News

Microsoft to Change Windows XP Firewall Defaults in Wake of Blaster Worm

Microsoft will change the default firewall settings for new shipments of Windows XP in response to the wide spread of the Blaster worm, according to published reports.

Blaster, also known as MS Blast, Lovsan and Poza, began spreading late Monday through an error in Microsoft's programming of the Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) that Microsoft patched in mid-July. The worm exploits the flaw automatically without requiring users to make any mistake beyond leaving a system unpatched.

While the Blaster worm can affect Windows 2000, the worm is programmed to attack Windows XP about 80 percent of the time.

Microsoft director of security strategy Steven Lipner told The New York Times that Microsoft will begin shipping Windows XP with its built-in Internet Connection Firewall fully activated. The firewall, which was first introduced to Windows with Windows XP in 2001, is fully enabled by default in Windows Server 2003.

"Doing it the way we did was probably the right decision when we shipped XP," Lipner told the newspaper. "Obviously times change, and the things we do to protect our customers change." Windows XP launched about three months before Microsoft chairman and chief software architect formally made security Microsoft's top priority with his Trustworthy Computing memo in January 2002.

The move is welcomed by one security expert as a first step for Microsoft to improve security by going back to re-evaluate shipping products, rather than reserving security changes for future products. In a note to his NTBugtraq security mailing list, longtime Trustworthy Computing critic Russ Cooper, wrote: "The significance here to me is that this is the first time that Microsoft has ever gone back and altered the defaults of an existing product. Historically, you wouldn't see such a change until the next major version release of the OS. This is a clear sign that there is an understanding that existing systems are as important as future versions."

In addition to recommending that users apply the patch, Microsoft and other security organizations have recommended that organizations and customers use firewalls to close off a number of ports known to be involved in the Blaster attack.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Report: Cost, Sustainability Drive DaaS Adoption Beyond Remote Work

    Gartner's 2025 Magic Quadrant for Desktop as a Service reveals that while secure remote access remains a key driver of DaaS adoption, a growing number of deployments now focus on broader efficiency goals.

  • Windows 365 Reserve, Microsoft's Cloud PC Rental Service, Hits Preview

    Microsoft has launched a limited public preview of its new "Windows 365 Reserve" service, which lets organizations rent cloud PC instances in the event their Windows devices are stolen, lost or damaged.

  • Hands-On AI Skills Now Outshine Certs in Salary Stakes

    For AI-related roles, employers are prioritizing verifiable, hands-on abilities over framed certificates -- and they're paying a premium for it.

  • Roadblocks in Enterprise AI: Data and Skills Shortfalls Could Cost Millions

    Businesses risk losing up to $87 million a year if they fail to catch up with AI innovation, according to the Couchbase FY 2026 CIO AI Survey released this month.