Vista firewall easily tricked, says Symantec

Symantec researcher claims that Microsoft's design decisions could lead to vulnerabilities

Windows Vista's firewall can easily be subverted because of design decisions made by Microsoft, a researcher at Symantec said Friday.

Orlando Padilla, a Symantec security response team member who authored a study released this week on how well Vista stands up to current malware, took the new operating system's firewall to task in a blog.

"[The firewall] poses a great limitation for malicious code looking to backdoor a host," said Padilla in the entry. "Unfortunately, the Unblock button may be accessed with the same privilege level as a standard user. This configuration of privileges creates a point of vulnerability that undermines the effectiveness of the firewall's policy in Windows Vista."

Padilla was unavailable for comment, but Javier Santoyo, manager of development in Symantec's research group, explained. "Subverting a firewall is nothing new, but Microsoft, with Vista and User Account Control [UAC], had the ability to strengthen the firewall." The company didn't take that opportunity, he said.

The problem, according to Santoyo, is that while Vista's firewall blocks all third-party and untrusted network traffic unless the user clicks the Unblock button, it's not hard for attackers to code their malware so that the software surreptitiously clicks the button. The SendMessage API call can be used to automate that function, said Padilla.

Microsoft could have guaranteed that only a click by a real live user would unblock the firewall for an application requesting Internet access. "They could have coded it so only an interactive user could click the button," he said. It's possible that rival firewall vendors may take up the approach, Santoyo said.

The motivation for tricking Vista into allowing malware access to the Internet is plain: "They could then download other malicious code" or hide the command-and-control traffic between an infected PC and the hacker using the machine as a spam zombie or denial-of-service attacker, said Santoyo.

"Assuming an attacker can perform the firewall unblock attack, most of the functionality commonly present in a bot is available," wrote Padilla in his research paper (download PDF).

"Yes, I think attackers will try this," said Santoyo. "It's not hard to do."

Microsoft officials could not be reached for comment.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?