There are even free firewalls online, as well as ones that you can buy. Despite their ubiquity, however, a lot of folks are confused about what firewalls are and what they actually do. 

Read on to find out:

Q: I hear the term "firewall" used all the time. What is a firewall, and why do I need one?

A: A firewall is a software program that monitors all incoming and outgoing activity over a network such as the Internet. Whenever a program such as an e-mail client or a web browser tries to access the internet, a firewall will alert you, asking whether the activity is to be allowed or blocked. If you unblock an activity, you can generally choose whether to unblock it just once or always. If you choose always, then the next time that type of activity is detected, you will not be notified.

A firewall is important because, although most types of access to the internet are initiated by you and are therefore legitimate, some of the most malicious programs around will attempt to steal your personal information and transmit it stealthily over the internet or deposit harmful code on your PC. Without a firewall, you may never even be aware that such activity is occurring. Thus a firewall exists for your protection.

Q: If I use a firewall, do I also need an antivirus program?

A: Firewalls do not take it upon themselves to identify and eradicate particular types of threats. Instead, their primary function is that of monitoring and logging – and alerting you to unsanctioned network activity.

That’s why a good security toolkit typically includes a firewall as well as antivirus, antispam, and malware detection and removal tools.

You can use a firewall to view reports of any program that has tried to access your computer or exchange data with it. As you are browsing the list of accesses or attempted accesses, you can generally decide whether to block future activity from a given program.

Be careful at this stage: while you’ll recognise some programs and want to continue allowing them access to your computer, others you may not recognise. Before you block access, it makes sense to perform an internet search on the program in question. You’ll want to make sure that you’re not blocking access from a program that you may need.

Q: Windows XP comes with a firewall, and so does my antivirus program. Which firewall should I use?

A: You’ll probably want to use the one that comes with your antivirus program, for two reasons. First, Windows XP’s firewall, while offering basic firewall protections, does not monitor outgoing connections. So if you happen to get a malicious program on your computer that wants to send information out without your knowledge, XP’s firewall won’t tell you about it.

Many third-party firewall solutions offer more thorough solutions. Initially, they’re often more annoying, as well, however, since they may interrupt your work with messages asking whether you wish to block a particular type of internet access. Over time, though, the firewalls will have a record of the types of activity you allow and expect, and will prompt you less often.

Second, the firewalls that come with antivirus solutions are designed to work integrally with those antivirus components, so there’s little likelihood that you’ll run into one part of your security solution raising false alarms about activity initiated by another.

Source: bangkokpost.com

That’s what Thierry Zoller believes. For the past two years, the security engineer for n.runs has taken a close look at the way antivirus software inspects email traffic, and he thinks companies that try to improve security by checking data with more than one antivirus engine may actually be making things worse. Why? Because bugs in the "parser" software used to examine different file formats can easily be exploited by attackers, so increasing your use of antivirus software increases the chances that you could be successfully attacked. 

Antivirus software must open and inspect data in hundreds, if not thousands, of file formats. One bug in the software that does this can lead to a serious security breach.

Zoller and his colleague Sergio Alvarez have been looking into this issue for the past two years and they’ve found more than 80 parser bugs in antivirus software, most of which have not yet been patched.

The flaws they’ve found affect every major antivirus vendor, and many of them could allow attackers to run unauthorised code on a victim’s system, Zoller said.

"People think that putting one AV engine after another is somehow defence in depth. They think that if one engine doesn’t catch the worm, the other will catch it," he said. "You haven’t decreased your attack surface; you’ve increased it, because every AV engine has bugs"

Although attackers have exploited parsing bugs in browsers for years now, with some success, Zoller believes that because antivirus software runs everywhere, and often with greater administrative rights than the browser, these flaws could lead to even greater problems in the future.

The bottom line, he says, is that Antivirus software is broken. "One email and boom, you’re gone," he said.

Research into parsing bugs has been spurred by a heightened focus in recent years on "fuzzing" software, which is used by researchers to flood software with a barrage of invalid data in order to see if the product can be made to crash. This is often the first step toward discovering a way of running unauthorised software on a victim’s machine.

