Feeds

Network ICE hits back over Gibson jibes

BlackICE Defender is not a firewall

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

Network ICE has responded angrily to claims by security consultant Steve Gibson that its product, BlackICE Defender is "lame" and claims that it is "actually good for something fly in the face of logic and reality".

Gibson made the strong comments during a widely-read piece on his grc.com Web site concerning DDoS attacks he was suffering. He discovered that the attack was being co-ordinated through programs called Trojans saved on innocent people's machines.

These programs enable an external person to make that computer send thousands upon thousands of data packets to a particular Web site address and take up all the available bandwidth, effectively removing the site from the Internet.

Once Mr Gibson had found the Trojan program, he tested to see whether two security products - ZoneAlarm and BlackICE Defender - would discover the program if it tried to install itself on your hard disc.

ZoneAlarm - which is free - gave "perfect performance" according to Gibson, but the latest version of BlackICE Defender, which costs $39.95, had "absolutely no effect whatsoever". Gibson then proceeded to mock the product, offering a copy of it "only used once" to anyone that wanted it.

Network ICE, however, has produced an official response in which it says Mr Gibson has made a major error in labelling its product as a firewall.

"BlackICE Defender is not a firewall. Its primary function is that of an intrusion detection system," it says. "BlackICE Defender is, in reality, a 'hybrid' between intrusion detection and firewall protection."

It then goes on to mention Mr Gibson: "Unfortunately, Mr. Gibson consistently labels BlackICE as only a firewall, and expects it to respond as other 'firewall only' products do. Most intrusion-detection products are designed to guard against incoming intrusions. Mr. Gibson either does not understand the difference, or he chooses to ignore it."

It then goes on to say that BlackICE will detect the Sub7 virus - the one that Mr Gibson categorically said it didn't. The explanation of this dichotomy is as follows: "As far as I can tell from reading Mr. Gibson's description, he installed BlackICE on the infected machine AFTER the infection had occurred and AFTER the connection with the 'control program' had already been established. This is part of the reason for the supposed 'failure' of BlackICE.

"BlackICE has never claimed to be a virus protection product. If someone sends you the Trojan activation command, BlackICE will alert you. If you have accidentally downloaded the dormant Trojan, and it tries to respond to a Trojan activation command, BlackICE will alert you. However, BlackICE cannot protect you if you already have an ACTIVE Trojan on your system prior to installing BlackICE. It has never claimed to protect against this."

There's some more stuff until it launches into Mr Gibson again: "I find it interesting that Mr. Gibson does not appear inclined to test out how effective particular anti-virus products appear to be in identifying, stopping, and removing this Trojan. Since Trojans are one of the things that these products are designed to protect against, I am curious as to why Mr. Gibson omitted them from his 'testing'."

It goes on and on and finally ends by offering Steve Gibson a refund on his copy of BlackICE.

NetworkICE isn't the only company Mr Gibson managed to upset with his piece. Microsoft is furious that he said its new OS Windows XP would make the Internet unstable, other security experts doubt his conclusions and hackers have bombarded his site to make their feelings felt. ®

Related Stories

Security expert waves DDoS white flag
Windows XP will make Internet unstable - top security expert
Everything you wanted to know about DDoS attacks

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.