Topic: Confirmed - GRC is a gimmick.

[chorleydave]

Although this is a continuation of my earlier thread, I think the conclusion is so important, as many of us use GRC.Com to check our security, that it deserves the prominance of a new thread.

As those who have been following my recent experiment will know, I have been testing the GRC site without a firewall, and have had some strange results.  Take last night:

A very strange set of results tonight.  After doing the test with the firewall running and getting 100% stealth, I disabled the firewall and rebooted.  This time, Ports 0 - 112 were closed, while Ports 113 - 1064 were stealthed.

Tonight, and without a firewall, GRC.Com's scanners reckoned that Ports 0-119 were closed (last night it was 0-112) and the rest were stealthed.  To test further, I rebooted and, without a firewall, I went to the PC-Flank site and using the "Advanced Port Scanner" tested Ports 120-135.  A couple of minutes earlier, GRC.Com claimed they were stealthed.  However, PC-Flank showed them as closed, not stealthed, which is what I would have expected.

Therefore, I can only conclude that GRC.Com is indeed a gimmick, or at best is unreliable.

[Clive]

I've been following your thread Dave and decided to test my own system out.  I've used GRC on countless occasions and it has always told me I am bombproof.  Yesterday however, it claimed that my computer could be pinged (very bad!)and that some of my ports were not stealthed.  But PC-Flank tells me that my machine is impenetrable!  So what's going on???

[Simon]

Although I'm not disputing your findings, Dave, which are most intriguing, I find it difficult to accept that GRC are merely a gimmick.  The shadow of doubt, for me, lies in the fact that GRC are not selling any firewall products, so what would they have to gain out of giving false information?  In fact, most of the software on the GRC site is freeware.  

[Simon]

Further to the above, I have just done tests on GRC and PC-Flank, and both came back with the results that I am fully stealthed.

[chorleydave]

Further to the above, I have just done tests on GRC and PC-Flank, and both came back with the results that I am fully stealthed.

I too get fully stealthed when I have my firewall running, Simon.  It is when I have no firewall running that I get these crazy results.

How can Ports 120 - 1064 be stealthed when my firewall isn't running?  At best, they should be closed.  I did suspect that my ISP might have something to do with it, as some ISPs block access to certain Ports, but as the PC-Flank tests show them as merely closed and not as stealthed (as I would expect when I haven't a firewall running) I think I can safely discount my ISP having anything to do with it.

It would be useful if someone else would disable their firewall and take the GRC tests and then post the results.  

[Simon]

Here you go then, Dave, this is from GRC with Sygate, and the failsafe mode, disabled:-

GRC Port Authority Report created on UTC: 2004-09-15 at 23:01:42

Results from scan of ports: 0, 21-23, 25, 79, 80, 110, 113,
                            119, 135, 139, 143, 389, 443, 445,
                            1002, 1024-1030, 1720, 5000

    2 Ports Open
   24 Ports Closed
    0 Ports Stealth
---------------------
   26 Ports Tested

NO PORTS were found to be STEALTH.

Ports found to be OPEN were: 135, 445

Other than what is listed above, all ports are CLOSED.

TruStealth: FAILED - NOT all tested ports were STEALTH,
                   - NO unsolicited packets were received,
                   - A PING REPLY (ICMP Echo) WAS RECEIVED.

[Simon]

...and with Sygate back up and running:-

GRC Port Authority Report created on UTC: 2004-09-15 at 23:05:11

Results from scan of ports: 0, 21-23, 25, 79, 80, 110, 113,
                            119, 135, 139, 143, 389, 443, 445,
                            1002, 1024-1030, 1720, 5000

    0 Ports Open
    0 Ports Closed
   26 Ports Stealth
---------------------
   26 Ports Tested

ALL PORTS tested were found to be: STEALTH.

TruStealth: PASSED - ALL tested ports were STEALTH,
                   - NO unsolicited packets were received,
                   - NO Ping reply (ICMP Echo) was received.

----------------------------------------------------------------------

[Dack]

Although I'm not disputing your findings, Dave, which are most intriguing, I find it difficult to accept that GRC are merely a gimmick.  The shadow of doubt, for me, lies in the fact that GRC are not selling any firewall products,

You mean apart from Zonealarm pro

Steve Gibson - self appointed guru
http://www.grcsucks.com/

[Simon]

While you're about, Dack, can you have a look at my Graphics Card problem, please?  

[Dack]

Will have to have a look in the morning as I've just been threatened with gonad removal - kiddywink is now home from hospital and girlfriend is a little stressed by the amount of time I'm out here (though it looks like either a. Overheating, b. refresh rate, c. driver issue - safe mode would negate most/all of those effects and allow you to see what was going on - also check to see what monitor it thinks is attached).

[chorleydave]

Thanks, Simon.

Again without any firewall, I tried more GRC tests.  This time 0-83 closed, 84-1054 stealthed, on full probe.  However, user defined probe then showed 200-220 closed and then 660-680 closed.  Yet another full probe showed them stealth.  

After reading:

http://www.jluster.org/log/d/textual/misc/2002/10/30/shieldsup_analyzed

I have just removed Shields Up from my bookmarks and will be sticking with PC-Flank from now on.  At least PC-Flank's results are believable.