Blocking Outgoing Messages

Dave Winer writes:

There’s something missing from Windows. An application that hooks into the outbound Internet message flow, and shows me where messages are going. This would allow me to figure out what spyware is running on my system even if the various utilities can’t get rid of them. Then the next step would be to allow me to block traffic to certain servers. That would disable the spyware. It seems that I should have control of my machine at that level.

And Jeff Sandquist responds that Windows XP SP2 can do this via the new firewall, but look again. The firewall built into XP blocks incoming traffic, not outgoing. My guess is that feature will come with SP3. For now, I recommend the free version of ZoneAlarm which is perennially considered by many to be the best desktop firewall software out there. It will notify you when an application tries to send an outgoing message to the internet and its quite easy to configure.

Comments

4 responses

Dylan Parker • August 6th, 2004
This outgoing-traffic shortcoming in firewalls has been known about for quite a while and it is interesting to see how slowly the bi-directional monitoring is becoming the standard.

I first read about it on GRC.com when I came across the simple "Leak Test" utility that simply tries to send outgoing connections through your firewall. ( http://www.grc.com/lt/leaktest.htm ) The author of that site wrote the util in the year 2000. How little we've progressed. Outgoing connections *are* a security risk... especially in the day of PhatBOT and DoS zombies.

ZoneAlarm is good for Beginner and Intermediate users, but for advanced users the best Firewall I've found is Kerio Personal Firewall (previously Tiny Personal Firewall). Their firewall is free for personal use and offers all sorts of configurability and options for both incoming and outgoing traffic. If you understand all of the lingo, this firewall is for you. And it is free.

Note, I have no affiliation with them:

http://www.kerio.com/kpf_download.html

Haacked • August 6th, 2004
Thanks for the tip.

Stan Krute • August 7th, 2004
Regarding Zone Alarm: great software, so long

as you use a version < 5. For example, version

4.5 build 494.

[Version 5 tries to become a full security suite,

and chokes itself in the attempt. Somehow I

sniff new management trying to jack up profits.]

-- stan

Stan Krute • August 7th, 2004
Correction: that's 4.5 build 594.