BlackICE Defender

~ the obituary ~

A personal firewall in the year 2000 was a piece of software that told you, several times an hour, that a stranger had touched your computer. BlackICE Defender was the one that did it with the most authority. It was not really a packet filter to begin with. It was an intrusion detection engine, the kind of thing that sat on corporate networks, shrunk down to run on one Windows machine hanging off a dial-up line.

Robert Graham wrote the engine in 1998 at Network ICE, a startup in San Mateo, and it shipped in more than one shape. Defender was the desktop build. The same code also ran as a network sensor at a full gigabit and as an inline box that dropped hostile traffic instead of just noticing it, which is why Graham has since called it the first intrusion prevention system rather than a detector.

Internet Security Systems announced it was buying Network ICE on 30 April 2001 and closed in June, for a package of stock and assumed options worth roughly $237 million. Defender was renamed BlackICE PC Protection and grew an application control layer that watched outbound connections too. By then ZoneAlarm had the free end of the market and Norton had the shelf space, so BlackICE settled into being the one technical people recommended to each other.

What dates this whole category is the shape of a home connection. On a dial-up line the modem handed the machine a public address and nothing sat in front of it, so every service Windows had left listening was reachable from anywhere in the world. That was my situation for years in Ankara, first on 33.6k and then 56k, and later on the first ADSL line. What killed the personal firewall as a thing people bought was not a better personal firewall. It was the cheap plastic router. Once a house had a box doing address translation, the machines behind it stopped being addressable, and the problem BlackICE sold against went away without anyone buying anything.

~ the case file ~

~ what it actually did ~

The back trace was the feature people talked about. When BlackICE decided it had seen an attack it would try to work out where the attack came from, walking back toward the source and collecting what it could about the machine at the other end, and the interface would put a name and a country in front of you. In 2000 that felt like the software was fighting back on your behalf. In practice most of what it flagged was weather: port scans hitting every address in a range, worms knocking on anything that answered.

It was also strict by default, which is why the technical crowd liked it and why ordinary users did not. It reported things other products silently discarded. A machine that had been online for one evening could produce a log with a hundred entries in it, and a first-time reader of that log concluded, reasonably enough, that they were under sustained personal attack. They were not. They were simply on the internet, which by 2001 meant standing outside in a permanent drizzle of automated probing.

~ the night of 19 march ~

eEye found a buffer overflow on 8 March 2004 in the part of the ISS engine that parsed ICQ traffic. The advisory went public on 18 March. The worm was on the wire the following evening at 8:45pm Pacific, which was at the time the shortest gap anyone had recorded between a vulnerability being announced and a worm using it.

It got called Witty because of a string in the payload. Speed was not what made it different, although it was fast: roughly 110 machines in the first ten seconds and the whole reachable population inside three quarters of an hour. What made it different was that it did damage deliberately. Witty wrote 65 kilobytes of garbage to a random point on the disk and then did it again, and kept going until the machine fell over. It was the first widely spread worm to carry a destructive payload.

The population was small, about 12,000 machines, because it only worked against ISS products. That is the part the industry kept. The bug lived in debug code that had been left inside a shipping product, the shipping product was a security product, and every machine it destroyed belonged to somebody who had installed extra software specifically so that this would not happen to them. ISS commissioned outside audits afterward and imposed code coverage rules, and Graham has written that he spent the following stretch travelling to apologize to customers in person.

~ the actual end ~

IBM bought ISS in August 2006 for $1.3 billion and the consumer line did not survive the review. In August 2007 IBM Internet Security Systems announced that BlackICE PC Protection and BlackICE Server Protection had reached end of sale on 19 September 2007, with end of life a year later on 29 September 2008. There was no successor product. IBM was not in the business of selling desktop software to households and said so in as many words.

What happened next was unusual. Sunbelt Software, which had bought the Kerio Personal Firewall and put its own name on it, registered saveblackice.com and handed BlackICE owners a free copy of its product with a year of updates and support. A competitor absorbing an abandoned userbase for nothing is not a common ending. It was also a correct reading of the moment. By 2008 the paid personal firewall was a legacy purchase, Windows had been shipping its own since XP Service Pack 2, and the people being rescued were the last of their kind.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »