Microsoft to Change Windows XP Firewall Defaults in Wake of Blaster Worm

Microsoft will change the default firewall settings for new shipments of Windows XP in response to the wide spread of the Blaster worm, according to published reports.

Blaster, also known as MS Blast, Lovsan and Poza, began spreading late Monday through an error in Microsoft's programming of the Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) that Microsoft patched in mid-July. The worm exploits the flaw automatically without requiring users to make any mistake beyond leaving a system unpatched.

While the Blaster worm can affect Windows 2000, the worm is programmed to attack Windows XP about 80 percent of the time.

Microsoft director of security strategy Steven Lipner told The New York Times that Microsoft will begin shipping Windows XP with its built-in Internet Connection Firewall fully activated. The firewall, which was first introduced to Windows with Windows XP in 2001, is fully enabled by default in Windows Server 2003.

"Doing it the way we did was probably the right decision when we shipped XP," Lipner told the newspaper. "Obviously times change, and the things we do to protect our customers change." Windows XP launched about three months before Microsoft chairman and chief software architect formally made security Microsoft's top priority with his Trustworthy Computing memo in January 2002.

The move is welcomed by one security expert as a first step for Microsoft to improve security by going back to re-evaluate shipping products, rather than reserving security changes for future products. In a note to his NTBugtraq security mailing list, longtime Trustworthy Computing critic Russ Cooper, wrote: "The significance here to me is that this is the first time that Microsoft has ever gone back and altered the defaults of an existing product. Historically, you wouldn't see such a change until the next major version release of the OS. This is a clear sign that there is an understanding that existing systems are as important as future versions."

In addition to recommending that users apply the patch, Microsoft and other security organizations have recommended that organizations and customers use firewalls to close off a number of ports known to be involved in the Blaster attack.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.


  • What Does Office 365 Support for New Surface Hardware Actually Mean?

    Microsoft has spilled a lot of ink touting the ways that its new Surface-branded peripherals will be bring Office 365 features to life.

  • Azure Active Directory ID Protection 'Refresh' Now Available

    Microsoft's enhancements to the Azure Active Directory Identity Protection service are now said to be "generally available" (GA), or ready for commercial use, per a Wednesday announcement.

  • Microsoft Releases Windows 10 Version 1909

    Microsoft on Tuesday announced the release of Windows 10 version 1909, a new operating system product that's also known as the "Windows 10 November 2019 Update."

  • November Microsoft Security Bundle Addresses 75 Vulnerabilities

    Of that number, 13 vulnerabilities are rated "Critical" to patch, while 62 vulnerabilities are deemed "Important."

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.