A parsing bug in the way the Safari browser processed .tiff graphic files was used recently to circumvent Apple’s strict controls over what software may be installed on the iPhone.

Zoller says he has been criticised by his peers in the security industry for "questioning the very glue that holds IT security all together," but he believes that by bringing this issue to the forefront, the industry will be forced to address a very real security problem.

Between 2002 and 2005, nearly half of the vulnerabilities that were discovered in antivirus software were remotely exploitable, meaning that attackers could launch their attacks from anywhere on the internet. Nowadays, that percentage is close to 80%, he said.

Zoller’s company sees a business opportunity here. N.runs, based in Oberursel, Germany, is building a product, code-named ParsingSafe, that will help protect antivirus software from the kind of parsing attacks that he has documented.

Russ Cooper, a senior scientist with Verizon Business, had some criticism for the work of n.runs. "The research almost appears to be goading criminals into ‘getting better’ at attacking vulnerabilities … hardly helpful," he said via instant message. "There’s no doubt that the list of vulnerabilities they have already published in security products looks daunting. However, historically, we have not seen this type of vulnerability exploited."

Though Cooper agrees that antivirus file parsing vulnerabilities do pose a risk, he said there are several reasons they have not yet been the focus of widespread criminal attacks. For one, criminals are already being effective enough with their current tactics, such as sending malicious email attachments. A second reason is that security software tends to get more scrutiny, meaning that any vulnerability that was being exploited would be quickly patched, and that any criminal involved in an exploit would be more likely to be caught.

Security vendors have long known about vulnerabilities in their software, said Marc Maiffret, chief technology officer with eEye digital security. "Security software is just as vulnerable as any other software," he said via instant message. "We all hire the same developers that went to the same colleges as Microsoft and learned the same bad habits."

Source: computerworld.co.nz

The malware distributors have attached a “recording” of the recipient’s phone call in an effort to convince the recipient of their surveillance capabilities, which is actually an executable .scr malware file. The attachment names are numerical variations on “call1105-10.rar.” and are password-protected, compressed files. The malware inside the attachment is activated when the recipient opens the file with the password provided in the body of the email.

“These techniques indicate the malware author’s ability to successfully launch new variants of malware on the Internet, which is why signature-less protection against these types of attacks is critical,” said Joshua Block, VP of North American Operations, Cyberoam. “Traditional signature-based protection methods are unable to provide zero-hour protection. Cyberoam’s unique identity-based UTM appliances provide organizations of all sizes with a proactive virus detection technology that protects against spam and new email-borne virus outbreaks hours before signatures are released and updated in signature-based solutions.”

Commtouch research shows that global spam levels recently reached an all-time high of 95 percent, increasing a spammer or virus author’s ability to launch a successful attack. To help combat this, Cyberoam’s fully integrated gateway antivirus and anti-spam engines provide reliable web and e-mail security at the gateway for enterprises. The powerful gateway antivirus solution from Cyberoam supports business flexibility and prevents Internet threats like worms, viruses and malicious programs from entering networks. In addition, Cyberoam goes beyond relying on signatures and email content to flag potential threats, enabling the solution to detect spam in any language and in every message format, non-English characters, single and double byte, etc. Its language and content agnostic nature provides customers with effective spam blocking from image-based and all other types of spam.

To learn more about Cyberoam’s unique identity-based UTM solutions, please contact Rebecca Paquette at cyberoam@shiftcomm.com, or visit www.cyberoam.com.

About Cyberoam

Cyberoam, a division of Elitecore, is a leading innovator of identity-based Unified Threat Management appliances offering a comprehensive range of security features, including identity-based firewall, VPN, gateway antivirus, gateway anti-spam, intrusion detection and prevention, content filtering, as well as bandwidth management and multiple link management – all over a single platform. Cyberoam offers robust Internet security to corporations, educational institutions and government organizations worldwide, and its solutions are certified by the ICSA Labs, an independent division of Verizon Business, and the Virtual Private Network Consortium. Cyberoam’s solutions have also received the 2007 Global Excellence Awards for Integrated Security Appliance, Security Solution for Education and Unified Security, and the 2007 Tomorrow’s Technology Today Award for Unified Security. Cyberoam has offices in the Newburyport, MA and India. For more information, please visit www.cyberoam.com.

