New Windows attack can kill firewall - Network World

Skip Links

DNSstuff.com
Get information about your IP
IP Information
50+ On-demand DNS and network tools

Security

Videos

rssRss Feed
Get instant email notification when white papers, webcasts, executive guides are added to our library.  Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.
Audio

Crackin' the Kraken bot. Listen now!

Network World's Newsmaker of the Week

Wireless dangers at airports. Listen now!

Network World Panorama

Additional Resources

RSS

FEATURED WHITEPAPERS

Fill the Gaps in Your Disaster Recovery Plan with Single Object Recovery for Active Directory NetPro

Most companies have a solid disaster recovery plan in place to handle a "complete failure" of its Active Directory, which is really quite rare. What most recovery plans are missing, and the most common scenario, is a means to efficiently restore single directory objects. In this paper, we'll explore what most disaster recovery plans already address, highlight potential weak points, and suggest solutions that help fill those gaps-without requiring you to completely re-do your existing plan.

RSS

FEATURED REPORTS

Executive Guide: Storage Heats Up HP

Get the latest on storage technologies that allow IT professionals to better cope with new IT demands. Learn how storage technologies can help you successfully tackle e-Discover, regulatory compliance, green data center initiatives and the data explosion. Get all the details now.

RSS

FEATURED WEBCASTS

Discover how to Create an Orchestrated Data Center through Virtualization Novell

IT professionals like the idea of consolidating hundreds of servers into only a few, but it takes a lot more to cost effectively consolidate and virtualize servers. Watch this six-chapter webcast, "Reduce Complexity and Cost - Windows Server Consolidation with Virtualization" to learn how to effectively consolidate your Windows environment. One of the themes explored includes the characteristics of an orchestrated data center, which includes: Resource management, dynamic provisioning, job management, policy management, accounting and auditing and real-time availability. Learn more about orchestration and much more today. Register below to learn more and be entered to win an Archos 605 Portable Media Player.

IT Buyer's Guides

View All Buyer's Guides

Free Newsletters

Sign up and receive the latest news, reviews and trends on your favorite technology topics

Save The Date!
What They Are Saying

You can find related project managemen articles in - Anonymous

Join the Discussion

New Windows attack can kill firewall

By Robert McMillan , IDG News Service , 10/30/2006
  • Social Web 
  • Email 
  • Feedback 
  • Close

Hackers have published code that could let an attacker disable the Windows Firewall on certain Windows XP machines.

The code, which was posted on the Internet early Sunday morning, could be used to disable the Windows Firewall on a fully patched Windows XP PC that was running Windows' Internet Connection Service (ICS). This service allows Windows users to essentially turn their PC into a router and share their Internet connection with other computers on the local area network (LAN.) It is typically used by home and small-business users.

The attacker could send a malicious data packet to another PC using ICS that would cause the service to terminate. Because this service is connected to the Windows firewall, this packet would also cause the firewall to stop working, said Tyler Reguly, a research engineer at nCircle Network Security Inc., who has blogged about the issue.

"Once the firewall is down, where's your line of defense?" he said Monday, in an interview.

By knocking off the Windows Firewall, a criminal could open the door to new types of attacks, but there are a number of factors that make such an attack scenario unlikely, Reguly said.

For example, the attacker would have to be within the LAN in order to make the attack work, and, of course, it would only work on systems using ICS, which is disabled by default. Furthermore, the attack would have no effect on any third-party firewall being used by the PC, Reguly said.

Users can avoid the attack by disabling ICS, Reguly said. But this will also kill the shared Internet connection.

An easier solution, may be for ICS users to simply move their networks onto a router or NAT (Network Address Translation) device, said Stefano Zanero, chief technology officer with Secure Network SRL. "They are so cheap right now, and in many cases they offer better protection and a easier administration of your LAN," he said via instant message.

Windows XP appears to be the only platform affected by this attack, which has not been successfully reproduced on Windows Server 2003, Reguly said.

1 | 2 |  Next >
Comments (2)
Login
Forgot your account info?

FIREWALL AFFECTEDBy Younes on September 1, 2007, 10:08 amHi, I experienced the same problem, the firewall of my windows xp was disabled. This occurs when i start up my computer. To tell you the truth, the firewall of...

Reply | Read entire comment

New Windows attack can kill firewallBy Anonymous on March 7, 2007, 12:55 pm14 Feb 07, I experienced such an attack that posed as a Microsoft Security via Dr Watson informing that I was infected by Backdoor PCK Trojan, it knocked down Nortons...

Reply | Read entire comment

View all comments

Add comment
Anonymous comments subject to moderator approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.
First Name
Last Name
E-mail
Zip Code