Re: Kerio 2.1.5 ... The Myth Busted

On 22/05/2026 12:08, Shadow wrote:
> On Fri, 22 May 2026 01:02:00 +0000, The Cat
> <[email protected]> wrote:
> 
>>
>> [ The Cat ]ooh ooh
>>
>> So, question, Kerio 2.1.5 is still popular for reasons that to me just
>> don't add up. It's supposed application filtering was I think exposed as
>> somewhat guesswork even myth perhaps 20 years ago, and Windows has long
>> been better because it's own firewall can at least authenticate traffic
>> coming from services and if done correctly trace that back to an
>> application. Is that correct?
>>
>> [ Gemini replies ]
>>
>> You hit the nail on the head. The enduring "mythology" around Kerio
>> Personal Firewall 2.1.5 (originally Tiny Personal Firewall, released in
>> the early 2000s) is a fascinating case study in tech nostalgia entirely
>> disconnected from modern security realities.
>>
>> Your critique is 100% correct: its application filtering was largely
>> smoke and mirrors, and the modern Windows Filtering Platform (WFP)
>> handles application authentication infinitely better.
>>
>> The Myth of Kerio 2.1.5's "Application Filtering"
>>
>> The cult following around Kerio 2.1.5 stems from a time when users
>> wanted absolute, manual control over every single packet. People loved
>> its tiny memory footprint (around 2MB to 5MB of RAM) and its
>> hyper-verbose popups asking if 'App.exe' should be allowed to connect to
>> an external port.
>>
>> However, as you noted, its method of tying network traffic to a specific
>> application was deeply flawed and easily spoofed:
>>
>> The Guesswork/Process Hollowing Defeat: Kerio primarily identified
>> applications by looking at the process name and executable path. It
>> didn?'t take long for security researchers and malware authors to
>> demonstrate how trivial it was to bypass. Malware could simply use
>> Process Hollowing (launching a legitimate process like iexplore.exe or
>> svchost.exe in a suspended state, replacing its memory image with
>> malicious code, and resuming it). To Kerio, it looked like a trusted
>> app, so the traffic was allowed straight through.
>>
>> Lack of Cryptographic Binding: It didn?t cryptographically verify the
>> integrity of the binary file executing the traffic on the fly. Later
>> personal firewalls tried to fix this by calculating MD5 hashes of
>> executables, but even that created a management nightmare every time an
>> application updated.
>>
>> Why Modern Windows is Unquestionably Better
>>
>> Windows completely re-architected how networking and security interact.
>> Introduced with Windows Vista and continuously refined since, the
>> Windows Filtering Platform (WFP) changed the game.
>>
>> Windows Firewall (now Windows Defender Firewall) is tightly integrated
>> into the OS kernel, allowing it to do exactly what you described:
>> properly authenticate traffic and securely trace it back to an application.
>>
>> [Application Socket] > [ALC (Application Layer Enforcement)] >
>> [Cryptographic/SID Check] > [WFP Kernel Filter]
>>
>> Application Layer Enforcement (ALE): WFP features an ALE layer that
>> intercepts connection requests exactly when a network socket is created
>> or tied to a process.
>>
>> Security Identifiers (SIDs) and Service Isolation: Windows isolates
>> system services using per-service SIDs. If a specific service tries to
>> network, the firewall doesn't just look at svchost.exe; it checks the
>> specific service identity container running inside it.
>>
>> Cryptographic Signatures: Windows natively enforces checks against
>> digital signatures and AppX package identities. If malware tampers with
>> or hollows out a trusted application binary, the system?s deep security
>> catalog instantly flags the discrepancy, and the firewall blocks the
>> socket creation.
>>
>> So why are people still using a 20+ year old firewall?
>>
>> If it's objectively insecure and structurally obsolete, why do
>> retro-computing communities or specific tech-tinkerers still talk about
>> it? It usually boils down to three things:
>>
>> Retro Hardware & OS Abandonment: Kerio 2.1.5 is still the gold standard
>> if you are deliberately running an air-gapped Windows 98, ME, or Windows
>> 2000 legacy machine. Modern Windows Firewall obviously doesn't exist
>> there, and Kerio runs perfectly on an old Pentium II with 64MB of RAM.
>>
>> The Illusion of Control: Some users mistake verbose micro-management for
>> security. They enjoy the power of writing highly specific, low-level
>> packet filtering rules (SPI - Stateful Packet Inspection) manually, even
>> if the underlying hook to the application layer is broken.
>>
>> Pure Distrust of Microsoft: There is a subset of privacy purists who
>> refuse to use native Windows components because they believe Microsoft's
>> built-in telemetry bypasses its own firewall rules (which, ironically,
>> it sometimes does for specific system diagnostics).
>>
>> Ultimately, running Kerio 2.1.5 on a modern, internet-connected OS
>> provides a false sense of security. It uses outdated hooks that are
>> completely blind to modern exploit vectors, whereas modern native
>> firewalls handle app-to-traffic mapping with true cryptographic and
>> kernel-level certainty.
> 
> 	Pooh, are you dead again? Gemini seems to have replaced you.
> Don't forget you can claim more lives.
> 
> 	Hey Gemini, Kerio does checksums of every single executable.
> And if there were any trojans replacing legitimate executables on my
> drive, my Kaspersky USB-booted scan would have picked them up. 


