Firewall Issues

Pocah · Dec 20, 2023

I am having an ever-increasing issue with the Win 11 firewall.

Apps are bypassing it. The latest one is iCUE.

This app, from Corsair, is a darn nuisance, because Corsair can't develop software to save their lives and often release a new version that has fatal problems. To limit damage, I block updates in the firewall, and then check the forum before manually updating. Problem is that now it seems that iCUE can see right through the firewall despite attempts to block it. I blocked the app, the loader and the updater. Doesn't stop it.

I don't understand the situation here, but what I am wondering is, is there a better firewall app to help out with this situation?

TairikuOkami · Dec 20, 2023

Even when you enable outbound blocking and remove default rules, windows firewall adds them back at will.
You have to use something like Binisoft WFC, it will protect rules from tampering by an app with admin rights.

zebal · Dec 20, 2023

If you create a new rule for the app in question and set it to block outbound (and optionally inbound) then any rule that allows that specific app will have no effect.

Those rules which allow it are created by that app, deleting them doesn't help since they can be recreated without your knowledge, but creating block rule voids them all because block rule has precedence over allow rules.

TairikuOkami · Dec 20, 2023

zebal said:
Those rules which allow it are created by that app, deleting them doesn't help since they can be recreated without your knowledge, but creating block rule voids them all because block rule has precedence over allow rules.

Yes, but Windows works in mysterious ways and it presumes that user is always wrong, like accidentally blocking an app.
Besides apps change with an each update, so blocking an exe will not block an updated exe. I had a problem to enable them.

C:\program files\windowsapps\microsoft.windowsstore_22311.1401.2.0_x64__8wekyb3d8bbwe\winstore.app.exe

zebal · Dec 20, 2023

TairikuOkami said:
Besides apps change with an each update, so blocking an exe will not block an updated exe.

Agree with that! in an app is updated then block rule might no longer be valid due to path or file name change, so you'd need to recreate or update the block rule.

Pocah · Dec 20, 2023

TairikuOkami said:
Yes, but Windows works in mysterious ways and it presumes that user is always wrong, like accidentally blocking an app.

Yes, this seems to be what I am finding. With iCUE, on two other PC's the block in the firewall seems to work, but not on the third. I can't for the life of me find out why.

This is what I find annoying about Firewall, there seems to be a depth of function that is just not accessible to the end user.

TairikuOkami · Dec 20, 2023

Pocah said:
Yes, this seems to be what I am finding.

You can try to block it per name, if you do not use it, like:

Code:

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowRun" /t REG_DWORD /d "1" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "iCUE.exe" /f

zebal said:
in an app is updated then block rule might no longer be valid due to path or file name change

Indeed, WFC solved that issue by providing a "secret" wildcard (due to malware) based on the file name or path (in capital letters).

zebal · Dec 20, 2023

TairikuOkami said:
Indeed, WFC solved that issue by providing a "secret" wildcard based on the file name or path (in capital letters).

I'm curious what would happen if malware is renamed to a name which the WFC allows as wildcard?
I assume it would allow malware out the same way it allows legitimate program?

TairikuOkami · Dec 20, 2023

zebal said:
I assume it would allow malware out the same way it allows legitimate program?

Yes, thus the reason, it is preferable to allow only based on a "protected" path and not allow something like Temp folder. Then again, unless someone would be in a targeted attack, it does not really matter. Most people give away their PC for mere asking (phishing).

zebal · Dec 20, 2023

@Pocah
If you want to do it in Windows firewall see tutorial below on how to block a program in Windows firewall.

How to Block a Program in a Firewall in 6 Steps (Easy Tutorial)

Blocking a program in a firewall can vary in difficulty. Learn the steps of how to block programs in the most common firewalls.

www.enterprisestorageforum.com

When you get to step where a program needs to be chosen specify full path to program you want to block, ex. iCUE path and executable.
You need to update this block rule every time the program in question is updated.