Why you shouldn't just use Windows Firewall

Поделиться
HTML-код
  • Опубликовано: 19 авг 2024
  • Turn Off Windows Firewall and use something else. This video demonstrates with a trojan backdoor malware test, why you shouldn't use Windows Defender Firewall,although it comes with Microsoft Windows 10 and isn't necessarily bad. ▼ Links, Resources and Contact Information ▼
    ✉ Contact us for business: www.thepcsecur...
    🔥 Love the channel? Become a Patreon:
    / tpsc
    🔥 Buy the best antivirus/security products with exclusive discounts and support this channel:
    www.thepcsecur...
    🔥 Join us on Discord and participate in our active community:
    www.thepcsecur...
    ▶️ See how your product performs in a Test vs Malware:
    www.thepcsecur...
    ▶️ Want to learn cybersecurity? Get started here:
    www.thepcsecur...

Комментарии • 589

  • @pcsecuritychannel
    @pcsecuritychannel  4 года назад +226

    This video shouldn't be *misinterpreted as advice not to use any firewall* especially if you're using a laptop and connecting to random Wifi networks.
    Also, since everyone is asking why I ran the sample in a Win 7 environment (yes, this happens the same way in Windows 8/10). The purpose here isn't to bash Windows Firewall.
    It is a demonstration of the problem with a security model relying on the firewall on the same system the malware is executing from a cybersecurity perspective with real backdoor example.

    • @kontoname
      @kontoname 4 года назад +28

      What the hell is this about? This setup can only work if the user you run this under has actual admin rights... and if it does then ANY solution is purely gimmick.
      What are you trying to teach here other than you not being aware of what an administrator is...?
      Please upload another video doing the same procedure but with the user being an actual user...
      And yes, UAC / Admin will stop this kind of bs - and if it did not (due to other exploits stacked, privilige escalation issues etc.) then ALL other solutions aside from a hardened and unexploitable (lol good luck) hardware firewall with DPI and other layers on top will not stop the threat either.
      So in summary your video says: basic threats will be dealt with unless you're being hacked by the FBI - and if you are... well... nothing will stop the attack. In the worst case people will just visit you, smash your teeth in and kindly ask for the password again. Get REAL.

    • @Turtle_Shell
      @Turtle_Shell 4 года назад +5

      To ensure people don’t misinterpret it, you could change the title to “Why you shouldn’t rely on Windows Firewall”

    • @evigilatus
      @evigilatus 4 года назад +4

      How about using Windows Firewall Control? - binisoft.org/wfc

    • @darkspace5762
      @darkspace5762 4 года назад +3

      Honestly the firewall doesn't make that much differnce on a local LAN. It's more for hosts on the public internet that are being continuously scanned for vulnerabilities. You could very well disable it and it wouldn't make any difference. You are already behind a NAT firewall, your home router. And the host-based firewall in windows is designed for programs that run with administrator privilges can create exceptions for itself.

    • @dktol56
      @dktol56 4 года назад +6

      So don't use an account in the Administrators group for everyday use? Then malware running as that user won't have the elevated privileges to run netsh and compromise the Windows firewall. Am I correct on this point? Of course, an (additional) external firewall is still preferable, but on a mobile device, you have to use what you've got available.

  • @rfunk727
    @rfunk727 4 года назад +703

    You should do a video on the best Firewalls available.

    • @kevinm3751
      @kevinm3751 4 года назад +13

      I use ESET and it has been fantastic! Not just for the OS but for email and everything that comes into the system. Worth every penny in my opinion!

    • @user-qu7ug7ir5u
      @user-qu7ug7ir5u 4 года назад +10

      Netlimiter is very satisfying.

    • @GeneralProfessor
      @GeneralProfessor 4 года назад +4

      Yes please do!

    • @malwaretestingfan
      @malwaretestingfan 4 года назад +13

      Comodo is a good choice? I used it for a while.

    • @darkspace5762
      @darkspace5762 4 года назад +5

      Windows is the best.

  • @Leokhawarizmi
    @Leokhawarizmi 4 года назад +88

    please make more videos about malware analytics techniques , and it will be much better if you make a series from beginner to advanced.
    your channel is really great
    thank you

  • @Lopoi
    @Lopoi 4 года назад +212

    Shouldnt windows always ask you when a program tries to add a rule on the firewall?

    • @unnamedchannel1237
      @unnamedchannel1237 4 года назад +46

      If uac is turned off and the user is silly enough to have their account run as admin or if the uac did pop up and they clicked yes when they initially launched the file

    • @springbok4015
      @springbok4015 4 года назад +27

      Yup, UAC and exceptions to the firewall are requested.

    • @Wahinies
      @Wahinies 4 года назад +23

      Yes it's a domino effect when the user runs at all times as local admin with UAC off. In this case using Windows Firewall is the *least* of security concern. Interesting walkthrough a Trojan but I dont get the point of this video and may be dangerous if viewers misconstrue this as turning WF off!

