Microsoft to Change Windows XP Firewall Defaults in Wake of Blaster Worm

Microsoft will change the default firewall settings for new shipments of Windows XP in response to the wide spread of the Blaster worm, according to published reports.

Blaster, also known as MS Blast, Lovsan and Poza, began spreading late Monday through an error in Microsoft's programming of the Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) that Microsoft patched in mid-July. The worm exploits the flaw automatically without requiring users to make any mistake beyond leaving a system unpatched.

While the Blaster worm can affect Windows 2000, the worm is programmed to attack Windows XP about 80 percent of the time.

Microsoft director of security strategy Steven Lipner told The New York Times that Microsoft will begin shipping Windows XP with its built-in Internet Connection Firewall fully activated. The firewall, which was first introduced to Windows with Windows XP in 2001, is fully enabled by default in Windows Server 2003.

"Doing it the way we did was probably the right decision when we shipped XP," Lipner told the newspaper. "Obviously times change, and the things we do to protect our customers change." Windows XP launched about three months before Microsoft chairman and chief software architect formally made security Microsoft's top priority with his Trustworthy Computing memo in January 2002.

The move is welcomed by one security expert as a first step for Microsoft to improve security by going back to re-evaluate shipping products, rather than reserving security changes for future products. In a note to his NTBugtraq security mailing list, longtime Trustworthy Computing critic Russ Cooper, wrote: "The significance here to me is that this is the first time that Microsoft has ever gone back and altered the defaults of an existing product. Historically, you wouldn't see such a change until the next major version release of the OS. This is a clear sign that there is an understanding that existing systems are as important as future versions."

In addition to recommending that users apply the patch, Microsoft and other security organizations have recommended that organizations and customers use firewalls to close off a number of ports known to be involved in the Blaster attack.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.


  • How To Use .CSV Files with PowerShell, Part 1

    When it comes to bulk administration, few things are handier than .CSV files. In this two-part series, Brien demos his top techniques for working with .CSV files in PowerShell. First up: How to create a .CSV file.

  • SameSite Cookie Changes Rolled Back Until Summer

    The Chromium Project announced on Friday that it's delaying enforcement of SameSite cookie changes, and is temporarily rolling back those changes, because of the COVID-19 turmoil.

  • Basic Authentication Extended to 2H 2021 for Exchange Online Users

    Microsoft is now planning to disable Basic Authentication use with its Exchange Online service sometime in the "second half of 2021," according to a Friday announcement.

  • Microsoft Offers Endpoint Configuration Manager Advice for Keeping Remote Clients Patched

    Microsoft this week offered advice for organizations using Microsoft Endpoint Configuration Manager with remote Windows systems that need to get patched, and it also announced Update 2002.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.