Todd H. <comphelp@toddh.net> wrote:
> > Please show one single way to crash the Windows-Firewall from outside.
> > After you showed, I will believe.
> Today: Email attachment with proper social engineering for grandma to click
> on it, leverage a zip buffer overflow, executable overflow turns of
> the windows firewall.

This is not what I meant with "from outside". Every technical security
system can be compromized with a social engineering attack, so this means
nothing.

> Future potential: as yet unkown vulnerability in the program or OS
> that brings down the protection directly.

The same potential is with every technical security system. So what?

I see, that you have no idea how to crash the Windows-Firewall from
outside. But don't be too sad - I don't have one either ;-)

> > > Security in depth.
> > Please explain. If you want to say, maybe one could use a filtering NAT
> > router _and_ the Windows-Firewall, I'd agree. Why not?
> Yes...bejesus! He sees the light!

I never contradicted here. Please read my postings.

> Volker, that is what I've been advocating in this whole thread.
> Remember way back to the original post where the guy with a firewall
> device asked why he needed a software firewall too?

I don't think, we're too different in our views here, too.

> And please don't argue Leythos's points with me please.

OK. This I can understand ;-)

> > His claim, the Windows-Firewall is "a piece of crap" and badly
> > implemented, we can forget, of course. He had no single argument for
> > that.
> As personal firewalls go, though, Windows Firewall is inferior because
> it, while running, is NO better than a border firewall device, and
> more likely to go down.
> A personal firewall that actually has the ability to inercept/track
> outbound traffic on a per-application basis would be a better choice
> as complimentary protection to a hardware based SPI firewall device.

I cannot see that, because I can easily proof, that no "Personal Firewall"
can intercept/track every outbound traffic, but only the traffic of
applications, which want to be controllable.

This means no security at all.

But many "Personal Firewalls" have huge drawbacks in security against the
Windows-Firewall.

Yours,
VB.
--
MAC-Filtering bringt so viel Schutz vor "Hackern" wie Zeitungspapier vor
einer Atombome. (MAC filtering is protecting against "hackers" like newsprint
is protecting against a nuclear bomb)
- Christian Forler in de.comp.security.misc