    • @unnamedchannel1237
      @unnamedchannel1237 4 года назад +3

      Blokka Nokka if you have uac turned off and running as admin then it will do what it wants

    • @eainen
      @eainen 4 года назад +3

      People usually just elevate the original malware executable without checking what it is when they run it initially. After that there's no more prompts because it has access.

  • @MattiKoopa
    @MattiKoopa 4 года назад +10

    UAC was supposed to protect against that. But people kept complaining about annoying prompts so Windows made the default security level for never OSes "medium" which doesn't ask about built-in programs running with Admin priviledges. Instead they now use safe screen stuff that looks a program trying to run on up on the internet to determine if it should display an additional prompt.
    Basically just turn UAC to high first thing on a new PC and never have an issue like the one displayed.

  • @briangullens5351
    @briangullens5351 4 года назад +156

    Don’t run as a administrator. A limited user can’t change firewall settings. Thus the script won’t be able to either.

    • @BreadMan434
      @BreadMan434 4 года назад +20

      However, everyone with private desktops and laptops are kinda screwed.
      I think he used administrator to demonstrate the market consumer average when it comes to Windows usage, which are often the common home usage Windows.

    • @psychcisco
      @psychcisco 4 года назад +40

      @@BreadMan434 So the title of this video, and most of his other video's should probably be "Why not to run Windows as an Administrator"

    • @lordgauron
      @lordgauron 4 года назад +15

      Most of the time software installers require admin rights. They can easily do this trick then.

    • @BreadMan434
      @BreadMan434 4 года назад +12

      @@psychcisco then they should also have the operating system labelled. As well as installed updates and OS versions.
      And really, it shouldn't need to be said.
      Every laptop in the world is sold to automatically set up your primary account as an Administrator, and every PC is preferably set up as one.
      And this is primarily a problem caused by user account control, antivirus and firewall permissions.
      If you're currently running a non-administrator windows, I have no idea what you're doing

    • @bjcanz
      @bjcanz 4 года назад

      I used to have deep freeze but the problem is it burns out the read and write of HDD platter disk in the long run but good against virus that overwrite the system very effective, if you know how to use it, just dont use a virtual disk as a storage, use a second physical drive,

  • @nuorizon8329
    @nuorizon8329 4 года назад +18

    You are testing your assertion using Windows 7 32-bit, which has entered end-of-life Jan-2020 and has not been receiving any meaningful updates for quite some time. It would have been more relevant if you run this experiment on an up to date Windows 10. Then see that the assertion you make does not hold true, at least for this test.

  • @lev2727
    @lev2727 10 месяцев назад +11

    Someone clearly has a rather limited knowledge about firewalls and security in general. As an IT security guy for over 17 years this was quite painful to watch.

    • @udi112
      @udi112 2 месяца назад

      True, no vector just payload on a simulator

  • @theastroquantumguy5810
    @theastroquantumguy5810 4 года назад +81

    Since more and more people are running smartphone devices, I was just wondering if you could make in the future a video about Antivirus software for Android/iOS?

    • @andrewseed7184
      @andrewseed7184 4 года назад +2

      Bitdefender free for Android

    • @malwaretestingfan
      @malwaretestingfan 4 года назад

      Agreed. Placed all my bets on Dr. Web being good / pretty decent as well.

    • @user-bm9gw2mg3g
      @user-bm9gw2mg3g 4 года назад +6

      @Dex4Sure well.... There was some instances were devs put malware and bypass Apple/Google protection. And don't get me started how many times ios
      users were attacked by hackers using exploits.

    • @hdezn26
      @hdezn26 4 года назад +3

      @@user-bm9gw2mg3g Yeah and its been real bad recently for android anyways... ( it's almost like google don't give a **** ) I don't know too much on apple as I don't hear as much about them. ( side note . . I'm not a fan of Apple and their crappy broken products ... Customer: Something broke/ not working? Apple: Buy a whole new computer )

    • @virtualtools_3021
      @virtualtools_3021 4 года назад +1

      all are scams, stop downloading pirated pr0n and you won't get viruses.

  • @spectretacitus325
    @spectretacitus325 4 года назад +59

    So, I've just never heard of that site until this video. It's very interesting to see what it can do. Are there any other sites of this type that you are aware of? Maybe you could do a video on such sites which you think are beneficial to people interested in cyber security. Thanks.

    • @TheFPSPower
      @TheFPSPower 4 года назад +3

      Virus Total is THE website for these things, it was bought by google long ago and has a massive database, if there is any other website I doubt it's any more powerfull.

    • @Mindflayer86
      @Mindflayer86 4 года назад +9

      @@TheFPSPower I am pretty sure he meant app.any.run

  • @ankitminz5872
    @ankitminz5872 4 года назад +37

    "Download his friends and have a party on your system" 🤣
    Well so what should we use?

