Network ICE hits back over Gibson jibes

BlackICE Defender is not a firewall


Network ICE has responded angrily to claims by security consultant Steve Gibson that its product, BlackICE Defender is "lame" and claims that it is "actually good for something fly in the face of logic and reality".

Gibson made the strong comments during a widely-read piece on his grc.com Web site concerning DDoS attacks he was suffering. He discovered that the attack was being co-ordinated through programs called Trojans saved on innocent people's machines.

These programs enable an external person to make that computer send thousands upon thousands of data packets to a particular Web site address and take up all the available bandwidth, effectively removing the site from the Internet.

Once Mr Gibson had found the Trojan program, he tested to see whether two security products - ZoneAlarm and BlackICE Defender - would discover the program if it tried to install itself on your hard disc.

ZoneAlarm - which is free - gave "perfect performance" according to Gibson, but the latest version of BlackICE Defender, which costs $39.95, had "absolutely no effect whatsoever". Gibson then proceeded to mock the product, offering a copy of it "only used once" to anyone that wanted it.

Network ICE, however, has produced an official response in which it says Mr Gibson has made a major error in labelling its product as a firewall.

"BlackICE Defender is not a firewall. Its primary function is that of an intrusion detection system," it says. "BlackICE Defender is, in reality, a 'hybrid' between intrusion detection and firewall protection."

It then goes on to mention Mr Gibson: "Unfortunately, Mr. Gibson consistently labels BlackICE as only a firewall, and expects it to respond as other 'firewall only' products do. Most intrusion-detection products are designed to guard against incoming intrusions. Mr. Gibson either does not understand the difference, or he chooses to ignore it."

It then goes on to say that BlackICE will detect the Sub7 virus - the one that Mr Gibson categorically said it didn't. The explanation of this dichotomy is as follows: "As far as I can tell from reading Mr. Gibson's description, he installed BlackICE on the infected machine AFTER the infection had occurred and AFTER the connection with the 'control program' had already been established. This is part of the reason for the supposed 'failure' of BlackICE.

"BlackICE has never claimed to be a virus protection product. If someone sends you the Trojan activation command, BlackICE will alert you. If you have accidentally downloaded the dormant Trojan, and it tries to respond to a Trojan activation command, BlackICE will alert you. However, BlackICE cannot protect you if you already have an ACTIVE Trojan on your system prior to installing BlackICE. It has never claimed to protect against this."

There's some more stuff until it launches into Mr Gibson again: "I find it interesting that Mr. Gibson does not appear inclined to test out how effective particular anti-virus products appear to be in identifying, stopping, and removing this Trojan. Since Trojans are one of the things that these products are designed to protect against, I am curious as to why Mr. Gibson omitted them from his 'testing'."

It goes on and on and finally ends by offering Steve Gibson a refund on his copy of BlackICE.

NetworkICE isn't the only company Mr Gibson managed to upset with his piece. Microsoft is furious that he said its new OS Windows XP would make the Internet unstable, other security experts doubt his conclusions and hackers have bombarded his site to make their feelings felt. ®

Related Stories

Security expert waves DDoS white flag
Windows XP will make Internet unstable - top security expert
Everything you wanted to know about DDoS attacks


Other stories you might like

  • Yet again, Cream Finance skimmed by crooks: $130m in crypto assets stolen

    Third time's the unlucky charm for loan outfit

    Decentralized finance biz Cream Finance became further decentralized on Wednesday with the theft of $130m worth of crypto assets from its Ethereum lending protocol.

    Cream (cream.finance and not creamfinance.com) reported the loss via Twitter, the third such incident for the loan platform this year.

    "Our Ethereum C.R.E.A.M. v1 lending markets were exploited and liquidity was removed on October 27, 1354 UTC," the Taiwan-based biz said. "The attacker removed a total of ~$130m USD worth of tokens from these markets, using this address. No other markets were impacted."

    Continue reading
  • OpenID-based security features added to GitHub Actions as usage doubles

    Single-use tokens and reusable workflows explained at Universe event

    GitHub Universe GitHub Actions have new security based on OpenID, along with the ability to create reusable workflows, while usage has nearly doubled year on year, according to presentations at the Universe event.

    The Actions service was previewed three years ago at Universe 2018, and made generally available a year later. It was a huge feature, building automation into the GitHub platform for the first time (though rival GitLab already offered DevOps automation).

    It require compute resources, called runners, which can be GitHub-hosted or self-hosted. Actions are commands that execute on runners. Jobs are a sequence of steps that can be Actions or shell commands. Workflows are a set of jobs which can run in parallel or sequentially, with dependencies. For example, that deployment cannot take place unless build and test is successful. Actions make it relatively easy to set up continuous integration or continuous delivery, particularly since they are cloud-hosted and even a free plan offers 2,000 automation minutes per month, and more than that for public repositories.

    Continue reading
  • REvil gang member identified living luxury lifestyle in Russia, says German media

    Die Zeit: He's got a Beemer, a Bitcoin watch and a swimming pool

    German news outlets claim to have identified a member of the infamous REvil ransomware gang – who reportedly lives the life of Riley off his ill-gotten gains.

    The gang member, nicknamed Nikolay K by Die Zeit newspaper and the Bayerische Rundfunk radio station, reportedly owns a €70,000 watch with a Bitcoin address engraved on its face and rents yachts for €1,300 a day whenever he goes on holiday.

    "He seems to prefer T-shirts from Gucci, luxurious BMW sportscars and large sunglasses," reported Die Zeit, which partly identified him through social media videos posted by his wife.

    Continue reading

Biting the hand that feeds IT © 1998–2021