🚀 go-pugleaf

Thank you Rebeccah for your thoughtfull analysis and detailed response. I 
appreciate it and I am sure many others do too.  I was very interested to 
read that the principles are ex Borland - I have used Borland's Delphi 
product for many years (have vers 5 Professional now) and before that 
their Turbo Pascal. Both excellent and reliable products.  However, on 
principle I do not like the idea of encrypted registry entries - the user 
should always be in a position to know what is in the registry.  
Encrypting it serves no purpose as no other programs, including 
Microsoft, do it (except for passwords).  Most Windows programs on the 
users machine will have a plain text registration entry that the user can 
read.

If the concern is sending it over the internet in plain text then surely 
ZA could encrypt a copy of the registry entry before sending it but 
leave the original in plain text (and avoid a lot of suspicion for 
following none-standard practices).  They should also clean up their 
uninstall so everything is gone, including at the users option the data 
files.  Without reinstalling it I don't know the exact version number I 
uninstalled but it was likely the latest as it was only downloaded from 
Zone Labs site about a week or 10 days ago.  I am running Windows 98 
which I last updated from the Microsoft download site less than a month 
ago. My machine is a Pentium II 400 MHz.

Christopher Anthistle

Rebeccah H. Prastein (rhp@fgi.net) wrote:
: comp.security.firewalls,can.internet.highspeed,alt.comp.freeware

: Re: Zone Alarm - Why I don't trust it




: In article <Frrozx.rF.0.queen@torfree.net>, bi446@torfree.net says...
: > Absolute trust in Zone Alarm is required by the user (that it will not 
: > transmit unauthorized data), 

: A good motto:  Trust, but verify.  A number of people have used packet 
: sniffers and dual firewall setups to monitor ZA for "phoning home."  To 
: my knowledge, the only times ZA transmits data is when you register the 
: product and when you click "more info" after receiving an alert.  Both of 
: these are under the control of the user.  People who have examined the 
: content going out, and who work with databases a lot, have stated that 
: they see exactly the type of information they would expect if ZA is 
: sending the information Zone Labs claims it is.

: > I don't now have that trust so I 
: > uninstalled it (using the custom option to get rid of everything listed) 
: > a few days after I installed it.

: The prudent thing to do.
:  
: <snip>
:  
: > There are too many things that don't add up so I don't want to take a 
: > chance on it. For whatever it is worth, here is what I know for sure:
: > 
: > I checked some of the Windows Registry entries it made and was surprised 
: > to find that in
: > 
: > [HKEY_LOCAL_MACHINE\Software\Zone Labs\ZoneAlarm\Registration]
: > 
: > the user information was in encrypted format. I do not know of any other 
: > programs that do this.  What, I wondered are these guys hiding.  Why is 
: > the user denied knowledge of what registry information is kept about him 
: > or her.  This is my registry, not theirs.

: A previous version from long ago did not do any encryption, and users 
: complained about sending registration information out over the Internet 
: "in the clear."  According to Zone Labs, they use "weak encryption" for 
: this now.  I guess they're "d*mned if they do, d*mned if they don't."

:  
: > The full list of entries for this registry key is (encrypted data has 
: > been removed, I replaced it with ="" ):
: > 
: > "Address1"=""
: > "Address2"=""
: > "City"=""
: > "Country"=""
: > "EMailAddr"=""
: > "Phone"=""
: > "PostalCode"=""
: > "RegisteredOrganization""
: > "RegisteredOwner"=""
: > "State"=""
: > "WantEmail"=""
: > "WantPost"=""
: > "SurveyComputers"=""
: > "SurveyNetConn"=""
: > "SurveyPeople"=""
: > "SurveyUse"=""
: > 
: > Why, I wondered, are there any entries for
: > 
: > "SurveyComputers"=""
: > "SurveyNetConn"=""
: > "SurveyPeople"=""
: > "SurveyUse"=""

: These are your answers to the demographic survey that you may 
: *optionally* complete when you register ZA.  As previously reported in 
: the ShieldsUp NG,

