🚀 go-pugleaf

Here we go again?

I'm the jerk who started the "Will Zone Labs PLEASE ..."

As a result of that tapestry (thread won't cut it) in
comp.security.firewalls I
came accross a few idiots, and many clearer heads.

Read the FAQ's at ZoneLabs.  Read the threads from comp.security.firewalls.
Ignore damn near everything that "Bill" posts.

1) Be paranoid.  Don't believe them.  Install something else.
2) Don't be paranoid.  Install Zone Alarm AND a good virus scanner and
get on with life.

Zone Alarm comes up with many red flags (a couple to a dozen per hour), but
some obvious hacker scans also pop up from time to time.  (eg: rolling
lowest
digit IP and/or Port Numbers...)

Cheers, Alan.

Christopher Anthistle wrote:

> Absolute trust in Zone Alarm is required by the user (that it will not
> transmit unauthorized data), I don't now have that trust so I
> uninstalled it (using the custom option to get rid of everything listed)
> a few days after I installed it.
>
> Why ?  I have concerns about privacy on the internet and potential
> invasion of privacy by cookies (especially from an advertising company
> that now owns a mail order database), by advertising supported software,
> and the fact that Zone Labs is giving away for free an apparently
> excellent fully functional program that does not appear to be time
> limited. They may of course be innocently testing and debugging it
> before making a paid version available in stores and/or by e-commerce,
> but they could also be laying the groundwork for a future invasion of
> privacy on a grand scale. Who knows what this firewall program is or
> will be doing behind the scenes.
>
> There are too many things that don't add up so I don't want to take a
> chance on it. For whatever it is worth, here is what I know for sure:
>
> I checked some of the Windows Registry entries it made and was surprised
> to find that in
>
> [HKEY_LOCAL_MACHINE\Software\Zone Labs\ZoneAlarm\Registration]
>
> the user information was in encrypted format. I do not know of any other
> programs that do this.  What, I wondered are these guys hiding.  Why is
> the user denied knowledge of what registry information is kept about him
> or her.  This is my registry, not theirs.
>
> The full list of entries for this registry key is (encrypted data has
> been removed, I replaced it with ="" ):
>
> "Address1"=""
> "Address2"=""
> "City"=""
> "Country"=""
> "EMailAddr"=""
> "Phone"=""
> "PostalCode"=""
> "RegisteredOrganization""
> "RegisteredOwner"=""
> "State"=""
> "WantEmail"=""
> "WantPost"=""
> "SurveyComputers"=""
> "SurveyNetConn"=""
> "SurveyPeople"=""
> "SurveyUse"=""
>
> Why, I wondered, are there any entries for
>
> "SurveyComputers"=""
> "SurveyNetConn"=""
> "SurveyPeople"=""
> "SurveyUse"=""
>
> If you are running Zone Alarm and wish to check your own registry click
> the Windows Start button, click Run, and type the word REGEDIT in the
> open dialog box and click OK (but don't change anything in the registry
> unless you know what you are doing).  Compare this with similar entries
> for other installed programs under the HKEY_LOCAL_MACHINE\Software key.
>
> I then checked the jobs on their website at
>
> http://www.zonelabs.com/jobs.htm
>
> and for the Director of Strategic Business Systems it says:
> "We are seeking a bright individual to be the heart of Strategic
> Business Systems; responsibilities will be to architect and implement
> the backbone of Zone Labs automated revenue accounting systems and e-
> commerce model. Play a lead role in creating marketing information
> systems that will allow us to target and market directly to our customer
> base using personalization software on our site, crafting direct
> electronic campaigns as well as collecting and consolidating our
> customer statistics (data mining). .........."
>
> Phrases like "target and market directly to our customer base" and "data
> mining" in conjunction with encrypted registry entries containing user
> data makes me very nervous. Does this mean Zone Alarm is potentially an
> even more dangerous threat to privacy than advertising supported
> software. Being a program it can access any Registry Information (ANY,
> not just the keys referred to above) or any Disk File that it chooses
> to.
>
> I restarted in DOS mode and checked what files were left behind:
>
> Directory of C:\WINDOWS\INTERN~1 ("Internet Logs" the Zone
> Labs\TrueVector\LocalStoreDir)
>
> .              <DIR>        03-17-00  3:19a
> ..             <DIR>        03-17-00  3:19a
> IAMDB    RDB        37,376  03-17-00  7:22p
> OEMCOM~1 LDB        22,016  03-17-00  7:22p
>          2 file(s)         59,392 bytes
>
> According to
>
> http://www.zonelabs.com/zonealarm/za_faq_details.htm
>
> The IAMDB.RDB file contains all the Internet access restrictions for
> your computer. This includes: rules, their settings, and objects that
> the rules apply to: programs, users, computers, subnets, zones, etc.
>
> The <mycomputer>.LDB file is the Internet log database for your
> computer. They say the only thing that is stored in the logs for
> ZoneAlarm is your computer's name and IP address, and icon bitmaps for
> your programs. However if their IAM experimental software is (later ?)
> installed it enables the maximum logging capability of the engine,
> including: programs that have used the Internet, users that ran them,
> protocols they've used, sites they've connected to, and every other
> piece of information you see in the IAM log and alert windows.  This
> leaves a lot of unanswered questions such as: under what circumstances
> is the IAM experimental software installed, is the user informed at the
> time, do they consent to the collection of this data, why is it being
> collected, etc. Can it ever be read or uploaded through an internet
> connection (with or without your knowledge).  Lots of potential for
> invasion of privacy there.
>
> The above is user data that is of no use with the program gone, it
> should have been presented in the uninstall as an optional delete.  It
> wasn't, so I manually deleted the contents of this directory and removed
> the directory. Also remaining was:
>
> Directory of C:\PROGRA~1\ZONELA~1\ZONEAL~1
>
> .              <DIR>        03-17-00  2:57a
> ..             <DIR>        03-17-00  2:57a
> ZONEBAND DLL        76,560  02-16-00  7:41p
>          1 file(s)         76,560 bytes
>
> The above is likely the item on the tool bar. I manually deleted the
> contents of this directory and removed the directories ZONELA~1\ZONEAL~1
>
> Then I restarted Windows and checked the Registry again and found Zone
> Labs keys still existed with the encrypted user data intact so I
> manually deleted keys
>
> [HKEY_CURRENT_USER\Software\Zone Labs] and
> [HKEY_LOCAL_MACHINE\Software\Zone Labs]
>
> These keys should have been removed in the uninstall, I am not 100%
> certain they were not as I had REGEDIT running at the time the uninstall
> was running (started before uninstall) and I did not close it until
> after uninstall finished so REGEDIT may have rewritten deleted data.
> Perhaps somebody else can test after an uninstall when REGEDIT is not
> running.
>
> On checking from the file list in
>
> http://www.zonelabs.com/zonealarm/za_faq_uninstall.htm
>
> I also noticed that the c:\windows\system\vsutil.dll was not removed by
> the uninstall.  This .dll seems to handle the on line registration for
> Zone Alarm.
>
> Christopher Anthistle