Bitguard Firewall

[WilliamP]

What does anyone know about this firewall. From what I have read it seems to be like System Safety Monitor. Also when I tried to find out how much it cost I couldn't really tell.

[gkweb]

from what i heard it cost 199$ for one year.

[richter]

Hi,

Can anyone provide screenshots of this program or give me a link to them? I haven't been able to find those on its site.

Anyone has any experience with this software? If anyone uses this it'd be awesome if they could provide us with some info about it.

thanks,

richter

[WilliamP]

I don't think the 199 is dollars. Here is the link. http://www.tryus.dk/bitguard.asp

[WilliamP]

It is at Tucows for 53 dollars?

[gkweb]

see what i have when wanting to buy BG, panda AV ??

[bigc73542]

for panda titanium you might want to look at the link.



http://www.softwareoutlet.com/Merchant2/merchant.mvc?Screen=CTGY&Category_Code=UTI-001

[gkweb]

i don't want panda titanium lol
not even BG, but when i click "order BitGuard" i fall on a panda titanium ordering page, it isn't a joke test yourself !

[controler]

Hello

I contacted the web site dev and told him or her that when you click on buy
bitguard , you always get the Panda AV pop up
I think the site has some issues.
I would think any good firewall resaller would have had this corrected along time ago.
It sure appears to be a good firewall.
I am sure you must know by now they use a driver at the ring 0 level\
which means they can do almost anything they want.
What I find hard to understand is all the new hype about ring 0 , when it has been around since windows 95.
I think bitguard costs around 50 bucks USA.
They ned to do some serious work on their resellers web site.

[bigc73542]

-{ Quote: " quoting: gkweb link=board=23;threadid=22168;start=0#msg132535 date=1077061329]
see what i have when wanting to buy BG, panda AV ??
" }-




sorry about that I thought you were looking to buy and was just having trouble.

[solarpowered candle]

I must say i like the firewall so far . Its the liightest that iv tried ( even lighter on my system than Look n stop) And flows like velvet .
The cost Is around $50 , however red_Dwarf says that thats maybe for a 3 yr liscence. If we go back a year to an earlier thread -{ Quote: " quoting: donlon link=board=23;threadid=8967;start=15#msg60444 date=1052906938]
I wrote the guys at Tryus about the price and renewall, and they said that once you bought the FW you have it for life, no annual renewall and free upgrade for life too.


" }-
So some where between those two should be right lol . Iv emailed them as i am interested .

richter, red Dwarf has been both the alpha and beta tester of bitgurad firewall and would know this firewall inside out by the sounds . It would be great if he would share more of his wisdom on this here . I would be real interested to learn more about it also.

[gkweb]

This software is for sure a good product, i just don't like the name "firewall" :)

As far as i can see, BitGuard is an excellent _sandboxe_ with a firewall part. Besides that, yes, it is good, i think we can compare it to Abtrusion Protector ;)

[WilliamP]

It sounds a lot like SSM . I have SSM on my system. How is it different? I know you smart guys can explain the difference.

[richter]

-{ Quote: " quoting: solarpowered candle link=board=23;threadid=22168;start=0#msg132559 date=1077064655]

richter, red Dwarf has been both the alpha and beta tester of bitgurad firewall and would know this firewall inside out by the sounds . It would be great if he would share more of his wisdom on this here . I would be real interested to learn more about it also.
" }-

Thank you very much for the information. I've heard about this firewall just a few weeks ago. I currently use LnS which is performing very well and it's very light on resources. Had a small glitch with it which I solved thanks to Phantom. I wouldn't like to install BitGuard just to test it. I'd like to hear some info from first hand before trying it out and comparing it to LnS. The firewall seems interesting as Tiny is the only firewall that has sandbox module, that I'm aware of (I am not sure if BlackIce has it as well), and it'd be interesting to see how does it compare to Tiny. I haven't seen any screenshots to see how the interface looks like and I don't want just to install it to check that out.

regards,

richter

[gkweb]

@WilliamP

the difference IMO is the same between SSM and Abstrusion Protector, SSM works in user mode, while AP and BG works in kernel mode, which gives them more power.

But basically, when an app wants to run, whatever user or kernel mode if you block it. The difference is if you mistakenly allow something to run, SSM can theorically be "disabled" while a kernel mode driver can't.
But even if kernel driver are supposed better (for sure they are), i find AP providing far less features than SSM (like to not block the launch of batch files...) and this is why i use SSM, because it fits to my needs :)

BitGuard seems very like AP, with firewall feature in addition.

If i'm wrong i'm sure someone will correct me.

[solarpowered candle]

The 1 yr licence is $37
3 yr licence is $59
http://www.tryus.dk/bitguard_buy.asp

[gkweb]

thx for the right information ;)

[WilliamP]

Thanks for all the information. It does look like some interesting piece of protection.

[Pilli]

;D This firewall is promising.
I have only had time to do a quick install and walk around :)
The inerface is a bit disjointed and could do with a rethink to make it more user friendly but once you get inside it is OK.
I like the encrypted database for processes which cannot be changed without permision even if you rename a file.
The control of individual connections, both in and out, are impressive
Real time statistics with a variable refresh rate are also to my liking as is the logging, connection views & charts.
To top it all it has driver based detection :) Which appears quite stable although I did have one BSOD which was possibly due to a clash with Sygate. Running two active firewalls together is just asking for trouble IMHO ;D

Unforrtunately uninstalling was less than adequate as after doing so I lost all Internet connections, probably due to registry settings not being put back correctly but it was simple enough to cure with a system restore :)

I have not had time to test it under pressure so this is just a user review NOT a test.