: 	"Spiny Norman" <spiny_norman at hotmail.com> wrote in message
: 	news:38d13fbe@webster.GRC...
: 	> Ya know, I never really appreciated paranoia until I began to 
: 	frequent this
: 	> newsgroup.......
: 	>
: 	> When you install ZoneAlarm, you're asked if you want to register 
: 	and have
: 	> the chance to answer several questions( a survey!), including 
: 	your name,
: 	> company, email addy, a checkbox asking if you want to be 
: 	informed about
: 	> updates, full address, phone number, business or personal use, 
: 	method of
: 	> connection to the Internet, number of computers at this 
: 	location, etc. If
: 	> you look at the questions asked, and then look at the values in 
: 	this key,
: 	> you'll see a one-to-one correspondence.  "SurveyComputers" ties 
: 	to the
: 	> number of computers at this location, "SurveyNetConn" ties to 
: 	method of
: 	> connection, etc.

: <snip>

: > I then checked the jobs on their website at 
: > 
: > http://www.zonelabs.com/jobs.htm 
: > 
: > and for the Director of Strategic Business Systems it says:
: > "We are seeking a bright individual to be the heart of Strategic 
: > Business Systems; responsibilities will be to architect and implement 
: > the backbone of Zone Labs automated revenue accounting systems and e-
: > commerce model. 

: OK, they want to automate their accounting system and sell their products 
: over the Internet...

: > Play a lead role in creating marketing information 
: > systems that will allow us to target and market directly to our customer 
: > base using personalization software on our site, crafting direct 
: > electronic campaigns as well as collecting and consolidating our 
: > customer statistics (data mining). .........."

: Name ONE major e-commerce vendor that doesn't want to target its existing 
: customer base for the sales of additional products.  This is not 
: inherently evil.  Zone Labs would be destined for economic failure if 
: they did not do this.

:  
: > Phrases like "target and market directly to our customer base" and "data 
: > mining" in conjunction with encrypted registry entries containing user 
: > data makes me very nervous. 

: The weakly encrypted registry entries have already been explained.

: > Does this mean Zone Alarm is potentially an 
: > even more dangerous threat to privacy than advertising supported 
: > software. Being a program it can access any Registry Information (ANY, 
: > not just the keys referred to above) or any Disk File that it chooses 
: > to. 

: Any security product is *potentially* a greater threat to privacy than 
: ad-supported software, because the user trusts it and gives it 
: information and access that would not be given to an untrusted 
: application.  That is the nature of the beast.  It can't do its job of 
: securing your system if you don't trust it.

: > I restarted in DOS mode and checked what files were left behind:
: > 
: > Directory of C:\WINDOWS\INTERN~1 ("Internet Logs" the Zone 
: > Labs\TrueVector\LocalStoreDir)
: > 
: > .              <DIR>        03-17-00  3:19a
: > ..             <DIR>        03-17-00  3:19a
: > IAMDB    RDB        37,376  03-17-00  7:22p
: > OEMCOM~1 LDB        22,016  03-17-00  7:22p
: >          2 file(s)         59,392 bytes
: > 
: > According to 
: > 
: > http://www.zonelabs.com/zonealarm/za_faq_details.htm
: > 
: > The IAMDB.RDB file contains all the Internet access restrictions for 
: > your computer. This includes: rules, their settings, and objects that 
: > the rules apply to: programs, users, computers, subnets, zones, etc. 
: > 
: > The <mycomputer>.LDB file is the Internet log database for your 
: > computer. They say the only thing that is stored in the logs for 
: > ZoneAlarm is your computer's name and IP address, and icon bitmaps for 
: > your programs. However if their IAM experimental software is (later ?) 
: > installed it enables the maximum logging capability of the engine, 
: > including: programs that have used the Internet, users that ran them, 
: > protocols they've used, sites they've connected to, and every other 
: > piece of information you see in the IAM log and alert windows.  This 
: > leaves a lot of unanswered questions such as: under what circumstances 
: > is the IAM experimental software installed, is the user informed at the 
: > time, do they consent to the collection of this data, why is it being 
: > collected, etc. Can it ever be read or uploaded through an internet 
: > connection (with or without your knowledge).  Lots of potential for 
: > invasion of privacy there.
: > 
: > The above is user data that is of no use with the program gone, it 
: > should have been presented in the uninstall as an optional delete.  It 
: > wasn't, so I manually deleted the contents of this directory and removed 
: > the directory. 

