This article is more than 1 year old

Network ICE hits back over Gibson jibes

BlackICE Defender is not a firewall

Network ICE has responded angrily to claims by security consultant Steve Gibson that its product, BlackICE Defender is "lame" and claims that it is "actually good for something fly in the face of logic and reality".

Gibson made the strong comments during a widely-read piece on his grc.com Web site concerning DDoS attacks he was suffering. He discovered that the attack was being co-ordinated through programs called Trojans saved on innocent people's machines.

These programs enable an external person to make that computer send thousands upon thousands of data packets to a particular Web site address and take up all the available bandwidth, effectively removing the site from the Internet.

Once Mr Gibson had found the Trojan program, he tested to see whether two security products - ZoneAlarm and BlackICE Defender - would discover the program if it tried to install itself on your hard disc.

ZoneAlarm - which is free - gave "perfect performance" according to Gibson, but the latest version of BlackICE Defender, which costs $39.95, had "absolutely no effect whatsoever". Gibson then proceeded to mock the product, offering a copy of it "only used once" to anyone that wanted it.

Network ICE, however, has produced an official response in which it says Mr Gibson has made a major error in labelling its product as a firewall.

"BlackICE Defender is not a firewall. Its primary function is that of an intrusion detection system," it says. "BlackICE Defender is, in reality, a 'hybrid' between intrusion detection and firewall protection."

It then goes on to mention Mr Gibson: "Unfortunately, Mr. Gibson consistently labels BlackICE as only a firewall, and expects it to respond as other 'firewall only' products do. Most intrusion-detection products are designed to guard against incoming intrusions. Mr. Gibson either does not understand the difference, or he chooses to ignore it."

It then goes on to say that BlackICE will detect the Sub7 virus - the one that Mr Gibson categorically said it didn't. The explanation of this dichotomy is as follows: "As far as I can tell from reading Mr. Gibson's description, he installed BlackICE on the infected machine AFTER the infection had occurred and AFTER the connection with the 'control program' had already been established. This is part of the reason for the supposed 'failure' of BlackICE.

"BlackICE has never claimed to be a virus protection product. If someone sends you the Trojan activation command, BlackICE will alert you. If you have accidentally downloaded the dormant Trojan, and it tries to respond to a Trojan activation command, BlackICE will alert you. However, BlackICE cannot protect you if you already have an ACTIVE Trojan on your system prior to installing BlackICE. It has never claimed to protect against this."

There's some more stuff until it launches into Mr Gibson again: "I find it interesting that Mr. Gibson does not appear inclined to test out how effective particular anti-virus products appear to be in identifying, stopping, and removing this Trojan. Since Trojans are one of the things that these products are designed to protect against, I am curious as to why Mr. Gibson omitted them from his 'testing'."

It goes on and on and finally ends by offering Steve Gibson a refund on his copy of BlackICE.

NetworkICE isn't the only company Mr Gibson managed to upset with his piece. Microsoft is furious that he said its new OS Windows XP would make the Internet unstable, other security experts doubt his conclusions and hackers have bombarded his site to make their feelings felt. ®

Related Stories

Security expert waves DDoS white flag
Windows XP will make Internet unstable - top security expert
Everything you wanted to know about DDoS attacks

More about

TIP US OFF

Send us news


Other stories you might like