News

Microsoft to Change Windows XP Firewall Defaults in Wake of Blaster Worm

Microsoft will change the default firewall settings for new shipments of Windows XP in response to the wide spread of the Blaster worm, according to published reports.

Blaster, also known as MS Blast, Lovsan and Poza, began spreading late Monday through an error in Microsoft's programming of the Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) that Microsoft patched in mid-July. The worm exploits the flaw automatically without requiring users to make any mistake beyond leaving a system unpatched.

While the Blaster worm can affect Windows 2000, the worm is programmed to attack Windows XP about 80 percent of the time.

Microsoft director of security strategy Steven Lipner told The New York Times that Microsoft will begin shipping Windows XP with its built-in Internet Connection Firewall fully activated. The firewall, which was first introduced to Windows with Windows XP in 2001, is fully enabled by default in Windows Server 2003.

"Doing it the way we did was probably the right decision when we shipped XP," Lipner told the newspaper. "Obviously times change, and the things we do to protect our customers change." Windows XP launched about three months before Microsoft chairman and chief software architect formally made security Microsoft's top priority with his Trustworthy Computing memo in January 2002.

The move is welcomed by one security expert as a first step for Microsoft to improve security by going back to re-evaluate shipping products, rather than reserving security changes for future products. In a note to his NTBugtraq security mailing list, longtime Trustworthy Computing critic Russ Cooper, wrote: "The significance here to me is that this is the first time that Microsoft has ever gone back and altered the defaults of an existing product. Historically, you wouldn't see such a change until the next major version release of the OS. This is a clear sign that there is an understanding that existing systems are as important as future versions."

In addition to recommending that users apply the patch, Microsoft and other security organizations have recommended that organizations and customers use firewalls to close off a number of ports known to be involved in the Blaster attack.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • FTC Expands Microsoft Antitrust Investigation Under Trump Administration

    The Federal Trade Commission (FTC) is pressing ahead with a broad investigation into Microsoft's business practices, an inquiry that began in the final weeks of the Biden administration.

  • An image of planes flying around a globe

    2025 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Microsoft to Shut Down Skype Services

    Microsoft will discontinue its Skype telecommunications and video calling services on May 5, 2025, marking the end of the platform's decades-long run.

  • Big Blue To Acquire Datastax in Enterprise AI Play

    In a bid to bolster its enterprise-aimed AI capabilities, IBM is planning to acquire Datastax, a leading AI and data solutions provider, for an undisclosed amount.