DefenseWall Personal Firewall 3.00 released

Hooray, Wilders forum must be going crazy haha.

demoneye, have you tested it yet? I'll get round to testing it in my VM eventually, although I don't think anything has changed from the Beta/RC phase. I definitely won't be testing it on my REAL system again (made that mistake too many times last year haha).

DefenseWall Personal Firewall & HIPS editions v3.00 released. There are a lot of changes, some of them are:

New DefenseWall Personal Firewall edition is created.
Dynamic Trusted/Untrusted zones control for installation software is added.
System shutdown control is added.
Screen capturing control for untrusted processes is added.
Whitelisting for new "known as good" installation programs is added.
Multiple stability and security-related issues are solved.

i give it a little quick test its seems like all previous RC`s hehe

ssj100 wrote:I definitely won't be testing it on my REAL system again (made that mistake too many times last year haha).

What happened?

Ruhe wrote:

ssj100 wrote:I definitely won't be testing it on my REAL system again (made that mistake too many times last year haha).

What happened?

I simply don't like how DefenseWall protects the system. Don't get me wrong, I understand how it works, and how to use it fine. I even tried to use it in combination with Sandboxie. I really tried hard to keep DefenseWall, but I simply didn't like it. Ask demoneye - he basically feels the same way haha.

But Sandboxie has spoilt me - it's nice to be able to empty the sandbox after several days/weeks/months with a couple of clicks and "guarantee" that everything is flushed out the toilet. With DefenseWall, you either have to spend hours sifting through the Rollback List (going through hundreds of entries) or you'll have to eg. review its list at the end of each day to ensure nothing suspicious is kept (and this is much more difficult than it sounds...and of course very time consuming). However, as I've mentioned, DefenseWall is excellent protection for the "noob" user who doesn't care about these things.

Also, Sandboxie has the start/run restrictions, which are arguably on its own even more powerful than the containment it (and DefenseWall) primarily provides.

Ultimately though, Sandboxie simply keeps my system cleaner and better protected than DefenseWall ever will. With my security setup and approach, Sandboxie fits in much better than DefenseWall.

Also, Malware Defender's developer Xiaolin claims that if you let a program execute, it will be able to bypass your protection sooner or later. Furthermore, everything is allowed to take place on the REAL system with DefenseWall, and everything is allowed initial execution - there is no direct virtualisation or direct anti-execution at all. Without these 2 aspects, I feel that DefenseWall isn't as strong as many people suggest.

I know a lot of Wilders posters claim that they have tested a lot of malware against DefenseWall, and that it is rock solid. Well, I've tested a lot of real-world malware against Windows' built-in security (LUA + SRP...or even just SRP alone), and nothing has ever bypassed it either. The same goes for Sandboxie with start/run restrictions in place. The fact is that if you simply want to protect yourself from real-world malware, there are much cheaper solutions that don't involve annual fees etc. Anyway, I digress haha.

ssj100 said:
"Furthermore, everything is allowed to take place on the REAL system with DefenseWall, and everything is allowed initial execution - there is no direct virtualisation or direct anti-execution at all. Without these 2 aspects, I feel that DefenseWall isn't as strong as many people suggest."

100% agree. The concept of "frozen" malware,while I understand it,
I just could never get comfortable with the idea.

noor

Exactly mate.

And by the way, the following are some of what demoneye and myself tried to bring up on Wilders about a year ago, and we got criticised heavily:
http://www.wilderssecurity.com/showpost.php?p=1663455&postcount=14
http://www.wilderssecurity.com/showpost.php?p=1663989&postcount=33
http://www.wilderssecurity.com/showpost.php?p=1664776&postcount=54

Interesting how finally one of their other respected members have also brought these issues up! He'd better be careful...

I also brought these issues up when I was seeking support from Ilya on the DefenseWall forums, and got heavily criticised from the forum administrators (but not from Ilya mind you) with no helpful feedback whatsoever. In fact, I recall they resorted to insulting me via PM haha, which I found was a rather low thing to do for a forum admin.

By the way, if you are using DefenseWall, don't forget to add your archiver (eg. WinRAR, 7-Zip etc) as "Untrusted". Why?

Well, if your archiver is not in the "Untrusted" program list, and you:
1. Zip an untrusted folder or file
2. Then unzip the untrusted folder or file

Those folders/files will come out trusted by DefenseWall! Mind you, this was with version 2.56. I might have to test it with the latest version, but I'm quite certain the same issue will remain.

Also, I note on other forums that several people are still using Sandboxie with DefenseWall! Very dangerous stuff in my opinion. When I was testing this combination, I often noticed some strange conflicts as well as "untrusted" files becoming "trusted" when moved in and out of the sandbox. In other words, Sandboxie appeared to be cancelling out DefenseWall's protective mechanisms and vice versa! No big surprise, considering both programs hook the kernel big time.

Thanks ssj100.
When I tried DefenceWall,I tried using it instead of Sandboxie.
My problem was with Files set as untrusted,being commited to the real disk from Returnil 2008,and not retaining untrusted status after reboot.

Maybe that is to be expected,but it is still rather useless from a security
prespective.
When I raised exactly the same issues about 7-Zip,media players and the like,one of the Gladiator forum Gurus,spoke to me as if I were an idiot.

The upshot of his advice,"Why untrust these applications? Dont you know if you archieves,music,pdfs,are clean? You just do not understand DefenceWall!!!"

At that point I decided I probably did not,but I understood enough,I went back to Sandboxie.

Bellgamin was a surprise!! Oh,well he is like a tenured professor,he can speak his mind.

By the way,what are you feelings about Returnil 2010?
Or did you play with it in VirtualBox,other than testing the website log in thing?

I thank it is WAY to heavey,and creates a distinct slowdown.(system wide)

Returnil 2008 was a classic,lean,mean,with a nice anti-executable module that worked in and out of protected mode.
I preferred it to ShadowDefender.


noor

Yes, I can see how you would like Returnil 2008. Returnil 2010? It's got an antivirus in it...enough said.

Better than Shadow Defender? In what way? I'm glad there isn't an anti-executable module with Shadow Defender, since I have (arguably) the best system-wide anti-executable out there called SRP! I just want a light system virtualiser for when I need it (read my security setup/approach post)...and nothing else. And that's exactly what Shadow Defender gives me.

Anyway, back on topic, good luck to those using DefenseWall. I'll leave you with this, just to rub it in more haha:
http://www.sandboxie.com/phpbb/viewtopic.php?t=7538