Neowin.net - Microsoft takes down barrier in Vista firewall

Microsoft takes down barrier in Vista firewall

Posted by Dice on 28 April 2006 - 02:18 · 48 comments & 27573 views

The Window's release of Vista early next year will have an updated firewall that looks at incoming and outgoing traffic, said the company. This updated firewall checks outgoing traffic in contrast to XP service pack 2, which only checks incoming traffic.

"Because the nature of an outbound firewall is to restrict the traffic sent to specific ports, the outgoing access in the Windows Vista firewall is open by default," a representative for the software maker told ZDNet Australia. "The reason for this is Microsoft has received strong feedback from its customers, especially from large organizations and government departments, saying that they would like to manage this feature from an administrator level."

Configuring the Vista firewall to stop outgoing connections made by rogue applications and malicious software will require a varying degree of technical knowledge, depending on each user's security requirements, Microsoft said.

Firewall specialist Zone Labs said that people will require a "fairly high level of sophistication" in order to properly configure the Vista firewall. For consumers, the company said the task will be nothing less than "challenging."

News source: CNet
"Outbound protection requires a fairly high level of sophistication to engage, and reports indicate that Microsoft expects that functionality to be used by IT professionals in a business-networking environment," Laura Yecies, general manager at Zone Labs, said.

Security specialist Michael Warrilow, director of Sydney-based analyst firm Hydrasight, believes that Microsoft has found it too difficult to create an all-encompassing firewall. However, he said that by not putting the capabilities of the firewall into full play, the company is not ignoring its nontechnical customer base.

"In effect, Microsoft is putting outbound (protection) in the 'too hard' basket for the time being," Warrilow said. "The firewall is to protect against inbound attacks--instead of protecting the rest of the world from you."

Vista's firewall is just one layer of security in the new operating system, according to Microsoft. "New features such as User Account Control, Windows Defender, and Internet Explorer Protected Mode, along with improvements to Windows Firewall and Windows Update, work together to help shield Windows Vista PCs from malware," or malicious software, the company's representative said.

Hide additional information

About the Author
Full name: Unknown
Forum name: vet

Dice
Contact: via forum PM
Submissions: Normal · Headline

Total votes: 0

Bookmark on del.icio.us

Advertisement

(3 replies) #1 Posted by Sam FT on 28 Apr 2006 - 02:51: I wish they would change XP to check outgoing as well.

(1 reply) #2 Posted by JadeWolf324 on 28 Apr 2006 - 02:59: well then maybe the consumer needs to be a tad more educated about using their computer beforehand...its not nearly as hard as driving a car or filing your taxes...come on now..

#3 Posted by qdave on 28 Apr 2006 - 03:27: probably cool. still organisations have people to do that sort of things.

(2 replies) #4 Posted by ZTrang on 28 Apr 2006 - 03:29: Not to be a "this is old news!" freak, but wasn't this already posted as news - on the front page, no less - a short while ago?

(1 reply) #5 Posted by Sam FT on 28 Apr 2006 - 03:35: I do internet tech support, then you should talk and listen to our customers then you will see why I would like to see outgoing firewall in XP. But yes I agree with you...about the taxes and driving a car.

(2 replies) #6 Posted by dhan on 28 Apr 2006 - 04:05: This is Bad, very bad. Enterprise customers already have easy way to control using group policy. Why screw home users for this ?
(Personally I never used/needed a firewall, always kept it off)

(1 reply) #7 Posted by Mike Frett on 28 Apr 2006 - 04:14: Any of you know if you can turn it off? I have a hardware firewall and would not like to be bothered with this.

#8 Posted by Nidonocu on 28 Apr 2006 - 04:49: Of course you can turn it off. And if Microsoft put in an 'easy' firewall program in the base O/S, a billion and one Firewall companies would sue them for unfairness. Silly really if you think that its Microsoft's holes that keep them in business.

(2 replies) #9 Posted by Fubar on 28 Apr 2006 - 07:04: well lets hope they try , although i doubt vista will be popular with alot of people considering it will make dual booting fustrating with btilocker , the more and more i read about vista the less and less i want to get it

(2 replies) #10 Posted by Jugalator on 28 Apr 2006 - 07:31: OK, I can understand the default, although permitting any outbound traffic in a firewall isn't something a user should strive for.

However, what I don't understand is why this process will be less than trivial (according to this article). Shouldn't it just be a checkbox; if on to block, you start getting "outgoing traffic" dialog boxes letting you create rules or just allow for that time, and if off to disable, just ignore any blacklists you've built and never show any dialogs, allowing everything outgoing.

