🚀 go-pugleaf

Very interesting -- sounds like employing the fox to guard the henhouse!

Matt

Christopher Anthistle wrote:

> Absolute trust in Zone Alarm is required by the user (that it will not
> transmit unauthorized data), I don't now have that trust so I
> uninstalled it (using the custom option to get rid of everything listed)
> a few days after I installed it.
>
> Why ?  I have concerns about privacy on the internet and potential
> invasion of privacy by cookies (especially from an advertising company
> that now owns a mail order database), by advertising supported software,
> and the fact that Zone Labs is giving away for free an apparently
> excellent fully functional program that does not appear to be time
> limited. They may of course be innocently testing and debugging it
> before making a paid version available in stores and/or by e-commerce,
> but they could also be laying the groundwork for a future invasion of
> privacy on a grand scale. Who knows what this firewall program is or
> will be doing behind the scenes.
>
> There are too many things that don't add up so I don't want to take a
> chance on it. For whatever it is worth, here is what I know for sure:
>
> I checked some of the Windows Registry entries it made and was surprised
> to find that in
>
> [HKEY_LOCAL_MACHINE\Software\Zone Labs\ZoneAlarm\Registration]
>
> the user information was in encrypted format. I do not know of any other
> programs that do this.  What, I wondered are these guys hiding.  Why is
> the user denied knowledge of what registry information is kept about him
> or her.  This is my registry, not theirs.
>
> The full list of entries for this registry key is (encrypted data has
> been removed, I replaced it with ="" ):
>
> "Address1"=""
> "Address2"=""
> "City"=""
> "Country"=""
> "EMailAddr"=""
> "Phone"=""
> "PostalCode"=""
> "RegisteredOrganization""
> "RegisteredOwner"=""
> "State"=""
> "WantEmail"=""
> "WantPost"=""
> "SurveyComputers"=""
> "SurveyNetConn"=""
> "SurveyPeople"=""
> "SurveyUse"=""
>
> Why, I wondered, are there any entries for
>
> "SurveyComputers"=""
> "SurveyNetConn"=""
> "SurveyPeople"=""
> "SurveyUse"=""
>
> If you are running Zone Alarm and wish to check your own registry click
> the Windows Start button, click Run, and type the word REGEDIT in the
> open dialog box and click OK (but don't change anything in the registry
> unless you know what you are doing).  Compare this with similar entries
> for other installed programs under the HKEY_LOCAL_MACHINE\Software key.
>
> I then checked the jobs on their website at
>
> http://www.zonelabs.com/jobs.htm
>
> and for the Director of Strategic Business Systems it says:
> "We are seeking a bright individual to be the heart of Strategic
> Business Systems; responsibilities will be to architect and implement
> the backbone of Zone Labs automated revenue accounting systems and e-
> commerce model. Play a lead role in creating marketing information
> systems that will allow us to target and market directly to our customer
> base using personalization software on our site, crafting direct
> electronic campaigns as well as collecting and consolidating our
> customer statistics (data mining). .........."
>
> Phrases like "target and market directly to our customer base" and "data
> mining" in conjunction with encrypted registry entries containing user
> data makes me very nervous. Does this mean Zone Alarm is potentially an
> even more dangerous threat to privacy than advertising supported
> software. Being a program it can access any Registry Information (ANY,
> not just the keys referred to above) or any Disk File that it chooses
> to.
>
> I restarted in DOS mode and checked what files were left behind:
>
> Directory of C:\WINDOWS\INTERN~1 ("Internet Logs" the Zone
> Labs\TrueVector\LocalStoreDir)
>
> .              <DIR>        03-17-00  3:19a
> ..             <DIR>        03-17-00  3:19a
> IAMDB    RDB        37,376  03-17-00  7:22p
> OEMCOM~1 LDB        22,016  03-17-00  7:22p
>          2 file(s)         59,392 bytes
>
> According to
>
> http://www.zonelabs.com/zonealarm/za_faq_details.htm
>
> The IAMDB.RDB file contains all the Internet access restrictions for
> your computer. This includes: rules, their settings, and objects that
> the rules apply to: programs, users, computers, subnets, zones, etc.
>
> The <mycomputer>.LDB file is the Internet log database for your
> computer. They say the only thing that is stored in the logs for
> ZoneAlarm is your computer's name and IP address, and icon bitmaps for
> your programs. However if their IAM experimental software is (later ?)
> installed it enables the maximum logging capability of the engine,
> including: programs that have used the Internet, users that ran them,
> protocols they've used, sites they've connected to, and every other
> piece of information you see in the IAM log and alert windows.  This
> leaves a lot of unanswered questions such as: under what circumstances
> is the IAM experimental software installed, is the user informed at the
> time, do they consent to the collection of this data, why is it being
> collected, etc. Can it ever be read or uploaded through an internet
> connection (with or without your knowledge).  Lots of potential for
> invasion of privacy there.
>
> The above is user data that is of no use with the program gone, it
> should have been presented in the uninstall as an optional delete.  It
> wasn't, so I manually deleted the contents of this directory and removed
> the directory. Also remaining was:
>
> Directory of C:\PROGRA~1\ZONELA~1\ZONEAL~1
>
> .              <DIR>        03-17-00  2:57a
> ..             <DIR>        03-17-00  2:57a
> ZONEBAND DLL        76,560  02-16-00  7:41p
>          1 file(s)         76,560 bytes
>
> The above is likely the item on the tool bar. I manually deleted the
> contents of this directory and removed the directories ZONELA~1\ZONEAL~1
>
> Then I restarted Windows and checked the Registry again and found Zone
> Labs keys still existed with the encrypted user data intact so I
> manually deleted keys
>
> [HKEY_CURRENT_USER\Software\Zone Labs] and
> [HKEY_LOCAL_MACHINE\Software\Zone Labs]
>
> These keys should have been removed in the uninstall, I am not 100%
> certain they were not as I had REGEDIT running at the time the uninstall
> was running (started before uninstall) and I did not close it until
> after uninstall finished so REGEDIT may have rewritten deleted data.
> Perhaps somebody else can test after an uninstall when REGEDIT is not
> running.
>
> On checking from the file list in
>
> http://www.zonelabs.com/zonealarm/za_faq_uninstall.htm
>
> I also noticed that the c:\windows\system\vsutil.dll was not removed by
> the uninstall.  This .dll seems to handle the on line registration for
> Zone Alarm.
>
> Christopher Anthistle