How can someone access my computer ("hack me") when my firewall is off?

Question

Why do people go crazy when the firewall if off? Most sites on the internet say its very dangerous to turn off your firewall and I want to understand why. For example Microsoft says this:

You should always run Windows Firewall even if you have another firewall turned on. Turning off Windows Firewall might make your device (and your network, if you have one) more vulnerable to unauthorized access.

Now I want to understand how does it make my infrastructure vulnerable. If you have malware already on your computer and then you turn off the firewall then yes I understand that then the malware will be able to send and receive Command-and-Control traffic.

But if a computer with a fresh installation of Windows has its firewall off then how would you hack it? You will be able to send all the packets you want to that computer but that computer will not know what to do with those packets right?

It will be great if someone gives an example/describe of how to hack a computer that has no firewall and has a fresh installation of Windows (remote desktop connection is disabled and a username and password is needed to login into that computer).

Answer 1

The topic of firewall protections can be big if we go into details. So I'll limit myself to one idea and one example.

Possible risk with a fresh Windows install: Security weaknesses (vulnerabilities) due to software defects or incorrect / insufficient configuration.

Example of what someone might do if it's without a firewall: Probe for those weaknesses without you noticing.

One of the first thing nearly all firewalls do by default is to limit incoming connections. i.e., someone trying to probe / connect to your computer would not be allowed to, without your permission. This greatly reduces exposure of any security weaknesses. Any complex software such as Windows with mulitple other software running on top, is likely to have many weaknesses unknown to general public - so it is a big risk.

If you connect through a home or an office LAN, you are relatively less exposed since the Internet gateway/router you use will most likely limit incoming connections that you don't specifically configure (effectively acting like a limited network firewall). However, inexpensive routers themselves have security problems that have in the past, allowed (and probably still allow) attackers to use the routers to discover and attack computers on the LAN - so having a host firewall (such as the Windows firewall) is an important defense to avoid this.

Answer 2

If you had no firewall, this means every piece of software on your box is allowed out of your network, and every port that isn't closed by default would be open for use.

So, here's your hack example assuming your fresh install of Windows 10 was fully patched with updates:

1. I dangle a carrot in front of you to lure you to a site I've setup for badness (compromised legit site or custom site) through phishing, spam, or clickbait

2. In that site, it has some code in there that says go to a raw github page to get some mimikatz program to be run in powershell such as this link. To bypass any anti-virus, I would have customized the mimikatz version to my own.

3. I dump all of your credentials on your box via powershell and now have all the access I need to do a pass-the-hash attack or other.

Your firewall could've prevented outbound http/https connections with powershell. But since it's not on, I hacked you on a fully patched system and didn't install a thing because it runs in memory and nothing gets dropped on the disk.

Answer 3

With no firewall you are simply enlarging the "attack surface" of your computer. One can attack all its network IP addresses/ports and from all locations. So you are giving a potential hacker more space to find vulnerabilities.