Search:  

 
theme to black backgroundlet page decide theme
HomeFind ServiceReviewsJob BoardISP NewsFAQsForumsToolsDatabaseAbout 
 
   News
newer
Alarming ZoneAlarm?
(old news - 12:22PM Wednesday Jun 16 2004)
In what has become both curious and creepy, users in our Security forum have been reporting that ZoneAlarm has been inexplicably "phoning home" to the BroadbandReports servers, apparently looking for updates. Once multiple users started reporting this, our site admins checked our own Apache logs and found many entries of the form:

X.X.X.X 404 0 POST http://update.zonelabs.com/checkupdate.asp HTTP/1.0 "Zone Labs Registration Agent 1.0"

This behavior remained even after running every anti-virus and anti-Trojan software known to man, and appears to be related to a discussion that appeared earlier this month (though not yet with the additional server weblog details).

It's happening on too many unrelated PCs to be "just a fluke", so we think this begs a few questions:
    •Is this actually ZoneAlarm phoning home, or an imposter?
    • Are we the only ones seeing this behavior?
    • If ZoneAlarm, why are they phoning here for updates?
    • If ZoneAlarm doesn't know (or can be fooled) where "home" is, how much can it be trusted in general?
"It's a very nice way to install a trojan on someone's pc if their firewall goes for updates to random places", jokes one of our site admins, who hopes that ZoneAlarm cryptographically signs their updates to forestall this kind of fraud.

So far none of these questions has been answered, but our forum is abuzz with members trying to find a common element. In addition, we've put out queries to administrators of other sites to see how widespread this behavior is.

The past month has seen numerous reports of various troubles with the latest beta version of the popular software firewall, leading some to wonder if the quality department at Zone Labs is on hiatus. It may very well be that this latest oddity is both explainable and innocuous, but at this point it can only be called "mysterious".

Forums » Alarming ZoneAlarm?
view: topics flat text 
Post a:
page: 1 · 2

CTCNetwork

join:2003-05-17
Notts

Bye-Bye ZoneAlarm

Sorry, but a security product, designed to protect your PC shouldn't be bugged with this sort of problem.:o
Hello Kerio, here I come.:D
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~I drive a Volvo, Please Don't Get In My Way!I owe, I owe, 'tis off to work I go. . . . . . . . .
permalink · 2004-06-16 11:46:12 · Reply to this

Steve
ho ho ho dammit
Consultant
join:2001-03-10
Yorba Linda, CA

Re: Bye-Bye ZoneAlarm

said by CTCNetwork See Profile:
Sorry, but a security product, designed to protect your PC shouldn't be bugged with this sort of problem.
It's not entirely certain that ZoneAlarm is even doing this: what if some badware is doing it with data patterns designed to make it *look* like ZA was doing this?

Only time will tell...
--
Stephen J. Friedl * Security Consultant * Tustin, California USA * my web site
permalink · 2004-06-16 12:25:52 · Print · Reply to this

TechieZero
Tools Are Using Me
Premium
join:2002-01-25
Wesley Chapel, FL

Re: Bye-Bye ZoneAlarm

said by Steve See Profile:
said by CTCNetwork See Profile:
Sorry, but a security product, designed to protect your PC shouldn't be bugged with this sort of problem.
It's not entirely certain that ZoneAlarm is even doing this: what if some badware is doing it with data patterns designed to make it *look* like ZA was doing this?

Only time will tell...
Have the people suspected with this problem, uninstalled ZoneAlarm and still notice the problem?
permalink · 2004-06-16 12:33:14 · Print · Reply to this

Smokey
I'm so much cooler offline
Premium
join:2003-05-20
Va Beach
clubs:
·Cox HSI

 Mine too had been doing it »ZA Logging attempts to reach DSLR??
but then stopped. I just checked again now, and it has yet again filled my logs with it. All 999 log entires are from TODAY alone.
--
You want 5 bucks to buy a 1.99 burger, and wonder why the democrats are in trouble?
permalink · 2004-06-16 15:23:28 · Reply to this

keith2468
Premium,MVM
join:2001-02-03
Winnipeg, MB

Maybe ZA had intended to plant a distro server on

Maybe ZoneLabs had intended to plant a distro server on BBR to reduce the cost of distributing updates.

Pretty strange though.