    • @advertslaxxor
      @advertslaxxor 4 года назад +2

      As suggested in the video, a hardware firewall is preferable, though that is pretty benign advice.
      A better (i.e., more possible/likely to be done, not "superior") suggestion, also in the video, is to have some other software firewall. Generally this will be bundled with some antivirus software.

    • @el_tate
      @el_tate 4 года назад +3

      Comodo firewall free, but good luck trying to find the correct download, nowadays the official web tries to spam you with "Complete Antivirus with Firewall" not the "firewall free" I am telling you.

    • @borgar4357
      @borgar4357 4 года назад

      eltate it doesnt have official website?

    • @SOF006
      @SOF006 4 года назад +3

      @@el_tate Took me the best part of 2 seconds to find it. I googled "comodo free firewall" and got this link www.comodo.com/home/internet-security/firewall.php

    • @SOF006
      @SOF006 4 года назад

      @@el_tate Okay so I retract my comment slightly, but it does appear that to get the firewall you need to install the AV product as well. I wouldn't say thats too bad considering comodo AV is actually pretty good.

  • @lilstimmy6814
    @lilstimmy6814 4 года назад +28

    Can you do a video on how to get a router level firewall? I know it would be different for each router but it would be helpful.

    • @pcsecuritychannel
      @pcsecuritychannel  4 года назад +28

      Definitely I'll add it to my list after seeing the comments in this video. ;)

    • @yazajin
      @yazajin 4 года назад

      @@pcsecuritychannel I'm not sure if a Raspberry Pi would be useful for that, since solutions like PiHole exist for other purposes. Just a thought for the video.

    • @MarkMark-sd4ej
      @MarkMark-sd4ej 4 года назад

      @@pcsecuritychannel yes bro I approve of that request too!!

    • @abandonedmuse
      @abandonedmuse 4 года назад +1

      All routers have their own firewalls. Just read the manual and block the ports you don’t need. Anything coming in is wise unless you really need it.

    • @lilstimmy6814
      @lilstimmy6814 4 года назад

      @@abandonedmuse My modem router combo from my ISP is really basic and doesn't have anything like that. If I go in the setting there is nothing for firewall but my cousins they have a different ISP and they have firewall options and stuff.

  • @Mario583a
    @Mario583a 4 года назад +3

    Title: You shouldn't use Windows Firewall.
    Me: He said nothing about Windows Firewall with Advanced Security.

  • @mymediapc9521
    @mymediapc9521 4 года назад +3

    If you are someone who use the Windows Firewall at least in a corporate environment, one other thing you can do is use a GPO to control the Windows Firewall and tell the firewall to ignore any locally made rules. Is not a guarantee obviously but would provide some minor to moderate additional resistance to this attack. Ideally though, ya you want a hardware firewall that can actually scan into the packets and an IPS on the host that will run hashs against executables.

  • @realmtl6829
    @realmtl6829 4 года назад +7

    A list of good firewalls would be nice. Also what kind of system do you use to test these? What Linux distro do you like?

  • @springbok4015
    @springbok4015 4 года назад +41

    Try it on Windows 10...

    • @TheCocoaDaddy
      @TheCocoaDaddy 4 года назад

      Yeah!

    • @arisu7397
      @arisu7397 4 года назад

      @Dex4Sure of course windows defender would be turned off when using third party av.

  • @lebaquette
    @lebaquette 4 года назад +19

    Doesn't f-secure use a modified windows firewall?

    • @sooocheesy
      @sooocheesy 4 года назад +2

      I think the point of the video was to use "security through obscurity". In other words, If you switch it up and use a different firewall the malware likely won't be written to specifically shut down that alternative firewall. If you are using common applications (MS Office)/OS (Windows)/Firewall (built-in) your system is what most malware are designed to attack.

    • @TwstedTV
      @TwstedTV 4 года назад

      @@sooocheesy People are better off just purchasing a tiny mini PC, with a cheap CPU, but not too old.
      and install Linux OS as the host-OS of that Tiny / Mini PC and then install OpenSense or pfSense with Saracata, and place the tiny / mini pc between the main computer
      and the router. You can get some pretty awesome protection.

  • @arnimkrause5696
    @arnimkrause5696 2 года назад +1

    I use Private Firewall on my laptop. It lets nothing through that's not part of the operating system and lets you know if something is trying to get onto your system. It's a learning curve to use it.

  • @Crroow
    @Crroow 4 года назад +1

    I didn't care to check what channel. I thought, hey this guy sound like Leo. Keep it up, this channel is awesome!

  • @UrbexAlliance-SG
    @UrbexAlliance-SG 4 года назад +9

    Why would you do this test on WIndows 7?

