Hackers disable Windows Firewall

Hacker has released a malicious code that can completely disable Windows Firewall on some PCs running Windows XP.

Specifically, they are PCs running Windows XP and have Internet Connection Service (ICS) service enabled. This is a system service that allows Windows users to turn their PC into a router and share Internet connection with other PCs on the same LAN.

An attacker can send 'exclusive' packets to a Windows XP PC that has ICS enabled to disable this system service. However, ICS has direct contact with Windows Firewall, so if ICS stops working, Windows Firewall will also die.

Tyler Reguly, a researcher with security firm nCircle Network Security, discovered the code and published it on his blog.

Risk?

Reguly claims that not only Windows XP can be attacked by malicious code but also Windows Server 2003.

However, early investigations by Microsoft confirmed that only Windows XP could be attacked by the newly discovered malicious code. Microsoft has yet to detect any attacks by taking advantage of this malicious code.

Disabling Windows Firewall, hackers will have more ways to attack users. However, it seems that the attack methods have not been very effective, Reguly said.

For example, to be able to attack a user, the attacker must be a member of the LAN and it must be a LAN that uses the ICS system service. Another factor is that this type of attack is completely helpless against other third-party firewall systems.

Users can completely avoid the risk of being attacked by modifying the ICS system service. But if you disable this application service, it means you cannot share your Internet connection.

Solution

The most solvable solution is that instead of using the ICS system service users should use a specialized router or NAT Address (Network Address Translation), Stefano Zanero - Technical Manager of Secure Network SRL - said.

' Most of the above devices are cheap. Not only that, some products also give users more safety solutions . '

Hoang Dung