If it is a trojan trying to stop ZA updating, I'd expect it to try the same trick with other FW and AV software.
permalink · 2004-06-16 11:46:41 · Reply to this
GujuGuy67

join:2003-07-28
Garland, TX

Compentant Security

At least ZoneAlarm is somewhat competant at what it is designed to do... compared to say anything that Microsoft may make (i.e. Windows firewall).
permalink · 2004-06-16 11:47:40 · Reply to this
dave
Premium,MVM
join:2000-05-04
not in ohio
·Verizon Online DSL

Re: Compentant Security

said by GujuGuy67 See Profile:
At least ZoneAlarm is somewhat competant at what it is designed to do... compared to say anything that Microsoft may make (i.e. Windows firewall).
There's one in every crowd, huh?

... and it's strange how they usually can't spell.
permalink · 2004-06-16 12:03:10 · Reply to this

Steve
ho ho ho dammit
Consultant
join:2001-03-10
Yorba Linda, CA

Re: Compentant Security

said by dave See Profile:
There's one in every crowd, huh?
at least he didn't spell "Microsoft" with a $
permalink · 2004-06-16 12:13:01 · Reply to this

pcscdma
Chocobo Chocobo Random Battle
Premium
join:2004-01-14
Winterset, IA
clubs:

Re: Compentant Security

at least this hasn't turned into a fight between Microsoft and Linu$ Torvald$' wares.
--
Be patriotic or I'm reporting you to Ashcroft.
permalink · 2004-06-16 13:48:39 · Reply to this

Combat Chuck
Too Many Cannibals
Premium
join:2001-11-29
Erie, PA
said by GujuGuy67 See Profile:
At least ZoneAlarm is somewhat competant at what it is designed to do... compared to say anything that Microsoft may make (i.e. Windows firewall).
No, XP's firewall did exactly what it was designed to do; block unsolicited incoming connections. It just didn't do what you wanted it to do; block outgoing connections.
--
Japan-- Now with 30% more climbable telephone poles!!
permalink · 2004-06-16 12:08:05 · Print · Reply to this

Rhobite
Premium
join:2002-02-24
Cambridge, MA
clubs:

 Please give a specific example of what the Windows firewall fails to do. The only thing I can think of is that during startup there's a brief period of exposure before the firewall kicks in. I agree that this is a small problem but it's fixed in SP2.
--
Jimmysquid.com - I take pictures.
permalink · 2004-06-16 12:24:53 · Reply to this
dave
Premium,MVM
join:2000-05-04
not in ohio
·Verizon Online DSL

Re: Compentant Security

said by Rhobite See Profile:
Please give a specific example of what the Windows firewall fails to do. The only thing I can think of is that during startup there's a brief period of exposure before the firewall kicks in. I agree that this is a small problem but it's fixed in SP2.
...and it's not clear that ZA does not have the same exposure (see Security forum posts passim).
permalink · 2004-06-16 12:31:42 · Print · Reply to this

SpitefulCrow
Insert Witty Tag Here
Premium
join:2003-06-04
Berkeley, CA

Re: Compentant Security

Yay for system boot procedures that load firewall code and rulesets before any kind of network interface is brought online.
/linuxrave
permalink · 2004-06-16 14:08:13 · Reply to this

Steve
ho ho ho dammit
Consultant
join:2001-03-10
Yorba Linda, CA

Re: Compentant Security

said by SpitefulCrow See Profile:
Yay for system boot procedures that load firewall code and rulesets before any kind of network interface is brought online.
/linuxrave
<xprave>Yah for XP Service Pack 2, which does the same thing</xprave>
permalink · 2004-06-16 14:28:41 · Reply to this

SpitefulCrow
Insert Witty Tag Here
Premium
join:2003-06-04
Berkeley, CA

Re: Compentant Security

said by Steve See Profile:
said by SpitefulCrow See Profile:
Yay for system boot procedures that load firewall code and rulesets before any kind of network interface is brought online.
/linuxrave
<xprave>Yah for XP Service Pack 2, which does the same thing</xprave>
Yay for firewalls that give the user more control than "On" and "Off". /linuxrave
permalink · 2004-06-16 17:43:07 · Print · Reply to this

Steve
ho ho ho dammit
Consultant
join:2001-03-10
Yorba Linda, CA

Re: Compentant Security

<xprave>Yay for firewalls that have more than two users</xprave>
permalink · 2004-06-16 18:59:28 · Reply to this
keyboard5684

join:2001-08-01
Youngsville, PA		 Windows firewall allows you to modufy it to "open ports" or do what you wish.
permalink · 2004-06-16 19:37:00 · Reply to this