    • @lukasvincourcz7043
      @lukasvincourcz7043 4 года назад +2

      A lot of people are still using this version of windows

    • @UrbexAlliance-SG
      @UrbexAlliance-SG 4 года назад +4

      @@lukasvincourcz7043 May be true, but thats actually their problem. Microsoft even released Windows 10 for free at first and clearly said that Windows 7 won't get supported anymore after some time, as every older Windows version. So I really don't see the point of making the test on an outdated windows version... Hope you get my point.

    • @brunopaquin5637
      @brunopaquin5637 4 года назад +1

      Just a note: to this day W10 is still free if you have a Win7 license

    • @TwstedTV
      @TwstedTV 4 года назад

      @@brunopaquin5637 While true, one should NEVER update to windows 10 through an already installed windows 7.
      windows 10 should ALWAYS be installed fresh from scratch and never as an update. my friends and hundreds of people I know have gone through hell doing it that way.
      then weeks later microsoft themselves posted on their website saying the same thing. And I only use windows for pc gaming.

    • @brunopaquin5637
      @brunopaquin5637 4 года назад

      @@TwstedTV agreed, but since 1909 you can install from scratch and activate with a win7 key

  • @udi112
    @udi112 2 месяца назад +1

    That video is misleading, you skipped the vector part which can be easily blocked by the firewall.

  • @nitaihat12
    @nitaihat12 4 года назад +13

    so how does this malware obtein premissions to change firewall settings? doesn't that need admin perms?

    • @ptyxx
      @ptyxx 4 года назад

      If you use exploits, no (most of the viruses do)

    • @nitaihat12
      @nitaihat12 4 года назад

      @@ptyxx I see, could you point me somewhere I can learn about how such an exploit might work?

    • @ltxr9973
      @ltxr9973 3 года назад +1

      ​@@nitaihat12 Just look at CVEs
      And of course it requires admin privileges. As much as I appreciate this channel, he often seems to blatantly skip things that would make you worry less. This might be either due to him targeting less experienced users that indeed shouldn't get a false sense of security with all the malware out there, or if it is to help sales of security software. If you are an experienced user, you can spend less money on security software and instead just keep your eyes open. But sure, don't do as root.

    • @PassionataDance
      @PassionataDance 3 года назад

      Powershell injection Set-MpPreference -DisableRealtimeMonitoring $true

  • @michaelleeper3649
    @michaelleeper3649 4 года назад +4

    How will this work against Windows 10 Firewall?

  • @WhattEvery
    @WhattEvery 4 года назад +3

    "Why you shouldn't just use Windows Firewall". Does this post also apply to [Windows 10 Firewall]?

  • @jugginator4390
    @jugginator4390 4 года назад +5

    In theory, would UAC settings and/or running the OS on a non admin account prevent the malware from using cmd to add the rules?

    • @gabrielandy9272
      @gabrielandy9272 4 года назад

      yes but if u click yes on the promp the same would happen

  • @Akaya3511
    @Akaya3511 4 года назад +2

    Iobit Malware Fighter 8 rc just came out. Would love to see some Iobit software tests.

  • @AtomicPixel42
    @AtomicPixel42 4 года назад +3

    There is a software (more like a gui) called Windows Firewall Control. It has an option called Secure Profile that deletes or disable any firewall rule that was not created using that software, even if created using cmd running as admin. But I'm not sure if it is that secure. It's now owened by Malwarebytes too.
    And I double down on asking you to do a video about good firewalls =)

  • @MrMolecular
    @MrMolecular 4 года назад +3

    Now why don't you try using an Operating System that isn't discontinued. Windows 7 isn't supported anymore.

  • @nzu11239
    @nzu11239 4 года назад +2

    You should make a video of how to configure your firewall.

  • @kabloosh699
    @kabloosh699 3 года назад +1

    Couldn't you just... set up a standard user account and use that for everything and require separate admin credentials?
    That said, I have glasswire on my desktop. It uses the Windows Firewall, but you can set it to ask to connect. So it blocks by default requiring your input to accept. It also provides a quick snip of where the application is connecting and its rating with Virustotal. It's kind of hands on at first, but once you figure it out it is pretty helpful at identifying shady programs. It does a whole lot of other things but I mainly like it because it makes managing the Windows Firewall possible.

  • @sallyhardwick6287
    @sallyhardwick6287 2 года назад

    My firewall: windows firewall has blocked some of the features of this app
    Me: oh- WELL AT LEAST MY FIREWALL IS WORKING 😃

  • @SMGJohn
    @SMGJohn 4 года назад +2

    Well obviously you use an anti virus software preferably with a firewall or one that modifies the Windows one, but you are right a firewall in the router would be the better idea, some internet providers also have firewalls at their base which seems to become more and more widepsread.
    I would really like to see you explore more GNU Linux safety aspects etc, interesting to see which are really more secure, with or without AV.

