Spam, Spam and more Spam – There are federal laws to help reduce the volume of spam you receive in your emails, but, there are no federal laws against spamming your Myspace inbox. It’s open to everyone. Online marketers and spammers are crowding the social networking communities, creating fake profiles, adding as many friends a possible and turning on the spam faucet and letting it flow.

Identity Theft – Posting personal information online is not only dangerous, it is reckless. Your name, age and city is enough information for a cyber thief to make off with your identity and you would never be the wiser… until you tried to get a loan or you ran your credit report.

Phishing Scams – Have you ever gotten one of those e-mails about how your “long-lost relative” in Timbuktu left you millions of dollars? These sorts of scams are very prevalent on social media and some are more deceiving than the above example. They can often look like official messaging from the social network whether it’s Myspace, Facebook, eBay or even Google. If you keep your profile setting to private you can often avoid these phishing scams from entering your inbox.

The April Fool’s Day Scare –Y2Conficker

Since 2003, one of the most common PC infections, Conficker or Downup, is responsible for over 9 million system contaminations. The necessity to quarantine the Conficker infection caused the grounding of the French Navy’s air fleet this past January. Conficker, or Downup, is no laughing matter. The UK Ministry of Defense, the Federal Republic of Germany and the British Director of Parliamentary are just a few of the government computer systems which have been infected by the worm.

As April neared, we were all prepared for the worst, with Conficker warnings that the worm would infect millions of systems as a very nasty April Fool’s Day hoax.

A modern day Y2K panic erupted, but rather than storing food and water supplies there was a mad rush to purchase antispyware and antivirus software, update windows patches and install firewalls. As we braced ourselves for this technical disaster…nothing happened.

And thank heavens, but what now?

An Old Dog Playing New Tricks

One nasty thing that PC users often face, that has been around for a while, is rogue antispyware. It basically has one goal – to rip you off and in the process make the authors a lot of money.

This is the way it usually operates:

1. It will infect PCs by using Trojans, browser security loopholes, deceptive ads and other tricky scams.

2. It will intimidate the PC user with fake security pop-up warnings, system scans, browser redirects, system tray warnings and many other methods to lead the user to believing their PC is badly infected.

3. It will often trick you into buying the full version of the malicious software in an effort to clean your PC and completely ripping you off because what you just bought was useless.

Unfortunately, as as PCMag and BleepingComputer stated earlier this week, rogue antispyware is sinking even lower:

http://blogs.pcmag.com/securitywatch/2009/02/new_rogue_anti-malware_pushes_fake_pcmag_review.php

The rogue authors have a new scam to keep you from removing the rogue antispyware from your PC. Here’s how it works:

The rogue software changes the HOSTS file when it infects a PC which makes users unable to go to legitimate security sites in order to remove the rogue. This means if you were trying to visit sunbeltsoftware.com to download the most recent version of VIPRE to get rid of a rogue infection, you would be prevented from visiting the website and instead you’d be sent to a rogue website.

The even scarier part is that these criminals are now making sites which look almost identical to respectable product review sites like PCMag.com, but have fake reviews of their rogue product on the fake review site to deceive you into thinking it is a legitimate and effective product. The authors of these fake sites and rogue software even go so far as to post actual product reviews for well reputed software written by well known software review editors, but they switch out the product title with the title of their rogue creation.

Pretty tricky huh?! It’s amazing how much energy they are devoting to scam PC users. You wouldn’t think their trickery would work but it’s surprising how often it does.

My recommendation to avoiding this is to always keep your computer protected with Antivirus/Antispyware software and a good firewall. And beware!