Steve
ho ho ho dammit
Consultant
join:2001-03-10
Yorba Linda, CA

edit:
June 16th, @08:58PM

Re: Compentant Security

said by keyboard5684 See Profile:
Windows firewall allows you to modufy it to "open ports" or do what you wish.
The one in XP/SP2: yes. The older firewall really sucked (even though it did what it claimed).
--
Stephen J. Friedl * Security Consultant * Tustin, California USA * my web site
permalink · 2004-06-16 20:27:17 · Reply to this

Rhobite
Premium
join:2002-02-24
Cambridge, MA
clubs:

Re: Compentant Security

Even the older one lets you open ports individually.
permalink · 2004-06-16 21:31:32 · Reply to this

SpitefulCrow
Insert Witty Tag Here
Premium
join:2003-06-04
Berkeley, CA

Re: Compentant Security

said by Rhobite See Profile:
Even the older one lets you open ports individually.
Ooh wow, opening ports. That's so great.
iptables supports connection tracking and customized matching based on almost every field in the packet/frame.
permalink · 2004-06-16 21:54:47 · Reply to this
keyboard5684

join:2001-08-01
Youngsville, PA
·WestPAnet Inc.
·WestPAnet Inc. CA..
·Verizon Online DSL

Re: Compentant Security

iptables, a Linux thing. Completely off base. We are not talking about complex firewall operations (which in my opinion the FreeBSD ipfw is far superior to a simple iptables function in linux), we are talking about Windows firewalls.

Zone alarm compared to the Windows firewall that is built in. In my eyes the Windows firewall is better because it shuts up. I do not think you should have to watch a firewall, it should just do its job. How many people go through there firewall logs and actually do something about it?

PIX firewall can track and customize matching/action on every field of the frame. Even a Cisco router can do what you stated without the firewall feature set. Checkpoint firewall can do it all to. I can go on and on about how many different firewall setups are better but since you learned how to write an iptable rule congrats.
permalink · 2004-06-16 23:08:55 · Print · Reply to this
dumbTNtech

join:2003-04-29
Knoxville, TN

 Say what you will, I've been doing ISP support for four years now and I haven't seen the ICF keep anyone offline. I have seen Zone Alarm suddenly block ALL incoming and outgoing traffic for no apparent reason. Then it's a real pain to remove. The ICF in WindowsXP seems to do a very good job. The only situation where it's not helpful is when you have a trojan on your system letting someone or something in. Of course, that never happens to anyone here.......
--
"Don't try to explain computers to a layman-easier to explain sex to a virgin."-R.A. Heinlein
permalink · 2004-06-17 09:45:29 · Print · Reply to this

Transmaster
Don't Blame Me I Voted For Bill and Opus

join:2001-06-20
Cheyenne, WY

edit:
June 16th, @01:02PM
said by GujuGuy67 See Profile:
At least ZoneAlarm is somewhat competant at what it is designed to do... compared to say anything that Microsoft may make (i.e. Windows firewall).
Don't compare the lame Windows Firewall as it is now with
what in included on the SP-2 Beta it works as well as any software firewall I have used.
--
»www.gobpl.com
permalink · 2004-06-16 12:56:26 · Print · Reply to this

robnelle
Blowing Kisses To You All
Premium
join:2001-12-05
Indianapolis, IN
clubs:
edit:
June 16th, @11:51AM

huh

What did Zone Labs have to say about it?
permalink · 2004-06-16 11:49:07 · Reply to this

dadkins
Go For It
Premium,MVM
join:2003-09-26
Hercules, CA
·Comcast

One reason I switched

That's one of the reasons I switched to Kerio 4.0.16. It seems that ZA just keeps having problems...enough so as to not to trust it. ZAP 4.5 did work well, but I'm happy with Kerio... for now.
--
When you've seen one nuclear war, you've seen them all. TheTechPub
permalink · 2004-06-16 11:49:16 · Reply to this

netwire
Premium
join:2001-04-27
Mooresboro, NC

Hmm..