  • @MF-le7fp
    @MF-le7fp 2 года назад

    Please consider doing a video on this particular threat against Komodo firewall. Thanks. Great channel! 👍

  • @georgeindestructible
    @georgeindestructible 4 года назад +1

    Excuse me but isn't this, assuming we run a malicious file first manually right?

  • @stefantomas
    @stefantomas 2 года назад +1

    Why is this so misleading? Executing the "netsh advfirewall firewall add rule" requires elevation, so unless you disabled UAC you will be perfectly protected by Windows firewall. Also it seems that in order to execute the Fire.exe you would need to disable the AV as well.

  • @TemplarDG
    @TemplarDG 4 года назад +1

    Use TinyWall, its a free and light firewall controller that uses Windows Firewall but prevents rule changes outside of its own dashboard.

  • @mar_kohoho
    @mar_kohoho 4 года назад +5

    I use "Windows Firewall Control" from Malwarebytes.
    is it good for something?

    • @TheMultimargarin
      @TheMultimargarin 4 года назад +2

      It’s a good add-on for the system firewall. There will be many requests for creating rules, but this will improve system security.

  • @notsosussy
    @notsosussy 4 года назад

    The good thing about default windows firewall is to block remote code execution vulnerabilitis. in my opinion, directly bind connections are denied, but the problem is when the connection is from inside to outside, windows firewall will just look and says "ok"

  • @dexterman6361
    @dexterman6361 4 года назад +4

    Doesn't netsh command require admin privileges?

  • @harisjafri9459
    @harisjafri9459 4 года назад +12

    Why not using windows 10?

    • @ppetrix
      @ppetrix 4 года назад +1

      Yes, windows 10 has the same problems?

    • @fuks5756
      @fuks5756 4 года назад +2

      ​@@RWBY Right? I wonder why TPSC didn't think about it. If you are testing, you need to have consistency. And that would be a REALLY stupid step from Microsoft to just let any program control Firewall, especially now that they invested so much money and time in Defender. And well, if the user gives it Admin right... then they are screwed. BUT TPSC didn't mention that - he just said that the problem could do it by itself, which is not true. That program needs admin rights.

    • @pcsecuritychannel
      @pcsecuritychannel  4 года назад +8

      Because I'm just demonstrating a basic point about security model which is independent of OS, be it Windows 7/8/10.
      For everyone saying it requires admin access, sure, but most malware/ransomware executes with admin access anyway, be it through privilege escallation or user grant, if you watch TPSC often you know this already. My objective is to make people aware of several cybersecurity scenarios. If you take it as a universal bashing of something, that's on you.

    • @harisjafri9459
      @harisjafri9459 4 года назад

      @@pcsecuritychannel want you to run it using the latest version. Since win 7 already expired. Need to show to anyone that say default windows protection is enough

    • @csparty11
      @csparty11 4 года назад +2

      @@pcsecuritychannel Yeah but if the malware executes with admin access anyways, which is not always the case but have it your way. The point is, there is no software firewall product that is going to protect you against this or with other words windows firewall does not do less of a job than other firewall products. So he's right, this video is a joke and you are mispresenting information. Also who says a hardware firewall will deny this traffic, depends on how you set it up.

  • @LaserFur
    @LaserFur 4 года назад +1

    I set "outbound" to default to "blocked" in order to deal with spyware like windows. I know that if infected spyware could easily disable this. I want to find a solution where the PC tells an external firewall the name of the process for each outbound connection attempt.

  • @seanleastria4478
    @seanleastria4478 2 года назад +1

    The end say not trying to bash Windows Firewall. But that is not even a question when it comes to objective reporting. The question is whether or not users should simply disable it and use something else.

  • @pineappleroad
    @pineappleroad 2 года назад

    It took me until now to realise that the ISP supplied router does not seem to have a built in firewall, at least as far as i can tell
    The router which i am using as an access point does have a firewall though, although because i had it in access point mode, the firewall was automatically turned off (since in access point mode the WAN port becomes another LAN port)
    Just now i switched a few Ethernet cables around so everything is now connected through the router that i was using as an access point, and changed the router back over to router mode, so now the ISP supplied router is basically being used as a modem
    All the devices i have were already either connected to Ethernet, or the router which i used to have set up as an access point, this router is upstairs, while the ISP supplied router is in the kitchen, the WiFi signal of the ISP supplied router drops out in certain areas of the living room, and does not reach upstairs, whereas the router i have upstairs covers all parts of the house except for the kitchen, but this doesn’t bother me, as I don’t have any devices in the kitchen that connect to WiFi

  • @abc123fhdi
    @abc123fhdi 4 года назад +10

    I see you’re using Windows 7 in the virtual machine. You probably shouldn’t use this at this point as it is no longer supported. You may get a different result in Windows 10 defender/firewall. I use MacOS so this won’t happen to me. Saying another software firewall might’ve worked isn’t saying much unless you show it working. As well as router firewalls which I believe I have. What is the likelihood of this happening if you avoid sketchy sites I would say don’t lose any sleep over it.

