Zone Labs' glee at hobbled Vista firewall

Zone Labs' glee at hobbled Vista firewall

Summary: A correction was made to this story. Read below for details.

SHARE:
A correction was made to this story. Read below for details.
The firewall built into Vista may be better than the one supplied with Windows XP but by default, it will not automatically block outgoing traffic, which is great news for security software vendor ZoneLabs.

When Microsoft updated Windows XP with Service Pack 2 (SP2) in August 2004, for the first time Windows included a firewall that was switched on by default. In Windows Vista, the firewall will be capable of blocking both outgoing and incoming traffic but Microsoft has not explained why the outgoing function will, by default, be inactive.

According to Microsoft, Vista is able to protect against incoming attacks but users will have to "selectively configure the firewall" to stop unauthorised applications from connecting to the Internet.

Michael Warrilow, director of Sydney-based security consultancy Hydrasight, told ZDNet Australia that one reason could be that predicting the behaviour of applications is very difficult.

"The firewall is to protect against inbound attacks -- instead of protecting the rest of the world from you. Also, the behaviour of applications is more difficult to predict for outbound traffic," he said.

One company that is rather pleased about Microsoft's decision is Zone Labs, which is probably best known for its ZoneAlarm firewall application.

During a short visit to Sydney last week, the general manager of Zone Labs, Laura Yecies, told ZDNet Australia that Vista's firewall is better than the one supplied with Windows XP but it will lack some key features that come as standard on the free version of ZoneAlarm.

"It is not final but [the Vista firewall] certainly doesn't have the behavioural capabilities [of ZoneAlarm]... It does have the outbound [blocking] capability but that is off by default," said Yecies.

Zone Labs is looking forward to Vista's arrival because it is likely to further boost sales of the company's firewall products, which is what Yecies said happened when Microsoft launched SP2 for Windows XP.

"There was a lot of attention for SP2, which put more attention on firewalls and most [press coverage] said that SP2 is better -- but really they made the point that you need a good firewall and if you are looking for a good firewall then ZoneAlarm is even better -- so we had an increase in sales," said Yecies.

Overall, Yecies believes that Zone Labs customers will be better off once Microsoft launches Vista because that will increase the overall level of security: "I am glad they are making their system better. My customers will be more secure if the average Microsoft customer has better security on their system -- because they will be less likely to be a bot."

Years behind the specialists?
ZoneLabs is two or three years ahead of Microsoft in terms of firewall technology, according to Yecies, which is a statement not disputed by Hydrasight's Warrilow.

"A whole lot of the IT industries' business model is to stay one step ahead of Microsoft or they are out of the game. They need to keep ahead or people will go with Microsoft," said Warrilow.

Yecies said that when Vista is released, Microsoft will still be at least a couple of years behind: "It is impossible to predict with certainty but what we are seeing in the beta [of Vista] is the firewall is again better -- but [Microsoft] will be about where we were two, maybe three years ago".

 
Correction: This story incorrectly reported that Windows XP with Service Pack 2 includes a firewall that protects users from both incoming and outgoing threats. It only protects against incoming threats.

Topics: Government, Microsoft, Security, PCs, Windows

Munir Kotadia

About Munir Kotadia

Munir first became involved with online publishing in 1998 when he joined ZDNet UK and later moved into print publishing as Chief Reporter for IT Week, part of ZDNet UK, a weekly trade newspaper targeted at Enterprise IT managers. He later moved back into online publishing as Senior News Reporter for ZDNet UK.

Munir was recognised as Australia's Best Technology Columnist at the 5th Annual Sun Microsystems IT Journalism Awards 2007. In the previous year he was named Best News Journalist at the Consensus IT Writers Awards.

He no longer uses his Commodore 64.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

4 comments
Log in or register to join the discussion
  • Horses for courses...

    While I can understand the confusion and frustration of people who do not understand the action of a firewall, and therefore cannot predict or recognise the effect of their presence, they are there for a purpose.

    Zone Alarm is a product that does what it is designed to do - block traffic that is not authorised - and it does it extremely well. The safest approach is always to block everything, unless it is explicitly permitted. ZoneAlarm does this by default (although this aggressive approach can be "turned down").

    If you don't need a product that does this, or you are confused by the behaviour or effects of such a product, don't blame the product.

    To state that ZA is worse than anything MS puts out smacks of ignorance or stupidity - or possibly, commercially oriented bias.

    Microsoft's Windows XP SP2 has a very simple firewall product. It has no SPI, and doesn't provide any mechanism to control outgoing traffic. There have been suggestions that some "throttling" exists in SP2, in order to restrict the propagation rate of worms, but there is no configurable outgoing connection management.

    And I do not work for Zone Labs, nor do I benefit (or suffer) in any way from changes in the number of sales of their products.
    paul_adams777
  • Windows Firewall/Internet Connection Firewall does have "SPI"

    You simply do not know what you are talking about.

    From Microsoft's own documentation:

    http://msdn.microsoft.com/security/productinfo/xpsp2/networkprotection/firewall.aspx

    "Windows Firewall is a stateful filtering firewall for Windows XP and Windows Server 2003."

    http://support.microsoft.com/?scid=kb;EN-US;841249

    "Windows Firewall is a host-based, stateful, filtering firewall that discards unsolicited incoming traffic through TCP/IP version 4 (IPv4) connections and through TCP/IP version 6 (IPv6) connections."

    http://www.microsoft.com/technet/itsolutions/network/evaluate/technol/tcpipfund/tcpipfund_ch13.mspx#EINAC

    "Windows Firewall is a stateful host firewall for IPv4 and IPv6 traffic in Windows XP with Service Pack 2 (SP2) and in Windows Server 2003 with Service Pack 1 (SP1)."

    An external source:

    http://www.answers.com/main/ntquery;jsessionid=16klpl7fid2tl?tname=windows-firewall&curtab=1512_1&hl=stateful&hl=firewall&sbid=lc05a

    "It provides a stateful inspection of packets which accepts only responses to requests originated by the user."

    Furthermore, there arent "suggestions" that there is "some throttling of outgoing connection", its a fact. The number of simultaneous imcomplete outbound TCP connections attempts has been limited in SP2. However, this has absolutely nothing to do with the Windows Firewall, but rather is a change to the TCP/IP stack:

    http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2netwk.mspx#E5AAE

    I suggest that in the future you (like the article author) inform yourself first, and express yourself last.
    anonymous
  • MS vs Zone Labs

    Microsoft really sucks big time now.You can't even download the Windows One Care app unless you click their button to uninstall ZoneAlarm.There's nothing out there that can compare to ZA and if MS thinks this user will delete ZA,they got another think coming.
    swathingscientist
  • Zonealarm is nobbled

    Recent press release regarding Zone Alarm compromises: "Zone Labs has no current plans to update its free firewall product to protect against this issue, the company said. Its paid products offer protection against the problem because of additional technology, called an operating system firewall, that is not part of the free network firewall, LaCour said."

    Quote from right here at http://www.zdnet.com.au/news/security/soa/Malicious_code_could_trick_ZoneAlarm_firewall/0,2000061744,39215450,00.htm - I stopped using it at this point, as I figured if they weren't going to continue to protect their users, free or not, then user safety wasn't their primary concern, especially as they were now relying on the 'additional technology' OS firewall (read Microsoft) to continue to provide the missing protection.

    Something smells around here!
    anonymous