Solution: Enabled "Manually Check for Updates"...
permalink · 2004-06-16 11:49:50 · Reply to this

Combat Chuck
Too Many Cannibals
Premium
join:2001-11-29
Erie, PA

Re: Hmm..

said by netwire See Profile:
Solution: Enabled "Manually Check for Updates"...
And pray that whatever is causing this actually pays attention to the setting.
--
Japan-- Now with 30% more climbable telephone poles!!
permalink · 2004-06-16 12:03:19 · Reply to this

CPM

join:2001-08-24
Miami, FL

Nothing but Problems

I had ZA two years ago and it is nothing but probems. Remeber a software firewall is only as good as the OS it is running on and Windows is not that secure.
permalink · 2004-06-16 12:00:22 · Reply to this

72276539
Premium
join:2001-01-19
Atlanta, GA
edit:
June 16th, @02:14PM

Re: Nothing but Problems

Wrong answer, sorry please try again. I have had plenty of problems with ZA but its not windows that writes the application. Its not windows that does the install routine nor is it windows that is phoning home.
permalink · 2004-06-16 14:13:22 · Reply to this

B52GUNR
KM 7D love and D3 Nirvana
Premium,MVM
join:2001-03-06
Alameda, CA
clubs:

Never liked ZA

I had no end of memory leaks with ZA. I personally prefer Sygate's free offering. Maybe I'll check out Kerio, as well.
permalink · 2004-06-16 12:05:18 · Reply to this

PhoenixDown
-- Ron Paul 2008 --
Premium
join:2003-06-08
Fresh Meadows, NY
clubs:

Odd

I am really interested in knowing why its contacting the bbr servers for updates.
--
www.shinraonline.com
permalink · 2004-06-16 12:09:31 · Reply to this
Samwoo

join:2002-02-15
Rancho Palos Verdes, CA
edit:
June 16th, @12:24PM

Wait?

Zone alarm doesn't ever automatically install updates anyways. when there is an update they link you to their site where you must manually download and run the new install.
The only thing it does automatically is check for updates.
permalink · 2004-06-16 12:22:59 · Reply to this

nil
Java Geek
join:2000-11-27

Re: Wait?

Yes, but considering it thinks *we* are their site.. well.. doesn't appear to be very secure, does it?
--
Life is too short to be boring
permalink · 2004-06-16 16:39:27 · Reply to this
Samwoo

join:2002-02-15
Rancho Palos Verdes, CA
edit:
June 16th, @12:24PM
 Hmm my browser didn't refresh properly...
is there any way i can delete this?
permalink · 2004-06-16 12:23:19 · Reply to this

Phoenix2088

join:2002-12-04
Strongsville, OH
clubs:
edit:
June 16th, @12:25PM
 Maybe the programmers of ZoneAlarm are fans of BBR? I mean who isn't?
permalink · 2004-06-16 12:25:12 · Reply to this

See 7 replies to this post
mkbaird

join:2000-03-30
Colorado Springs, CO
·Qwest.net

 I'm wondering if this started with version 5, or are even the older versions doing this updating thing. I'm still using 4.5. I'm not updating to 5 until I hear more positive reports etc. Does anyone know if there PC has called the BBR's?

Marcus
permalink · 2004-06-16 12:29:05 · Reply to this

netwire
Premium
join:2001-04-27
Mooresboro, NC
·RoadRunner Cable
·Millenicom
·Sprint Mobile Broa..
·Vonage
·WildBlue

 ZoneAlarm does a security check when you try and install an update - it ask if you are sure about doing the update... so if you don't know anything about an update and all of a sudden it tells you that it wants to install one.. be smart and tell it no, then go to the ZoneLabs web site and see if there really is an update.
--
StanaPhone - The Worlds First Free Telephone Service; www.stanaphone.com
Fact: AOL Cd's function best as drink coasters.
permalink · 2004-06-16 12:32:36 · Print · Reply to this

Rhobite
Premium
join:2002-02-24
Cambridge, MA
clubs:

 Are we sure that this isn't some sort of trojan or other sort of spyware on the users' machines, that's made to look like ZA? After all the traffic is being blocked by ZA and I'd assume that ZA lets its own "real" traffic pass through. Are we sure that ZA is the source of this traffic, and not some other program that's running on the PC?
--
Jimmysquid.com - I take pictures.
permalink · 2004-06-16 12:36:10 · Reply to this

Steve
ho ho ho dammit
Consultant
join:2001-03-10
Yorba Linda, CA

Re: Question for folks who've been following

If it *is* a Trojan or other badware, none of the anti-badware software is detecting it. Our users have been over the hills and through the woods looking for badware without any success.