    • @pcsecuritychannel
      @pcsecuritychannel  4 года назад +3

      That's not the point. The video about malware on a system using access to CMD to edit Firewall rules, the same can happen in Windows 10.

    • @abc123fhdi
      @abc123fhdi 4 года назад +3

      The PC Security Channel Microsoft may have issued a patch for this except they ended support in January and this cane out in April so there are no more patch Tuesday patchers for win 7. The last patch Tuesday for win 10 was on May 12 so it would be worth testing an updated windows 10 install to see if this works. In practice don’t visit any malicious sites to avoid something like this.

    • @advertslaxxor
      @advertslaxxor 4 года назад +1

      @@abc123fhdi In the best case it will present as a notification. Do you know what happens when your average user is presented with a notification? "Yes" "Okay" "Continue" "Accept" "Confirm" etc. :/

    • @dashripkin
      @dashripkin 4 года назад

      @@advertslaxxor That's not a failure of Windows; that's a user error, and no firewall can prevent ham-fisted users who are itching to mess everything up.

    • @marv42dp
      @marv42dp 4 года назад +1

      ​@@pcsecuritychannel Did you test it on Windows 10? You used an OS that's EOL, and it's successors have had major overhauls in the security department.

  • @sebbes333
    @sebbes333 4 года назад +4

    1:30 *SERIOUSLY WTF!!!???*
    Why doesn't that command AT LEAST require some kind of password to execute!? (as a parameter or a separate popup window or something.)

    • @tropolite
      @tropolite 4 года назад +1

      Because he's using an unsupported OS. Windows 7 is End of Life since Jan 2020

    • @sebbes333
      @sebbes333 4 года назад +1

      @@tropolite
      Not really the point, this SHOULD have required some kind of password FROM THE START, or at least been patched soon after.

  • @TechnicalIssuesOfficial
    @TechnicalIssuesOfficial Год назад +1

    1:02, This wasn’t fair. Windows 7 is EoL. Please do a test on 11/10 for fair!

  • @PushyPawn
    @PushyPawn 2 года назад +1

    Trust MS to call their paperwall a firewall.

  • @86JonesL
    @86JonesL 4 года назад +1

    Malwarebytes Windows firewall control has something called a secure profile and secure rules, no idea how effective it is though.

  • @DayzGone
    @DayzGone Год назад

    Back in the day, I used ZoneAlarm. Currently, I don't run a firewall. As I actually forgot how important they are

  • @idk-sy3iu
    @idk-sy3iu 4 года назад +1

    Tip: use linux, you need a root/admin password to do rules in firewalls

  • @SOF006
    @SOF006 4 года назад

    I have my firewall/IPS running on a UDM from Ubiquiti and also have Norton Internet Security running on all of my machines. According to my IPS threat management it blocked a suspicious connection attempt made by someone Canada and Norway and more recently someone in the US. Its crazy to think that if routers didn't have firewalls built in, lots of people would be infected without even realising.

    • @pepeshopping
      @pepeshopping 4 года назад

      Norton is one of the worst and I have replaced it on several computers after they got hacked.

  • @nuNWO
    @nuNWO 3 года назад

    Really interesting and so well explained with the demonstration.

  • @michaelwaterman3553
    @michaelwaterman3553 4 года назад

    I can’t really say that I would agree with the title and conclusion. The WF is z a great addition to Windows and can do multiple levels of authentication. What you demonstrated is a local infection that connects to an external source, it could do that by utilizing a session and skip any host based fw. I do agree on net network based fw. BTW, in a corporate environment always set the firewall to enable and manage it.

  • @CHAUVELINwastaken
    @CHAUVELINwastaken Год назад +1

    How do I stop it from blocking my game bruh

  • @obsidian9998
    @obsidian9998 4 года назад

    So what Windows firewall payed package is worth buying to the competition. This is if I have too sercumstance of being cheaper likely.

  • @Jarrenkai
    @Jarrenkai 4 года назад

    Very informative, I am using Malwarebytes Windows Firewall Control and its pretty awesome

  • @Ambassador-For-Christ
    @Ambassador-For-Christ 2 года назад

    I use Private Firewall, It is not being updated any more since 2015 I believe, but I don't see any need for it to be updated. I would love to see The PC Security Channel test it against Ransomware, like he did with the Comodo Firewall...PLEEEEEEESE?!?!

  • @TheMultimargarin
    @TheMultimargarin 4 года назад +1

    If you add the "Windows Firewall Control" add-on, this should improve the situation of protecting the network from malicious activity. Kettles will boil from add-on requests for creating rules for each network action, but this will be effective to limit the actions of the malware and legitimate programs that should not have access to the network.

