New Windows attack can kill firewall

Infoworld ^ | 30 October 2006 | Robert McMillan

[Echo Talon]

The code, which was posted on the Internet early Sunday morning, could be used to disable the Windows Firewall

Who uses Windows Firewall?

[KoRn]

This will bring down an XP firewall remotely:

'

---

Start

Set objFirewall = CreateObject("HNetCfg.FwMgr")
Set objPolicy = objFirewall.LocalPolicy.CurrentProfile

objPolicy.FirewallEnabled = FALSE

'

---

End



Of course you have to know the local administrative credentials, which are all too often easy to guess, if there are any at all on a home Windows PC.

[Centurion2000]

80 buck for relative peace of mind on the home computer is ok by me. Of course hardening the PC itself is important as well.

But I see your point.

[observer5]

Please don't encourage any Windows PC users to switch to a secure and modern OS, such as OSX.

The natural law of survival of the fittest and extinction of the inept must be kept intact.

[ShadowAce]

Uh Oh. Now our RT will call you out on posting exploit code.... :)

[Centurion2000]

While they're usually better than the Windows firewall, they still consist of just software

Don't forget that ASIC and FPGA's are hardware ... crap ... even those have some kind of software.

[tubebender]

Don't do that!!! I had to look to see if mine was still back there...

[HoosierHawk]

I've used the Tiny Personal Firewall for years; from Window NT to Window XP Pro.

I wouldn't be without it.

[dennisw]

Hahaha
I have a hardware firewall in my router, I use WindowsXP's firewall and I use Zone Alarm firewall. I use SpyWare Blaster which sort of locks down your computer in advance of assaults. Also Windows Defender and McAfee anti virus. Also AVG anti virus. Some of these are run only when I remember to. Once a week or so.

[KoRn]

"Uh Oh. Now our RT will call you out on posting exploit code.... :)"

ROFL! I was just about to post another script to open a remote shell on the windows machine after you get the firewall down! :p

PS: I doubt anyone could kill IPTables in such a way =)

[CedarDave]

How do I check if ICS is active and if so, how do I disable it?

[stylin_geek]

Yeah, but how many high speed internet providers supply decent hardware to non technical end users? I've been in too many homes and been appalled by junk provided by the internet provider.

Although, I recently went DSL and SBC provided me with a great router/firewall.

[Echo Talon]

[dennisw]

.

[ShadowAce]

How do I check if ICS is active and if so, how do I disable it?

Essentially, ICS is used when one computer on a network is the computer that actually has Internet access--usually over a modem.

ICS is used by that computer to share it's internet access with other computers on the network. It's usually used by dial-up accounts.

If you do not have your home computers set up in the above configuration, don't worry about it.

[mgstarr]

I'm amused by sheeple who willingly choose Windows when there are far better choices out there.

[TommyDale]

Anyone dependent on the Microsoft firewall is just asking for trouble anyway.

I am amazed how many people I know who don't even back up their hard drive on a regular basis.

[Clara Lou]

LOL--who in the world trusts their computer to the Windows firewall? Way too funny!!

[taxed2death]

mepis

[zeugma]

In the past there have been exploits against IPTables, but it is darned solid code these days.

One of the more interesting hacks I've seen on locking down a Linux-based firewall is to remove the 'poweroff' from your shutdown sequence. You basically boot the PC up, set up your firewall =exactly= as you want it, then "shutdown".

However, without the poweroff, you'll basically end up with a box that has all services turned off, and the disks unmounted. The only thing running is the kernel ... and iptables, which runs as a kernel process! The thing will be as close to not running as possible, but would still be passing packets. Of course, if you need to make a change to your rules, you have to physically power off and reboot, then make your changes and 'shutdown' again. This makes this more of an interesting hack than something actually useful, but I thought it was cool. Of course, you also don't want your init scripts to kill your ethernet while it's killing other processes as well.