It is an impressive piece of work and I am looking forward to the next release as I would probably use it providing the minor nits are corrected.

[gkweb]

@Pilli

since you have tested it, can you answer me :

what is the pro of BG if i use for instance Abstrusion Protector ?
I think i have already the sandboxe, does the BG sandboxe feature is disabled (an option) ? if yes, what the firewall part has more (or as much as) interesting than other firewalls ?

For now, i have the same opinion toward BG than BlackIce, two sandboxe labelled as firewall (thought there is a real firewall in the package).

[Pilli]

Hi GK, Firstly I did not test it, merely a basic review.
It is a firewall not an IDS such as Blackice ;)
The database function is to do more with process control with regards to the firewall and as such cannot be compared easily with sandboxes and the firewall uses a ring 0 driver. BG does not monitor the registry either as far as I am awrare.
Also you have very fine control of all connections to the internet and the encrypted database / driver stops any of those processes being hijacked, although, as yet, there is no protection against .dll injection.

There is a fully working demo so why not try it? You could do some leaktests and give us your opinion ;D

Be aware that if you are using another firewall it may well be better to disable it.

[gkweb]

again, all that you say to me is sandboxe like feature + firewall, to prevent process hijacking is application layer defense (like Process Guard) and it not what leaktest are testing.

Example for you :

Leaktests VS SSM or AP : sandboxe 1 - leaktests 0

there is no sense to do such "test".



BI is more than an IDS, it is a sandboxe too in case you don't know.
Regarding ring 0 or kernel mode driver, AP use it, hence my first question.

From Red_Warf tests, lekatest launched and killed _because not doing in the database_ has nothing to do with "firewalling".

EDIT :

from the official home page :

-{ Quote: "
# Process Control – Control which applications are able to run on the computer, and prevent the execution of specific applications.
" }-

like SSM or AP, sandboxe

-{ Quote: "
# Stealth ports – hides ports on the computer, to prevent attacks and port-scans.
" }-

firewall

-{ Quote: "
# Protects system against unknown threats – By configuring the firewall to prevent unknown processes from execution and communication, a system can be secured from undiscovered threats.
" }-

-> "to prevent unknown processes from execution"

sandboxe


i end again to my first question, what BG bring me if i already use a sandboxe ?

[Pilli]

-{ Quote: "again, all that you say to me is sandboxe like feature + firewall, to prevent process hijacking is application layer defense (like Process Guard) and it not what leaktest are testing" }-

You are the best judge of that, I am no firewall expert that is why I have not pressumed to test it :)

Regarding PG the leaktests you are probably correct and in that respect it is probably more like Tiny personal firewall 5 which I believe also has a powerful sandbox function as well, I am not familiar Abtrusion Protector so cannot comment.

Anyway GK give it a try and you can see for yourself. ;)

[gkweb]

ok !

i gave a try and it was what i thought.
With the attachment, you can see that first i allow my trusted programs

[gkweb]

then, first test, i don't enable the "run only configured program".

With this configuration, BitGuard is a good firewall, each time an applications want to access the internet BG ask you, moreover BG has very good logs and statistics, one of the best i have seen among others firewalls, i have to admit.

But, the bad point, in this state (firewall _only_ state) BG fails near all leaktests, i haven't tested "leaktest" and "yalta" because i assume BG pass them.
All other leaktests go throught.

Then, i enable the "run only configured program", and programs i try to run which aren't in the database are simply killed, exactly like SSM does while being in user mode, it's simply a sandboxe like Kerio tries to use too.

So finally, IMO, someone having already a sandboxe will have to uninstall it before using BG.
The pb with BG is the same as with all sandboxe, if you mistakenly allow something to run, it will be able to highjack the firewall if this one is vulnerable.

The purpose to have a firewall with a real anti-leak protection at network layer is in the case your sandboxe has been bypassed (because of one of your mistakes) the firewall will however detect the software highjacking attempt and will block it ("Tooleaky" IE highjacking is detected and blocked by most firewalls without any sandbox, just by controling IE).

So use in one hand a sandboxe, and in an other hand a firewall.
BG is both in one, but rely exclusively on the first to block leaktests, which is a logic i don't like, if the layer is bypassed your are in trouble.

However users wanting something simple will like to have one software instead of two, i am not bashing BG, i just want to make things clear without confusing.

EDIT : based on my criteria testing identical for all firewall i am evaluating, if i would have to add BG to my site it wouldn't have more than 2/20 score so i don't think people would like that, especially those who refuse to try to understand my criteria.

[Pilli]

Nice Job GK! Maybe Red_Dwarf will answer the technical aspects. :)

[gkweb]

ty Pilli ;)

For adding a little "pros" of BG (because if i don't do it people will think i am bashing BG whereas i was just showing the difference beteen a sandboxe and a firewall) BG is the second "firewall" that i class in the light firewall categorie with Look'n'Stop, it doesn't consume a lot of ressources (at least on my comp).
Logs and graphics are very detailed and show more information than most of other firewall.
The main pro is that it is easy to use and you can be fully protected in a few clicks.

But if you use BG you must enable the built-in sandboxe to be protected
(so the sandboxe "block" leaktests _executables_, only a firewall is rewarded as "passing" a leaktest proof of concept).

So global good note for BG, but i can't really add it to my website.