  • @testhekid
    @testhekid 4 года назад

    yt recommendations is giving me good stuff lately

  • @johnDingoFoxVelocity
    @johnDingoFoxVelocity 4 года назад

    actually windows 10 as well as windows server 2003 have basically the same firewall and most malware that affected server 2003 surprise works in windows 10 i highly recommend another firewall program as well as anti malware and anti virus as well

  • @rcarter-ip8xd
    @rcarter-ip8xd Год назад

    Great video, have been looking for something along these lines for sometime, also caught your video on Win11 and agree with the concerns you posed. Because of the risks of using Windows Firewall I installed Norton 360 and use that instead about five years ago. One feature I liked about Norton was the ease at which you could block out bound traffic from specific apps. And for a while I thought I had plugged most of the holes that Windows Telemetry was using. But nearly two years ago I noticed NF was not logging blocked traffic on the Window Telemetry settings I had entered, and wondered if MS had moved telemetry services deeper into the OS in order to bypass any firewall. But my knowledge doesn't take many any further than that, so I'm not sure what MS is doing now, but I do know the amount telemetry being collected has only increased. And you can't disable it any longer either. So, if you could add some suggestions on alternative firewalls, preferably hardware ones, that would allow someone to block outbound traffic, that would be great. Keep up the work and I'll share the links.

  • @r3n846
    @r3n846 3 года назад

    So, one edge case where your system needs to already be compromised means that Windows Firewall is useless?

  • @CarlosOrtiz-ht6rn
    @CarlosOrtiz-ht6rn 4 года назад

    Subscribed to your channel! You have amazing information!

  • @neilmurphy845
    @neilmurphy845 4 года назад

    Shouldn't you get a notification tell new Defender is off and the settings were changed

  • @michaelp.3369
    @michaelp.3369 2 года назад

    You should have gave some resolutions. As in firewalls that are available. But it was a good video thank you very much.

  • @AnAN-bn1ol
    @AnAN-bn1ol 3 года назад

    what's the difference between registered and non registered domain with PAGE NOT FOUND 404 message? can you explain I can't find the info, how to distinguish them?

  • @stevenanderson3205
    @stevenanderson3205 4 года назад

    How come you are not using private settings on the firewall.

  • @alfawolve869
    @alfawolve869 2 года назад

    This only happened if the malware can pass defender antivirus for windows right?

  • @AndrewAHayes
    @AndrewAHayes 4 года назад +4

    Is the firewall on Win10 any different?

  • @j2klegend
    @j2klegend 4 года назад

    Totally agree. Especially if the system need to be protected in a LAN file share environment.

  • @havkacik
    @havkacik Год назад

    I wonder wheter Win 11 firewall behaves the same

  • @psychcisco
    @psychcisco 4 года назад

    This is not a Windows Firewall issue at all. This is an issue that could apply to any software firewall if running Windows as an Administrator. It could also apply to MacOS or Linux if you are stupid enough to operate as the Root account and run a malicious script.

  • @BaSsGaZ
    @BaSsGaZ 4 года назад +1

    Well, the malware can in this case kill any antivirus you have running using Command lines. So, the moment you give admin rights, you're screwed regardless.

  • @01sapphireGTS
    @01sapphireGTS 4 года назад

    1. Can you differentiate between Windows Firewall, Windows Defender, and Microsoft Security Essentials in Windows 7? 2. Is Microsoft Security Essentials adequate when used in Windows 10?

  • @cammy85
    @cammy85 3 года назад

    Windows Firewall + Simplewall works great!! Older versios allowed you to disable Windows Frewall, but now they coexist and you can block all telematry as well. Nothing is allowed unkess you approve it.

  • @kirillfilimonov8583
    @kirillfilimonov8583 4 года назад

    Hm.. I think this problem happens only if you use administrative windows account. AFAIK simple user account, unless asked to so, does not allow changing system settings, firewall rules included.
    It is not a problem of a windows firewall, the problem is in windows itself, because some programs required administrative environment to run properly.

  • @sooocheesy
    @sooocheesy 4 года назад +1

    I'm not really sure how effective firewalls are to stopping an established malware that's already installed itself. Unless you set the firewall to block outbound traffic by default, the malware can just initiate an outbound request to the malware server (which probably won't be blocked) and the response is automatically allowed back in through the firewall. And let's face it, most users don't setup firewalls to block by default and if they were already dumb enough to open the malware in the first place they will probably just allow it out through the firewall too.

    • @bluenightsky
      @bluenightsky 2 года назад

      Probably one that allows you to set a password before changing anything. Just a guess though.

  • @mrtwinky2007
    @mrtwinky2007 2 года назад

    still waiting on your test of ZoneAlarm Firewall and Antivirus

  • @abrarmurshed1363
    @abrarmurshed1363 3 года назад +1

    I have liked every video I have watched.........amazing channel.