About Elitecore Technologies

Elitecore Technologies Limited is a leading provider of convergent billing, provisioning and customer acquisition solutions, and Unified Threat Management Solutions. Elitecore’s divisions include Crestel, meeting the voice, data, video billing and customer care requirements of tier-one service providers; and Cyberoam, the leading innovator of identity-based UTM solutions that offers integrated Internet security with fine granularity through unique user identity-based policies. Elitecore was established in 1999 by Eclipse Micro Computer Inc., and possesses a strong R&D base and support center based in India, allowing the Company to sustain a healthy growth rate of more than 75 percent since inception. For more information, please visit www.elitecore.com. 

Source: www.businesswire.com

Antivirus software must open and inspect data in hundreds, if not thousands, of file formats. One bug in the software that does this can lead to a serious security breach.

Zoller and his colleague Sergio Alvarez have been looking into this issue for the past two years, and they’ve found more than 80 parser bugs in antivirus software, most of which have not yet been patched.

The flaws they’ve found affect every major antivirus vendor, and many of them could allow attackers to run unauthorized code on a victim’s system, Zoller said.

“People think that putting one AV engine after another is somehow defense in depth. They think that if one engine doesn’t catch the worm, the other will catch it,” he said. “You haven’t decreased your attack surface; you’ve increased it because every AV engine has bugs”

Although attackers have exploited parsing bugs in browsers for years now with some success, Zoller believes that because antivirus software runs everywhere and often with greater administrative rights than the browser, these flaws could lead to even greater problems in the future.

The bottom line, he says, is that antivirus software is broken. “One e-mail and boom, you’re gone,” he said.

Research into parsing bugs has been spurred by a heightened focus in recent years on “fuzzing” software, which is used by researchers to flood software with a barrage of invalid data in order to see if the product can be made to crash. This is often the first step toward discovering a way of running unauthorized software on a victim’s machine.

A parsing bug in the way the Safari browser processed .tiff graphic files was used recently to circumvent Apple’s strict controls over what software may be installed on the iPhone.

Zoller says he has been criticized by his peers in the security industry for “questioning the very glue that holds IT security all together,” but he believes that by bringing this issue to the forefront, the industry will be forced to address a very real security problem.

Between 2002 and 2005, nearly half of the vulnerabilities that were discovered in antivirus software were remotely exploitable, meaning that attackers could launch their attacks from anywhere on the Internet. Nowadays, that percentage is close to 80 percent, he said.

Zoller’s company sees a business opportunity here. n.runs, based in Oberursel, Germany, is building a product, code-named ParsingSafe, that will help protect antivirus software from the kind of parsing attacks that he has documented.

Russ Cooper, a senior scientist with Verizon Business, had some criticism for the work of n.runs. “The research almost appears to be goading criminals into ‘getting better’ at attacking vulnerabilities … hardly helpful,” he said. “There’s no doubt that the list of vulnerabilities they have already published in security products looks daunting. However, historically, we have not seen this type of vulnerability exploited.”

Though Cooper agrees that antivirus file parsing vulnerabilities do pose a risk, he said there are several reasons they have not yet been the focus of widespread criminal attacks. For one, criminals are already being effective enough with their current tactics, such as sending malicious e-mail attachments. A second reason is that security software tends to get more scrutiny, meaning that any vulnerability that was being exploited would be quickly patched, and that any criminal involved in an exploit would be more likely to be caught.

Security vendors have long known about vulnerabilities in their software, said Marc Maiffret, CTO with eEye digital security. “Security software is just as vulnerable as any other software,” he said. “We all hire the same developers that went to the same colleges as Microsoft and learned the same bad habits.”

Source: computerworld.com.my