: I happen to agree that these should be optionally deleted.  The rationale 
: for leaving them is so that the user's configuration settings won't be 
: lost when doing an upgrade.  Zone Labs does document ther presence, 
: however, as you have demonstrated.

: > Also remaining was:
: > 
: > Directory of C:\PROGRA~1\ZONELA~1\ZONEAL~1
: > 
: > .              <DIR>        03-17-00  2:57a
: > ..             <DIR>        03-17-00  2:57a
: > ZONEBAND DLL        76,560  02-16-00  7:41p
: >          1 file(s)         76,560 bytes
: > 
: > The above is likely the item on the tool bar. I manually deleted the 
: > contents of this directory and removed the directories ZONELA~1\ZONEAL~1

: It is.  It is documented that this must be removed from the toolbar (and 
: I think you have to reboot, too) *before* uninstalling ZA, for this dll 
: to be removed.

: > 
: > Then I restarted Windows and checked the Registry again and found Zone 
: > Labs keys still existed with the encrypted user data intact so I 
: > manually deleted keys 
: > 
: > [HKEY_CURRENT_USER\Software\Zone Labs] and 
: > [HKEY_LOCAL_MACHINE\Software\Zone Labs]   
: > 
: > These keys should have been removed in the uninstall, I am not 100% 
: > certain they were not as I had REGEDIT running at the time the uninstall 
: > was running (started before uninstall) and I did not close it until 
: > after uninstall finished so REGEDIT may have rewritten deleted data. 
: >
: > Perhaps somebody else can test after an uninstall when REGEDIT is not 
: > running.

: I just checked, and there *are* registry entries that get left behind 
: other than those mentioned in the ZA FAQ.  I have recently uninstalled 
: 2.1.1, and have not yet installed 2.1.3.  I don't recall whether or not 
: the uninstaller presented me with the option of deleting iamdb.rdb and 
: <mycomputer>.ldb, but if it gave me the option, I'm quite sure I left 
: them there, to save my settings for the upgrade.  I haven't done a 
: thorough check of my registry, but just searching for entries containing 
: the string "zone", I find:

: HKCU\Zone Labs\Zone Alarm\Dialog Control		#listed in FAQ

: HKLM\Software\Zone Labs\Minilog			#not listed in FAQ, but 
: 							relates to the new 
: 							*alert* logging feature, 
: 							and I don't think the FAQ
: 							has been updated

: HKLM\Software\Zone Labs\True Vector\LocalStorDir#not listed in FAQ

: HKLM\Software\Zone Labs\True Vector\LogStorDir	#not listed in FAQ

: HKLM\Software\Zone Labs\True Vector\Zone Alarm\Registration\2.1.1
: 							#listed in FAQ

: HKU\Default\Software\Zone Labs\Zone Alarm\Dialog Control
: 							#not listed in FAQ

: > 
: > On checking from the file list in
: > 
: > http://www.zonelabs.com/zonealarm/za_faq_uninstall.htm
: > 
: > I also noticed that the c:\windows\system\vsutil.dll was not removed by 
: > the uninstall.  This .dll seems to handle the on line registration for 
: > Zone Alarm.

: vsutil.dll is *not* left on my system.  I am running win95b on this 
: computer.  What OS are you running?  I know things get a little trickier 
: with winNT, and especially win2K.  Also, it would help to know what 
: version of ZA you uninstalled, as the uninstaller has undergone some 
: fixing in later releases.

: Rebeccah