🚀 go-pugleaf

comp.security.firewalls,can.internet.highspeed,alt.comp.freeware

Re: Zone Alarm - Why I don't trust it




In article <Frrozx.rF.0.queen@torfree.net>, bi446@torfree.net says...
> Absolute trust in Zone Alarm is required by the user (that it will not 
> transmit unauthorized data), 

A good motto:  Trust, but verify.  A number of people have used packet 
sniffers and dual firewall setups to monitor ZA for "phoning home."  To 
my knowledge, the only times ZA transmits data is when you register the 
product and when you click "more info" after receiving an alert.  Both of 
these are under the control of the user.  People who have examined the 
content going out, and who work with databases a lot, have stated that 
they see exactly the type of information they would expect if ZA is 
sending the information Zone Labs claims it is.

> I don't now have that trust so I 
> uninstalled it (using the custom option to get rid of everything listed) 
> a few days after I installed it.

The prudent thing to do.
 
<snip>
 
> There are too many things that don't add up so I don't want to take a 
> chance on it. For whatever it is worth, here is what I know for sure:
> 
> I checked some of the Windows Registry entries it made and was surprised 
> to find that in
> 
> [HKEY_LOCAL_MACHINE\Software\Zone Labs\ZoneAlarm\Registration]
> 
> the user information was in encrypted format. I do not know of any other 
> programs that do this.  What, I wondered are these guys hiding.  Why is 
> the user denied knowledge of what registry information is kept about him 
> or her.  This is my registry, not theirs.

A previous version from long ago did not do any encryption, and users 
complained about sending registration information out over the Internet 
"in the clear."  According to Zone Labs, they use "weak encryption" for 
this now.  I guess they're "d*mned if they do, d*mned if they don't."

 
> The full list of entries for this registry key is (encrypted data has 
> been removed, I replaced it with ="" ):
> 
> "Address1"=""
> "Address2"=""
> "City"=""
> "Country"=""
> "EMailAddr"=""
> "Phone"=""
> "PostalCode"=""
> "RegisteredOrganization""
> "RegisteredOwner"=""
> "State"=""
> "WantEmail"=""
> "WantPost"=""
> "SurveyComputers"=""
> "SurveyNetConn"=""
> "SurveyPeople"=""
> "SurveyUse"=""
> 
> Why, I wondered, are there any entries for
> 
> "SurveyComputers"=""
> "SurveyNetConn"=""
> "SurveyPeople"=""
> "SurveyUse"=""

These are your answers to the demographic survey that you may 
*optionally* complete when you register ZA.  As previously reported in 
the ShieldsUp NG,

	"Spiny Norman" <spiny_norman at hotmail.com> wrote in message
	news:38d13fbe@webster.GRC...
	> Ya know, I never really appreciated paranoia until I began to 
	frequent this
	> newsgroup.......
	>
	> When you install ZoneAlarm, you're asked if you want to register 
	and have
	> the chance to answer several questions( a survey!), including 
	your name,
	> company, email addy, a checkbox asking if you want to be 
	informed about
	> updates, full address, phone number, business or personal use, 
	method of
	> connection to the Internet, number of computers at this 
	location, etc. If
	> you look at the questions asked, and then look at the values in 
	this key,
	> you'll see a one-to-one correspondence.  "SurveyComputers" ties 
	to the
	> number of computers at this location, "SurveyNetConn" ties to 
	method of
	> connection, etc.

<snip>

> I then checked the jobs on their website at 
> 
> http://www.zonelabs.com/jobs.htm 
> 
> and for the Director of Strategic Business Systems it says:
> "We are seeking a bright individual to be the heart of Strategic 
> Business Systems; responsibilities will be to architect and implement 
> the backbone of Zone Labs automated revenue accounting systems and e-
> commerce model. 

OK, they want to automate their accounting system and sell their products 
over the Internet...

> Play a lead role in creating marketing information 
> systems that will allow us to target and market directly to our customer 
> base using personalization software on our site, crafting direct 
> electronic campaigns as well as collecting and consolidating our 
> customer statistics (data mining). .........."

Name ONE major e-commerce vendor that doesn't want to target its existing 
customer base for the sales of additional products.  This is not 
inherently evil.  Zone Labs would be destined for economic failure if 
they did not do this.

 
> Phrases like "target and market directly to our customer base" and "data 
> mining" in conjunction with encrypted registry entries containing user 
> data makes me very nervous. 

The weakly encrypted registry entries have already been explained.

> Does this mean Zone Alarm is potentially an 
> even more dangerous threat to privacy than advertising supported 
> software. Being a program it can access any Registry Information (ANY, 
> not just the keys referred to above) or any Disk File that it chooses 
> to. 

Any security product is *potentially* a greater threat to privacy than 
ad-supported software, because the user trusts it and gives it 
information and access that would not be given to an untrusted 
application.  That is the nature of the beast.  It can't do its job of 
securing your system if you don't trust it.

