Greetings --
You're the one who "doesn't get it." Your constant harping on
this one subject has become quite tiresome. Why are you so obsessed
with the messenger service? Why do you so adamantly defend those who
offer harmful advice? Have you no other interests?
You are really FULL OF IT. I have NEVER defended those "who offer
harmful advice". I have NEVER advocated or defended the advise to
only turn off the Messenger Service. You can imply it all you want
to, but it simply is not true and only serves to continue to discredit
you.
You, on the other hand seem to be obsessed in making sure others have
the Messenger Service turned on and bashing those who would disagree.
Let's try one last time, and I'll keep it as simple as I can.
Yes, lets try.
Turning off the messenger service, in and of itself, is _not_ a
viable security solution. Yes, a vulnerability has been discovered,
announced, and a patch provided. However, there is, to date, no known
exploit of this vulnerability. (I don't doubt that some clown will
feel the need to develop one, though, just to prove he can, now that
the weakness has been publicly announced. Hopefully, people will have
learned their lesson from Blaster, and actually pay a little bit of
attention, this time.) If one has a _properly configured_ firewall,
this - or any other, yet to be discovered - vulnerability stands very,
very little chance of ever causing a problem.
You are defending a position that lacks depth in security knowledge.
1. No known exploit does not mean there's not one out there.
Generally these exploits are known only when the hackers have tired of
them and want some recognition. This is not the wisdom from myself
but words directly from various security companies like ISS. Even if
there is no exploit, this just means that those who were unnecessarily
running it dodged a bullet.
2. The point remains that it is a basic security rule to enable only
those things you need. Why? because just of this type of scenario.
If you had disabled the Messenger Service, you would not be at risk to
this vulnerability which could allow a hacker complete control of your
system. Even if you patched, you still need to turn it off if not
needed to avoid future risks like this.
3. Yes, a patch is available. So this service is bulletproof, now
right? We know that there can never be any more vulnerabilities in
this service right? WRONG. You were so certain before that it was
perfectly safe to run this service even if unneeded and even heralded
the benefits of leaving it turned on as a mechanism of warning. What
you were also unknowingly doing was advised those to run a service
that wasn't needed that had a vulnerability (and still may have
several, for all we know) which possibly given a hacker control of
their system where they might otherwise not had.
4. Firewalls are NOT the panacea that you paint. They are not
bulletproof and it is extremely foolish to put all your security eggs
in the firewall basket. It is another very basic security tenet to
have a multilayered defense. Depending on a firewall to protect you
100% is foolish.
The advice offered by many to turn off the messenger service as
the sole action necessary stop messenger service spam -- advice which
you have been so tenaciously adamant about defending -- is completely
irresponsible. Doing so "protects" the computer from one theoretical,
undefined threat, and the user from some annoying but harmless
interruptions, at the expense of leaving the computer completely
vulnerable to other, very real, exploits, such as W32.Blaster.Worm.
I have to say it. You, sir, are a liar. I have never defended the
action of only turning off the Messenger Service. I have always
advocated first establishing a firewall and then addressing turning
off unneeded services.
Granted, one of the basic security precautions is to turn off any
processes/services that are not needed. Doing so, however, should be
done with the full knowledge that such an action does not protect the
computer from the most common threats extant. If a user is confident
that he has no need of the messenger service, he's perfectly welcome
to turn it off. I've never said otherwise, although I do think that,
on balance of the relative risks,
You've been very, very resistant to the idea of turning off the
Messenger Service. Although, I won't lie (like you have) and insist
that you have insisted that it should always stay on.
the messenger service does serve a
useful purpose as a "canary in the mine shaft" to warn of a firewall
failure. Messenger service spam is constantly being broadcast, and is
much more likely to show up than is any other yet-to-be-developed
exploit.
OK, lets just leave this unneeded service on just because it has some
kind unintended side affect of *possibly* warning the individual of
some port being open. This warning is not very reliable. A user can
have that port open and there's no guarantee the kindly spammers
sending their messages will make their way to the system. IMHO no
real security expert would ever dream to advise a user to run an
unneeded service just for the purpose of the possibility that it may
alert the user to an open port. If a hacker gets past the firewall,
he is not going to send a kindly Messenger pop-up to alert the user to
his presence, either. It is a very weak argument.
Now, who is going to determine whether any given user has other
needs of the messenger service? Does he have an antivirus application
that uses the Alerter service, which is dependent upon the messenger
service? Is he using a UPS-monitoring utility that has the same
needs? Can you confidently assert that the millions of "John Q.
Publics" can all safely disable the messenger service on their many
millions of different PCs, with millions of different combinations of
applications and utilities?
That is a different argument that I have already hashed out with
others. AS I HAVE SAID OVER AND OVER AGAIN, disable it if you don't
need it. If you do need it, certainly patch it and keep it on. I
don't know how many times I have to say this. You seem to be on a
witch hunt to burn at the stake anyone who remotely suggests that the
Messenger Service should be turned off despite the context in which it
is said.
I submit that the vast majority of
computer users in the general public have absolutely no idea -- nor
any real desire to learn -- whether or not they need or use the
messenger, or any other specific, service.
This has been addressed in another thread. I have already
acknowledged these issues. I have agreed with others that if the user
is a novice and/or does not have the compunction to find out if they
need the service, the best advice is to leave it on. I have repeated
that sentiment as well. The advice to turn it off if unneeded is
largely targeted to a user above the novice or apathetic level.
However, to not mention that, IMO is giving incomplete security
advice.
To cavalierly pronounce
that everyone should just turn off an operating system process,
regardless of the millions of individual specific computing
configurations, situations, needs, and environments is the height of
irresponsibility.
Again, I do not insist that everyone should just arbitrarily turn off
this service or any other. The witch hunt continues.
