Re: Microsoft update asking for security change - SP 2 firewall operation
From: Steve Riley (steriley_at_microsoft.com)
Date: 06/06/04
- Next message: Bill Sanderson: "Re: MAJOR BUG"
- Previous message: Bill Sanderson: "Re: Spybot message:"DSO EXPLOIT: There is a security hole....."
- In reply to: zz: "Re: Microsoft update asking for security change"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sat, 5 Jun 2004 17:44:54 -0700
In XP service pack 2, the firewall is still an inbound-only blocker. It's
default configuration is to block all unsolicited inbound traffic. Allowed
inbound traffic must be a response to something that previously went out.
Depending on the protocol, the characteristics of that allowed traffic will
be different:
* For outbound TCP, inbound replies must come from the target IP address
* For outbound UDP, inbound replies can come from any IP address;
after 90 seconds of inactivity, no inbound replies are permitted
* For outbound broadcast and multicast, replies can come from any IP
on the target's subnet for three seconds
Just like on the original ICF, you can create openings in the firewall to
allow unsolicited inbound traffic for certain things running on the computer
that you want to permit. The old ICF let you open only static ports, and
these ports would remain open as long as the computer was running. The new
firewall still has this functionality, but it also allows you to grant an
application permission to open a port. When you do this, no ports are
initially open. When the application binds to a socket, whatever port the
application requested will be opened in the firewall. When the application
terminates, the port will close.
But do remember: this is for applications that bind to a port in listening
mode. There is no functionality in the new firewall to control, by
application, outbound traffic. All outbound traffic is always permitted.
Steve
steriley@microsoft.com
"zz" <zz@nospam.com> wrote in message
news:zpNuc.17705$eH1.7771363@newssvr28.news.prodigy.com...
> Lady wrote:
>
<snip>
>
> Also, Internet Connection Firewall only prevents unsolicited INCOMING
> packets and does not check OUTGOING packets sent from your system (Service
> Pack 2 will fix this). ICS does not screen for viruses, worms or trojans,
> you need an anti-virus for that. Once a computer is infected a good
> firewall will prevent trojans etc from sending out packets unless you give
> the program permission to send.
- Next message: Bill Sanderson: "Re: MAJOR BUG"
- Previous message: Bill Sanderson: "Re: Spybot message:"DSO EXPLOIT: There is a security hole....."
- In reply to: zz: "Re: Microsoft update asking for security change"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
