Feeds

Network ICE hits back over Gibson jibes

BlackICE Defender is not a firewall

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Network ICE has responded angrily to claims by security consultant Steve Gibson that its product, BlackICE Defender is "lame" and claims that it is "actually good for something fly in the face of logic and reality".

Gibson made the strong comments during a widely-read piece on his grc.com Web site concerning DDoS attacks he was suffering. He discovered that the attack was being co-ordinated through programs called Trojans saved on innocent people's machines.

These programs enable an external person to make that computer send thousands upon thousands of data packets to a particular Web site address and take up all the available bandwidth, effectively removing the site from the Internet.

Once Mr Gibson had found the Trojan program, he tested to see whether two security products - ZoneAlarm and BlackICE Defender - would discover the program if it tried to install itself on your hard disc.

ZoneAlarm - which is free - gave "perfect performance" according to Gibson, but the latest version of BlackICE Defender, which costs $39.95, had "absolutely no effect whatsoever". Gibson then proceeded to mock the product, offering a copy of it "only used once" to anyone that wanted it.

Network ICE, however, has produced an official response in which it says Mr Gibson has made a major error in labelling its product as a firewall.

"BlackICE Defender is not a firewall. Its primary function is that of an intrusion detection system," it says. "BlackICE Defender is, in reality, a 'hybrid' between intrusion detection and firewall protection."

It then goes on to mention Mr Gibson: "Unfortunately, Mr. Gibson consistently labels BlackICE as only a firewall, and expects it to respond as other 'firewall only' products do. Most intrusion-detection products are designed to guard against incoming intrusions. Mr. Gibson either does not understand the difference, or he chooses to ignore it."

It then goes on to say that BlackICE will detect the Sub7 virus - the one that Mr Gibson categorically said it didn't. The explanation of this dichotomy is as follows: "As far as I can tell from reading Mr. Gibson's description, he installed BlackICE on the infected machine AFTER the infection had occurred and AFTER the connection with the 'control program' had already been established. This is part of the reason for the supposed 'failure' of BlackICE.

"BlackICE has never claimed to be a virus protection product. If someone sends you the Trojan activation command, BlackICE will alert you. If you have accidentally downloaded the dormant Trojan, and it tries to respond to a Trojan activation command, BlackICE will alert you. However, BlackICE cannot protect you if you already have an ACTIVE Trojan on your system prior to installing BlackICE. It has never claimed to protect against this."

There's some more stuff until it launches into Mr Gibson again: "I find it interesting that Mr. Gibson does not appear inclined to test out how effective particular anti-virus products appear to be in identifying, stopping, and removing this Trojan. Since Trojans are one of the things that these products are designed to protect against, I am curious as to why Mr. Gibson omitted them from his 'testing'."

It goes on and on and finally ends by offering Steve Gibson a refund on his copy of BlackICE.

NetworkICE isn't the only company Mr Gibson managed to upset with his piece. Microsoft is furious that he said its new OS Windows XP would make the Internet unstable, other security experts doubt his conclusions and hackers have bombarded his site to make their feelings felt. ®

Related Stories

Security expert waves DDoS white flag
Windows XP will make Internet unstable - top security expert
Everything you wanted to know about DDoS attacks

Choosing a cloud hosting partner with confidence

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.