> I restarted in DOS mode and checked what files were left behind:
> 
> Directory of C:\WINDOWS\INTERN~1 ("Internet Logs" the Zone 
> Labs\TrueVector\LocalStoreDir)
> 
> .              <DIR>        03-17-00  3:19a
> ..             <DIR>        03-17-00  3:19a
> IAMDB    RDB        37,376  03-17-00  7:22p
> OEMCOM~1 LDB        22,016  03-17-00  7:22p
>          2 file(s)         59,392 bytes
> 
> According to 
> 
> http://www.zonelabs.com/zonealarm/za_faq_details.htm
> 
> The IAMDB.RDB file contains all the Internet access restrictions for 
> your computer. This includes: rules, their settings, and objects that 
> the rules apply to: programs, users, computers, subnets, zones, etc. 
> 
> The <mycomputer>.LDB file is the Internet log database for your 
> computer. They say the only thing that is stored in the logs for 
> ZoneAlarm is your computer's name and IP address, and icon bitmaps for 
> your programs. However if their IAM experimental software is (later ?) 
> installed it enables the maximum logging capability of the engine, 
> including: programs that have used the Internet, users that ran them, 
> protocols they've used, sites they've connected to, and every other 
> piece of information you see in the IAM log and alert windows.  This 
> leaves a lot of unanswered questions such as: under what circumstances 
> is the IAM experimental software installed, is the user informed at the 
> time, do they consent to the collection of this data, why is it being 
> collected, etc. Can it ever be read or uploaded through an internet 
> connection (with or without your knowledge).  Lots of potential for 
> invasion of privacy there.
> 
> The above is user data that is of no use with the program gone, it 
> should have been presented in the uninstall as an optional delete.  It 
> wasn't, so I manually deleted the contents of this directory and removed 
> the directory. 

I happen to agree that these should be optionally deleted.  The rationale 
for leaving them is so that the user's configuration settings won't be 
lost when doing an upgrade.  Zone Labs does document ther presence, 
however, as you have demonstrated.

> Also remaining was:
> 
> Directory of C:\PROGRA~1\ZONELA~1\ZONEAL~1
> 
> .              <DIR>        03-17-00  2:57a
> ..             <DIR>        03-17-00  2:57a
> ZONEBAND DLL        76,560  02-16-00  7:41p
>          1 file(s)         76,560 bytes
> 
> The above is likely the item on the tool bar. I manually deleted the 
> contents of this directory and removed the directories ZONELA~1\ZONEAL~1

It is.  It is documented that this must be removed from the toolbar (and 
I think you have to reboot, too) *before* uninstalling ZA, for this dll 
to be removed.

> 
> Then I restarted Windows and checked the Registry again and found Zone 
> Labs keys still existed with the encrypted user data intact so I 
> manually deleted keys 
> 
> [HKEY_CURRENT_USER\Software\Zone Labs] and 
> [HKEY_LOCAL_MACHINE\Software\Zone Labs]   
> 
> These keys should have been removed in the uninstall, I am not 100% 
> certain they were not as I had REGEDIT running at the time the uninstall 
> was running (started before uninstall) and I did not close it until 
> after uninstall finished so REGEDIT may have rewritten deleted data. 
>
> Perhaps somebody else can test after an uninstall when REGEDIT is not 
> running.

I just checked, and there *are* registry entries that get left behind 
other than those mentioned in the ZA FAQ.  I have recently uninstalled 
2.1.1, and have not yet installed 2.1.3.  I don't recall whether or not 
the uninstaller presented me with the option of deleting iamdb.rdb and 
<mycomputer>.ldb, but if it gave me the option, I'm quite sure I left 
them there, to save my settings for the upgrade.  I haven't done a 
thorough check of my registry, but just searching for entries containing 
the string "zone", I find:

HKCU\Zone Labs\Zone Alarm\Dialog Control		#listed in FAQ

HKLM\Software\Zone Labs\Minilog			#not listed in FAQ, but 
							relates to the new 
							*alert* logging feature, 
							and I don't think the FAQ
							has been updated

HKLM\Software\Zone Labs\True Vector\LocalStorDir#not listed in FAQ

HKLM\Software\Zone Labs\True Vector\LogStorDir	#not listed in FAQ

HKLM\Software\Zone Labs\True Vector\Zone Alarm\Registration\2.1.1
							#listed in FAQ

HKU\Default\Software\Zone Labs\Zone Alarm\Dialog Control
							#not listed in FAQ

> 
> On checking from the file list in
> 
> http://www.zonelabs.com/zonealarm/za_faq_uninstall.htm
> 
> I also noticed that the c:\windows\system\vsutil.dll was not removed by 
> the uninstall.  This .dll seems to handle the on line registration for 
> Zone Alarm.

vsutil.dll is *not* left on my system.  I am running win95b on this 
computer.  What OS are you running?  I know things get a little trickier 
with winNT, and especially win2K.  Also, it would help to know what 
version of ZA you uninstalled, as the uninstaller has undergone some 
fixing in later releases.

Rebeccah