News

Microsoft to Change Windows XP Firewall Defaults in Wake of Blaster Worm

• By Scott Bekker
• 08/14/2003

Blaster, also known as MS Blast, Lovsan and Poza, began spreading late Monday through an error in Microsoft's programming of the Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) that Microsoft patched in mid-July. The worm exploits the flaw automatically without requiring users to make any mistake beyond leaving a system unpatched.

While the Blaster worm can affect Windows 2000, the worm is programmed to attack Windows XP about 80 percent of the time.

Microsoft director of security strategy Steven Lipner told The New York Times that Microsoft will begin shipping Windows XP with its built-in Internet Connection Firewall fully activated. The firewall, which was first introduced to Windows with Windows XP in 2001, is fully enabled by default in Windows Server 2003.

"Doing it the way we did was probably the right decision when we shipped XP," Lipner told the newspaper. "Obviously times change, and the things we do to protect our customers change." Windows XP launched about three months before Microsoft chairman and chief software architect formally made security Microsoft's top priority with his Trustworthy Computing memo in January 2002.

The move is welcomed by one security expert as a first step for Microsoft to improve security by going back to re-evaluate shipping products, rather than reserving security changes for future products. In a note to his NTBugtraq security mailing list, longtime Trustworthy Computing critic Russ Cooper, wrote: "The significance here to me is that this is the first time that Microsoft has ever gone back and altered the defaults of an existing product. Historically, you wouldn't see such a change until the next major version release of the OS. This is a clear sign that there is an understanding that existing systems are as important as future versions."

In addition to recommending that users apply the patch, Microsoft and other security organizations have recommended that organizations and customers use firewalls to close off a number of ports known to be involved in the Blaster attack.