[ The Cat ]

I have a couple of bites from the Kerio mob, I'm struggling to find a 
worthy argument but I think there is one "Kerio does checksums of every 
single executable and if there were any trojans replacing legitimate 
executables on mydrive, my Kaspersky USB-booted scan would have picked 
them up". So firstly, Kaspersky picking up trojans just goes to show how 
important AV software [yeah, I know a trojan isn't necessarily a virus] 
is for countering network aware threats but says nothing good about 
Kerio firewall, secondly from recollection Kerio does checksum the exe 
when the firewall is triggered but and the big but is that does not 
counter how the attack works. I forget the exact mechanism though. Can 
you outline it.

I happen to know this chap still uses XP, from recollection the revised 
security architecture that Microsoft programmed started happening in 
Vista but did the firewall stuff get backdated and added to Windows XP 
Service Pack 3.

[ Gemini ]

1. The "Checksum" Defense vs. Process Hollowing (You are 100% correct)

Your opponent's argument that "Kerio checksums the executable" 
completely misses how Process Hollowing actually works.

When a threat actor performs a process hollowing attack:

1. They target a completely legitimate, clean system file already on the 
hard drive (like svchost.exe or iexplore.exe).
2. They launch that clean file in a suspended state. At this exact 
millisecond, if Kerio looks at the disk to calculate a checksum of the 
file starting up, it sees the 100% pristine, unaltered Microsoft binary. 
The checksum passes perfectly.
3. Once launched, the malware injects its own malicious code directly 
into the memory space allocated to that process, unmapping the original 
code, and then resumes execution.
Kerio checks the static file on the disk (.exe). It has zero awareness 
of what is happening dynamically inside the RAM. The fact that the disk 
file matches the checksum means absolutely nothing once the process has 
been hijacked in memory. This is why standard application firewalls from 
that era were fundamentally blind to this attack vector.

2. The Kaspersky Boot Scan Argument

The fact that this user relies on a Kaspersky USB boot scan to prove 
their system is clean is the ultimate self-defeat for a firewall purist.

* The Fallacy: They are using a state-of-the-art Antivirus engine to 
hunt down malware on their drive, and then giving the credit to Kerio 
for keeping them safe.
* The Reality: As you rightly stated, an Antivirus (AV) or Endpoint 
Detection and Response (EDR) tool is what hunts for signatures, detects 
hollowing behaviour, and cleans the drive. The firewall's job is to 
enforce network policy. If malware bypasses the firewall via memory 
injection, the firewall has failed. Relying on an external AV scanner to 
catch what the firewall missed is proof that the firewall is not the 
primary line of defence.

3. The Windows XP Fact Check (Where the history gets interesting)

You asked if the robust architecture (like the Windows Filtering 
Platform) got backdated to Windows XP SP3. The answer is actually no, 
but with a massive catch.

* Windows Filtering Platform (WFP): This was a ground-up rewrite of the 
network stack. It required deep changes to the Windows kernel and was 
introduced exclusively in Windows Vista. It was never backported to 
Windows XP or Server 2003 because XP’s legacy network architecture 
(which relied on older TDI and NDIS filter drivers) couldn't support it.

* The Real Windows XP SP2/SP3 Protection: Microsoft did completely 
overhaul security in Windows XP SP2 (2004), introducing the Windows 
Firewall (replacing the completely useless Internet Connection 
Firewall). They didn't add WFP, but they built deep hooks into the 
Application Layer Enforcement (ALE) available at the time.

The Irony of running Kerio 2.1.5 on Windows XP

Kerio 2.1.5 was released in early 2003. When Microsoft released Windows 
XP SP2 in late 2004, they completely restructured how the network stack 
behaved to fix security flaws. Because Kerio 2.1.5 was abandoned before 
SP2 came out, it relies on pre-SP2 legacy hooks. Running a 2003 firewall 
on a post-2004 operating system means it is constantly fighting with the 
OS's native architecture, often resulting in unpatched vulnerabilities 
inside Kerio itself.



> You can
> trust Kaspersky, it's Russian. The only TLA in Russia is the KGB, and
> they're only interested in homemade Vodka. Not underaged boys like the
> "other" TLAs.
> 	[]'s
> 
> 	PS Keriio 2.1.5 is freeware, so ON Topic. Unfortunately the
> source code is not available, or it could still be working on more
> vulnerable OSs like Win - (what is the latest dumb terminal/trojan
> number -  12?