  • @seba19762
    @seba19762 4 года назад +1

    Honestly I don't see the point of this video. Most users setups don't need a firewall (software or otherwise), because their behind a router doing NAT for them, so unless the malware can open ports in the router they are protected. There uPnP of course, but the whole premise of the video is wierd. It's not whether your firewall is good or not, it's about running untrusted software and the correct use of UAC.

  • @estellebright2579
    @estellebright2579 4 года назад +2

    While hardware firewall is very good, when on the go, it is difficult to use a hardware firewall on, say, public transport. Relying on tech to protect people from doing shady behaviours online is just not going to go well.
    With all that being said, some recommendations other than using hardware firewall would be nice.

  • @M1911Original
    @M1911Original 4 года назад

    What's the best alternative then? How do we put a firewall at the appropriate level for protection?

  • @santiagolabayjr.1596
    @santiagolabayjr.1596 3 года назад

    Bro waht if i use windows firewall to prevent the game from trying to go online

  • @DoomVik
    @DoomVik 4 года назад +1

    Im a bit lost. Does it like completely bypass UAC as well and any permissions settings? obviously if you run it as a local admin it would run rampant, but does it do the same even if you separate the user account and the local admin?

  • @coolmonkey5269
    @coolmonkey5269 3 года назад

    i was using kaspersky total fiewall before.. no detections... clean system
    now using mcafee total firewall... i get many warning - blocked unsafce connection
    is it true that kaspersky failed to detect
    or mcafee is false signals 🙄

  • @delboyg01
    @delboyg01 4 года назад

    Microsoft used to apply a similar poor firewall policy on the Small Business Server line! They had to change the technical guidance once people explained how ineffective the firewall was.

  • @mkatakm
    @mkatakm Год назад +1

    cmd.exe needs administrative privilege to run firewall commands, so never disable UAC.

  • @sydniusalminia5364
    @sydniusalminia5364 4 года назад +1

    What's the program you're using there to simulate this stuff?

  • @vladislavkaras491
    @vladislavkaras491 Год назад

    Really great video!
    Thanks!

  • @Limitless332
    @Limitless332 4 года назад

    Leo, i have bitdefender antivirus plus edition which doesnt have firewall, i dont want to use windows firewall, any recomendation for firewall that can installed with bitdefender antivirus plus?,P.S.: sorry for bad english

    • @johnave4545
      @johnave4545 3 года назад

      Comodo firewall, tinywall, simple wall, zonealarm firewall

  • @ChemChoqnai
    @ChemChoqnai 3 года назад

    just for information, it takes 3 seconds to deactivate your windows defender firewall and control your full pc by the help on one usb.

  • @clankboss827
    @clankboss827 3 года назад

    why is the audio so low?

  • @ultimate3dition343
    @ultimate3dition343 4 года назад +1

    Hello to you thank you for the information but there are some games forza Horizon 4 does not work online if the Windows Firewall is not activated. Because once I had a problem with online games and doing my research it was the firewal which was to deactivate the problem. I can't explain that doing this causes some problem with Windows 10 games.

  • @imperiumcommentingnetwork4677
    @imperiumcommentingnetwork4677 4 года назад +1

    Ad: "This battery thing is life"
    Me: "Please stop showing me the same ad on every single video i watch..."

  • @TheSpanjaMan
    @TheSpanjaMan 2 года назад

    Does this affect people who use standard account with admin separated? Can this get past UAC?

  • @KALTBLUTWOLF1
    @KALTBLUTWOLF1 4 года назад

    I am using Windows Firewall Control which is a 3rd party interface for the windows firewall. It has an option called 'Secure Profile' which blocks any attempt to change firewall rules that does not come from this interface.
    But I am considering to switch to NetLimiter's firewall but I am not sure whether it is good enough to help against malware. Their support would not even answer me and they don't have a forum yet and neither a subreddit interestingly...

  • @zipzeolocke2
    @zipzeolocke2 4 года назад +1

    I think it would be informative to make a video on firewall usage. Are there certain firewalls that conflict with others? When a certain application stops functioning correctly I often wonder is it my router's firewall conflicting with my computers firewall? Or was it just a Microsoft or Google update that broke things. I'm more inclined to believe the ladder

  • @WmTyndale
    @WmTyndale 4 года назад

    Thank you. Right to the important point!

  • @rightOrWrongMyContry
    @rightOrWrongMyContry 3 года назад

    The solution is actually simple: use a Windows Firewall Control program with the "Security -> Secure Profile" option.

  • @toresagen7346
    @toresagen7346 4 года назад

    Lot of people in the comments are talking about netlimiter. I don't know what it is but it seems popular. Can you do a video on netlimiter? How effective is it with this malware stuff? Please do a video on netlimiter.