🚀 go-pugleaf

Scary stuff, if true, Christopher.  And an amazing piece of detective
work on your part.  Now the question is;  have you submitted this to
any of the anti-aureate folks for an opinion?

Many of the things you see which are serving a data-gathering function
(apparently) demographically could be explained away by Zone Labs as
merely establishing browsing patterns to enhance ZoneAlert's ability
to recognize similar, yet redundant and alternately-named, systems
compromises by the same individual (see how easy it is to dazzle the
masses?).

Yet, put all together, it's easy to see the potential for a humongous
benigb Back Orifice attempt (see? I can see even grimer uses than
simply advertising).

Why would such a visible, free proggie be used to dupe a bunch of
people if not for money?  I dunno.....

But where was the sense of the infamous Yahoo Bomb?.......

Love to hear what you finally resolve with Zone Labs!'

Keith

On Tue, 21 Mar 2000 10:26:21 GMT, bi446@torfree.net (Christopher
Anthistle) wrote:

>Absolute trust in Zone Alarm is required by the user (that it will not 
>transmit unauthorized data), I don't now have that trust so I 
>uninstalled it (using the custom option to get rid of everything listed) 
>a few days after I installed it.
>
>Why ?  I have concerns about privacy on the internet and potential 
>invasion of privacy by cookies (especially from an advertising company 
>that now owns a mail order database), by advertising supported software, 
>and the fact that Zone Labs is giving away for free an apparently 
>excellent fully functional program that does not appear to be time 
>limited. They may of course be innocently testing and debugging it 
>before making a paid version available in stores and/or by e-commerce, 
>but they could also be laying the groundwork for a future invasion of 
>privacy on a grand scale. Who knows what this firewall program is or 
>will be doing behind the scenes.
>
>There are too many things that don't add up so I don't want to take a 
>chance on it. For whatever it is worth, here is what I know for sure:
>
>I checked some of the Windows Registry entries it made and was surprised 
>to find that in
>
>[HKEY_LOCAL_MACHINE\Software\Zone Labs\ZoneAlarm\Registration]
>
>the user information was in encrypted format. I do not know of any other 
>programs that do this.  What, I wondered are these guys hiding.  Why is 
>the user denied knowledge of what registry information is kept about him 
>or her.  This is my registry, not theirs.
>
>The full list of entries for this registry key is (encrypted data has 
>been removed, I replaced it with ="" ):
>
>"Address1"=""
>"Address2"=""
>"City"=""
>"Country"=""
>"EMailAddr"=""
>"Phone"=""
>"PostalCode"=""
>"RegisteredOrganization""
>"RegisteredOwner"=""
>"State"=""
>"WantEmail"=""
>"WantPost"=""
>"SurveyComputers"=""
>"SurveyNetConn"=""
>"SurveyPeople"=""
>"SurveyUse"=""
>
>Why, I wondered, are there any entries for
>
>"SurveyComputers"=""
>"SurveyNetConn"=""
>"SurveyPeople"=""
>"SurveyUse"=""
>
>If you are running Zone Alarm and wish to check your own registry click 
>the Windows Start button, click Run, and type the word REGEDIT in the 
>open dialog box and click OK (but don't change anything in the registry 
>unless you know what you are doing).  Compare this with similar entries 
>for other installed programs under the HKEY_LOCAL_MACHINE\Software key.
>
>I then checked the jobs on their website at 
>
>http://www.zonelabs.com/jobs.htm 
>
>and for the Director of Strategic Business Systems it says:
>"We are seeking a bright individual to be the heart of Strategic 
>Business Systems; responsibilities will be to architect and implement 
>the backbone of Zone Labs automated revenue accounting systems and e-
>commerce model. Play a lead role in creating marketing information 
>systems that will allow us to target and market directly to our customer 
>base using personalization software on our site, crafting direct 
>electronic campaigns as well as collecting and consolidating our 
>customer statistics (data mining). .........."
>
>Phrases like "target and market directly to our customer base" and "data 
>mining" in conjunction with encrypted registry entries containing user 
>data makes me very nervous. Does this mean Zone Alarm is potentially an 
>even more dangerous threat to privacy than advertising supported 
>software. Being a program it can access any Registry Information (ANY, 
>not just the keys referred to above) or any Disk File that it chooses 
>to. 
>
>I restarted in DOS mode and checked what files were left behind:
>
>Directory of C:\WINDOWS\INTERN~1 ("Internet Logs" the Zone 
>Labs\TrueVector\LocalStoreDir)
>
>.              <DIR>        03-17-00  3:19a
>..             <DIR>        03-17-00  3:19a
>IAMDB    RDB        37,376  03-17-00  7:22p
>OEMCOM~1 LDB        22,016  03-17-00  7:22p
>         2 file(s)         59,392 bytes
>
>According to 
>
>http://www.zonelabs.com/zonealarm/za_faq_details.htm
>
>The IAMDB.RDB file contains all the Internet access restrictions for 
>your computer. This includes: rules, their settings, and objects that 
>the rules apply to: programs, users, computers, subnets, zones, etc. 
>
>The <mycomputer>.LDB file is the Internet log database for your 
>computer. They say the only thing that is stored in the logs for 
>ZoneAlarm is your computer's name and IP address, and icon bitmaps for 
>your programs. However if their IAM experimental software is (later ?) 
>installed it enables the maximum logging capability of the engine, 
>including: programs that have used the Internet, users that ran them, 
>protocols they've used, sites they've connected to, and every other 
>piece of information you see in the IAM log and alert windows.  This 
>leaves a lot of unanswered questions such as: under what circumstances 
>is the IAM experimental software installed, is the user informed at the 
>time, do they consent to the collection of this data, why is it being 
>collected, etc. Can it ever be read or uploaded through an internet 
>connection (with or without your knowledge).  Lots of potential for 
>invasion of privacy there.
>
>The above is user data that is of no use with the program gone, it 
>should have been presented in the uninstall as an optional delete.  It 
>wasn't, so I manually deleted the contents of this directory and removed 
>the directory. Also remaining was:
>
>Directory of C:\PROGRA~1\ZONELA~1\ZONEAL~1
>
>.              <DIR>        03-17-00  2:57a
>..             <DIR>        03-17-00  2:57a
>ZONEBAND DLL        76,560  02-16-00  7:41p
>         1 file(s)         76,560 bytes
>
>The above is likely the item on the tool bar. I manually deleted the 
>contents of this directory and removed the directories ZONELA~1\ZONEAL~1
>
>Then I restarted Windows and checked the Registry again and found Zone 
>Labs keys still existed with the encrypted user data intact so I 
>manually deleted keys 
>
>[HKEY_CURRENT_USER\Software\Zone Labs] and 
>[HKEY_LOCAL_MACHINE\Software\Zone Labs]   
>
>These keys should have been removed in the uninstall, I am not 100% 
>certain they were not as I had REGEDIT running at the time the uninstall 
>was running (started before uninstall) and I did not close it until 
>after uninstall finished so REGEDIT may have rewritten deleted data.  
>Perhaps somebody else can test after an uninstall when REGEDIT is not 
>running.
>
>On checking from the file list in
>
>http://www.zonelabs.com/zonealarm/za_faq_uninstall.htm
>
>I also noticed that the c:\windows\system\vsutil.dll was not removed by 
>the uninstall.  This .dll seems to handle the on line registration for 
>Zone Alarm.
>
>Christopher Anthistle