[QUOTE=Vicsun]<snip>
I was under the impression Trojan Horses, like viruses, are at their core applications - to get my computer remotely controlled (and f.ex. used in a DDoS attack) I'd have to manually open a file which actually executes code on my machine. And it won't really take me a long time to notice the massive amounts of outbound traffic a DDoS attack from my computer would generate
Can you be a bit more technical on how? I'm certain an open port number, by itself, is not enough for an attacker to run code on my machine...
<snip>
[/quote]
Well - I'm by no means a security wizard, so I'm not sure how technical I actually can become. I'm more of an experienced user who has some technical knowlegde, and read a lot (it is somewhat related to work)
However - Trojan horses are in effect named for a reason. They act/tell the computer they are something but infact they have the nasty server application payload which if infected will allow the client software direct access to your computer.
A trojan horse communicates with your computer via the IP address and portnumber, and if your port isn't closed for incomming traffic the trojan can infect your computer, and I'm pretty sure they can do so without you having to do anything, because the computer thinks it is a legit packet comming to the port - so why should it ask you to run it? It isn't like the old days when you recived an .exe file via mail, and had to execute it - many things run automatically these days.
Firewalls help here firstly by "closing" all unused ports, so a portscan will not show that the port is active. Further more it will scan incomming traffic for signatures which will reveal if the packet is infact a trojan horse.
Also - software have holes, so while you update windows regular, it will still have security holes that will allow somebody to take control of your computer and execute code. This is why many people "complain" about the security in Internet Explorer because it is riddled with holes allowing for code to be run via it - often these are buffer overflow holes (basically meaning that a long string of information is send to the program which it cant contain fully, so the "left over" string can be interpreted as code, and executed.... I think
)
It is similar, that nowadays "they" can hide code in jpeg images, which if unprotected (software not "up to date") can run even as you view the image itself. Again - it isn't like it was 5 years ago, when such things were much more manuel and much rare.
In the old days you almost only had virus spreads via discs that people lend to each other with games or something similar. Now a days vira and trojan horses are very complex buisness.
As for detecting the traffic if ones computer is used for a DoS attack, then I don't think it will be that noticeble as you seem to indicate. Remember that thousands of computer-zombies are involved in such attacks and try pinging a website/domain and notice how little traffic that generates. It isn't much - however - it isn't really the main argument for a firewall.
One of the arguments is that if do get infected by a trojan, then the trojan will access the Internet - and here the outgoing trafic monitor would kick in and warn you that some service is trying to access the Internet.
Thus the 2 main reasons - in my view for getting a firewall is closing all ports to a port scan, and containing the problem if you do get infected.
[QUOTE=Vicsun]<snip>
While an outbound traffic filter is a relatively interesting feature to have, it's not particularly useful; I rather rely on not acquiring any software that needs to be blocked before it accesses the internet, rather than having blocking it once it's on my computer
<snip>
[/quote]
As with the trojan example just above, a control of outgoing connections/traffic can help contain the issue of if you get infected.
However - many other things happen "behind the screen" which one might not know of.
When I just recently reinstalled windows, then the first thing it tried to do was the Windows printer spooler wanted to access the Internet, some wierd IP located some place obscure. Now I've no doubt that it was a legit request after all I'd only just installed windows - but I saw no reason what so ever to allow that to access the Internet. I didn't even (and still don't) have a printer driver installed and my printer wasn't turned on, so what on earth did it want to go online for.
So while you might think that you have no software which requiers access to the Internet, and thus is "safe" it is very possible that a large number of your software actually is communicating with the Internet without you knowing it.
This is also a privacy issue, I see no reason for letting software vendors know when I use their programs by allowing them to access the Internet and searching for god knows what.
It might be paranoia, but all it takes is one bad seed, and a computer can be infected in a very short time.
Basically - to me - a Firewall is like insurance. While you dont' have need of it, it feels like a waste, but the moment something pops up - it sure felt good that my computer was (somewhat) protected.
[QUOTE=Vicsun]<snip>
I'd argue you're being overly paranoid, but that would have little relevance to the discussion - I've yet to be infected by an e-mail spread virus and get no spam on my main email account so I'm probably doing something right
<snip>
[/quote]
I've had a minor infection once, and have recived multiple e-mails with vira. I've also recived multiple hits on my firewall from Trojan Horses and portscans.
But I might be somewhat paranoid, but I tribute that to actually knowing something of what is going on in some of the greyer areas of the Internet.
I don't think it is neasceary to have an antivirus. But a firewall in my view is a very good thing although maybe not neacesary. I'd think it is perfectly possible to run withouth ever having anything happen - however it is also perfectly possible to get infected after 10mintues of connecting to the Internet. It is all about luck withouth protection.
And it might seem unnesacary, but I'd much rather be safe then sorry. Supposed a keylogging trojan infected your computer without you knowing ... could be quite expensive, in case of for instance homebanking
If you have no problems, then fine - you don't need it, just like you don't need insurance against theft and similar - I'm not trying to convice you. I'm just giving an alternative perspective. I'm no security freak, I just do that little something which makes it harder to get infected, and doing so for such a small price.
I'd much rather pose the question - what do you loose by running a firewall which makes it unwanted. A few percentage of your RAM and CPU speed is about all.
Hmmm - long rambeling, and I've likely said something multiple times, and some of the things might also be wrong
I can't keep up anymore with what I wrote
Edit: or is it "worms" which spread on their own ..... hmm - can't remember, and to lazy to look it up atm