The firewall component in Microsoft's Windows OneCare
security bundle has holes, experts have warned.
If you do not know previously, OneCare is Microsoft's plan to
create an antivirus+firewall bundle for Windows. Its status
(freeware/shareware/payware) is still undecided, but Windows
Defender (antispyware) will be free for all Windows users.
Source: ZDNet
The security software, available in a public beta version, by
default allows applications that use the Java Virtual Machine or
have a digital signature to connect to the Internet.
Like any blanket security-bypass rule, these default settings are a
bad idea, said Mark Curphey, vice president at vulnerability
management specialist Foundstone, a part of McAfee.
"Any firewall, any security device should have a default deny,"
Curphey said in an interview Tuesday. "Any door should always be
closed."
Curphey discovered the issue when running software on his wife's
computer, on which he had installed OneCare. He informed Foundstone
security consultant Roger Grimes, who subsequently blogged about it
on the InfoWorld Web site. Grimes also blasted the default bypass
settings.
"It just invites malicious hackers and other malware goons to
exploit it," Grimes wrote.
------------------------------------------------------------------------------------------
Microsoft is slacking again for virus fixes, in this case the Kama
Sutra virus; infected PCs will be in danger tomorrow.
Software giant Microsoft has it in its paws to fix a potential
virus nightmare for its customers, but is sitting on the
patch.
Tomorrow the Kama Sutra worm will overwrite Office documents on
infected PCs, as viruses do. It will do this again next month.
Microsoft is slower, and never trust them. Talk about
Microsoft's determination to provide better security?