#11 Posted by Peter McGrath on 28 Apr 2006 - 07:53: as long as there is a checkbox that says "stop blocking connections AND never ask me again" I'll be happy

(4 replies) #12 Posted by Daninku on 28 Apr 2006 - 08:20: I can see Microsoft buying Zone Labs in the future.

(2 replies) #13 Posted by ahhell on 28 Apr 2006 - 10:50: Big deal. Who cares about outbound traffic?
It's the inbound traffic that you have to worry about.

(1 reply) #14 Posted by cork1958 on 28 Apr 2006 - 12:34: I think it should be turned on by default. That way, at least when it pops up it's first warning, a user will have to at least LOOK at what it is. If not turned on by default, joe blow user will never even know it exists!

Hasn't MS learned from these kind of dumb mistakes yet?

#15 Posted by sphbecker on 28 Apr 2006 - 13:25: In some ways I like the idea of a two-way firewall, but its really not a big deal to me (its interesting to see what random apps try to "call home" ).

I do have one concern with the safety of two-way firewalls. Let’s say you start using a program, junk.exe, and junk.exe tries to use the internet. My two-way firewall alerts me and asks if I want to allow access. I know that junk.exe needs to check for updates so I say I want to allow it access to the internet. Everything is fine so far, but here is my issue. The firewall now has an acceptation saying that junk.exe traffic can go through the firewall. The problem is that junk.exe really is junk and it opens listening ports which make my computer valuable. With a one-way firewall junk.exe would not have needed an acceptation and inbound would have still been blocked; with the two-way I need to grant it access to get out, but doing so also allows inbound to that app.

Perhaps some firewalls already work this way, but I would like to see two different prompts. One asking if a process can use the network/internet connection and another with a strongly worded warning message asking if you want to allow the process to open listening ports and allow other computers from the internet to connect to your computer. The second prompt should also allow you to choose between “All computers including those from the internet” and “only computers on my local subnet.”

I know that you can manually set this up, but the prompts are the key. The way in which the firewall can setup its self needs to follow good practices. IE, getting out to the internet isn't that big of a deal, but allowing listening ports requires direct user authority.

#16 Posted by P1R4T3 on 28 Apr 2006 - 13:55: Now the EU will have a new reason to complain.

#17 Posted by fpd on 28 Apr 2006 - 16:38: How will this be any more difficult than zonealarm?

#18 Posted by TwoTailedFox on 28 Apr 2006 - 19:26: As long as I can turn it off, I don't care.

#19 Posted by RangerLG on 28 Apr 2006 - 20:06: There's a shock. ZoneLabs trashing another company's firewall.

(1 reply) #20 Posted by Coolme on 28 Apr 2006 - 21:46: Quote -
then that would be like stripping out another feature of vista.

Let me ask you a question, what is considered a 'feature' of vista? Is a program that adds security to the OS, which should be a free update to exsiting windows users considered to be a feature? I think not. I think a new 'feature' in an OS should not be something that patches or makes it more secure, instead it should be something like faster searching, virtual folders.... new and innovative programs and ways of doing things. Continual security related updates for an OS should never comes across as a premium.

#21 Posted by TickleOnTheTum on 28 Apr 2006 - 22:16: I think this is a great idea, and ZoneLabs, as RangerLG says, are just upset that it may decrease their sales. It's hardly surprising that they'd kick up a fuss but it is a little childish.

#22 Posted by Xavien on 29 Apr 2006 - 06:19: in the end, hardware firewalls are pretty much the best out there and dont drain your computers resources and you only need one for the entire network. I have one, so quite frankly i dont care about vista's little firewall and ill be turning it off...

if i ever get vista that is (unless games come out that require DirectX 10/Vista im not switching for a long while)

(1 reply) #23 Posted by Angel Blue01 on 29 Apr 2006 - 12:42: I look foward to not having to install a third-party firewall

#24 Posted by shirike on 30 Apr 2006 - 07:55: I think Microsoft need to take a different approach to their attempts at user-friendliness and stop relying so heavily on pop-ups.

Although, part of me also wishes Microsoft was as technically-challenging as Linux because I've learned so much from using Linux.

#25 Posted by tom5 on 30 Apr 2006 - 07:56: "The reason for this is Microsoft has received strong feedback from its customers, especially from large organizations and government departments, saying that they would like to manage this feature from an administrator level."

<LOL>

They should better say: "Microsoft has received strong feedback from its customers, especially from large organizations and government departments, saying that they wouldn't be able to SPY ON YOU anymore"

[1]

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Scroll to the Top