Firewall Fiasco

intel

Rikki wrote:

The arrows went back to blue when I clicked on them and the security log said there had been a port scan, severity minor.

Somebody is scanning your computer.
Your computer's UDP ports:
4257, 1033, 1029, and 1032 have been scanned from 61.233.40.205..

In simple terms its working... :beer:

penrhyn

Having had loads of problems with Zonealarm 6.0, it was with trepidation that I just upgraded to 6.1.

Success! It works with none of the old locking up the PC problems I had before. I had uninstalled version 6 and had gone back to 5.

So thanks Rex for the note that Zonelabs had fixed version 6, even the Spyware scanner seems to work.

BTW Do you know where Mr Skint went?

Rex_Mundi

backflip wrote:

I doubt that very much, firewalls would have an inbuilt and necessary ability to update (as AV or spyware programmes) if that was the case, but they don't,

Very wrong. My Zonealarm Pro is set to auto update (a built in feature). It tells me when there is a new version out there, it also automatically installs any neccessary patches or bits and bobs it needs along the way.

To manually update ZoneAlarm select the Configure button in the main ZoneAlarm program window. Select Check for updates. ZoneAlarm will connect to the ZoneAlarm site to check for new update information.

intel

I see what you mean Rex

Its a program update supposed to a definition update.. Is that correct?

backflip

What you describe is part of the service you get when you BUY Zonealarm, they keep you up to date with the latest version, but that's nothing to do with security. I've ran Kerio, Outpost, Sygate and never needed to update, been adviced to update or had the ability to update through the programmes other than to a bought version. You are confusing AV issues with what a firewall does.

Rex_Mundi

intel wrote:

I see what you mean Rex

Its a program update supposed to a definition update.. Is that correct?

You should be informed of any updates available for your version of your firewall. Whether it's a patch or a new version that will include any fixes for any vulnerabilities that have been found.

intel

My Head Hurts



Mind you half a gallon of JD didnt help

Rex_Mundi

If what you say is true. Why have Zonelabs gone to all the bother of releasing new versions of the free version? Have a look HERE (scroll down the page). You will see that not only have they improved the product with each version, they have also sorted out various security issues with some of the versions. If what you say is true, they did not need to do this.

Here's an article that explains why sometimes even firewalls need to be updated. Quote..........(from HERE )

A Windows virus masquerading as a security update from Microsoft is spreading via e-mail, warn experts.

The worm, dubbed Swen or Gibe, comes as an e-mail attachment and exploits a two-year-old hole in Internet Explorer.

Nearly 35,000 copies of the worm in 82 countries have been reported by one security company, while another has classified it as a high risk.

Computer users are advised not to click on attachments in unknown e-mails and update their systems.

Sneaky tricks

The virus tries to trick people into clicking on it by purporting to be a security update from Microsoft, using a variety of subject line and spoof e-mail addresses.

The worm also can spread over internet relay chat and the Kazaa file-sharing network, as well as copy itself over shared computer networks.

Windows virus
Other viruses have posed as messages from Microsoft
The worm switches off any anti-virus or firewall software and mails itself to addresses it finds on the victim's computer.

The only way that firewall companies can ensure they are protected from these sort of attacks is by releasing an updated version.

backflip

Rex, so long as the code, the implementaion and configuration are ok, the firewalls perform as they should, it is only when an error occurs somewhere in those areas that revisions have to be made, at other times it is purely cosmetic. Kerio 2.14 is generally regarded as being the best version, they tried to improve on that and issued 2.15. That however proved to be a mistake because it was discovered that if you kept your system on 24/7, then eventually (after about 60,000 blocks or so) you'd get a BSOD. The programme update had nothing to do with security, they just tried to improve the product ( perhaps tidy up the code) and ended up with a problem that needed yet a further update to resolve. None of these affected security, and that is what firewall updates are usually about.

I agree with what you say about opening attachments etc. BUT these are AV problems and NOTHING to do with a firewall. What has email to do with a firewall, your AV should prevent malicious attachments taking effect.

intel

Can someone please clear up the Kerio Firewall debate

Is it free or does it only last 30days?