Steve
--
Stephen J. Friedl * Security Consultant * Tustin, California USA * my web site
permalink · 2004-06-16 12:42:32 · Reply to this

Smokey
I'm so much cooler offline
Premium
join:2003-05-20
Va Beach
clubs:

Re: Question for folks who've been following

But when will we get to grandma's house?
permalink · 2004-06-17 02:31:35 · Reply to this

Owlbet
Ignite the Ice
Premium,MVM
join:2002-09-24
Palmer, AK
clubs:
·MTA Online
said by Rhobite See Profile:
Are we sure that this isn't some sort of trojan or other sort of spyware on the users' machines, that's made to look like ZA? After all the traffic is being blocked by ZA and I'd assume that ZA lets its own "real" traffic pass through. Are we sure that ZA is the source of this traffic, and not some other program that's running on the PC?
I highly doubt that. Most of the MVMs, VIPS, Mods, Regulars & general lurkers, run pretty tight ships. We come loaded with our hosts files, Spybot, Spyware Guard, Hi-Jack This, Ad-Aware, various AVs & ATs, etc. I agree with the consensus here that there is a programming flaw in Zone Alarm that is causing this and not some undiscovered malicious payload piggybacking on Zone Alarm.

On a lighter note....Zone Alarm wants to read the Security Update Sticky in the Security Forum.
--
Rocky is, was, and always will be Dawg E. Dawg. Miss you, pal.
permalink · 2004-06-18 02:52:53 · Print · Reply to this

LinuXProX

join:2000-04-23
Birmingham, AL
clubs:

We have seen a number of these type requests in our web server logs as well. Some include:
- - [15/Jun/2004:16:45:31 -0500] "GET http://avu.zonelabs.com/modules.txt HTTP/1.0" 404 20
 *5 "-" "Internet Download"

- - [15/Jun/2004:16:45:33 -0500] "GET http://update.zonelabs.com/checkupdate.asp HTTP/1.0"
 * 404 205 "-" "Zone Labs Registration Agent 1.0"

(*) WARNING 2 long line(s) split

--
»www.OverclockersClub.com
permalink · 2004-06-16 12:50:11 · Print · Reply to this

See 7 replies to this post

Maggs
Premium
join:2002-11-29
Woodside, NY
clubs:
·RCN CABLE

 It was one of the ZoneAlarm coders who was surfing BBR at the time. He might have typed BBR's IP in instead of ZA's.

I use Sygate, so I will check my logs to see if it occurs in other Firewall products.

I feel sorry for the site admins, getting pounded by stupid ZA cilents. Why don't the site admins, set a redirection to the actual ZA update servers, that way it might get corrected.
--
Paperclips do not belong inside a printer. Snapple Tech tip #123
permalink · 2004-06-16 12:53:47 · Reply to this

Steve
ho ho ho dammit
Consultant
join:2001-03-10
Yorba Linda, CA

Re: Maybe... Just Maybe

said by Maggs See Profile:
Why don't the site admins, set a redirection to the actual ZA update servers, that way it might get corrected.
Because "posting front-page news" on a busy site like BBR is much more likely to capture their attention
permalink · 2004-06-16 13:11:12 · Reply to this

Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
clubs:

 ... by a ZA detractor?

Has anyone captured the packet leaving their PC? Where does it send it's request when you perform a Manual Update Check?

Things that make you go Hmm.

HOSTS file hijack?

Proxomitron misfire?

Trusted Zones first site used?
permalink · 2004-06-16 12:54:55 · Reply to this

AcidLoops

join:2000-12-26
Ontario, CA		 I got away from that crap and switched to the free version of sygate a year ago.
permalink · 2004-06-16 13:21:01 · Reply to this

LordSoth3

join:2003-05-29
London, KY

Re: ZoneAlarm sucks.

x2, using Kerio 2.15 right now, have been for a few years for that matter.

No problems, does EXACTLY what I tell it to

Sygate, Outpost and Tiny are also very good.
permalink · 2004-06-17 19:18:27 · Reply to this

richk_1957
If ..Then..Else
Premium
join:2001-04-11
Minas Tirith

 When I upgraded to 5, I noticed that, although I had told it not to contact zone labs, it tried to. And as I've had other issues with 5, I uninstalled it.

4.5 doesn't have this problem. I've had no problems there so that is where I am right now.
permalink · 2004-06-16 13:22:42 · Reply to this

PunkGod

join:2003-02-02

I never liked ZoneAlarm

I never trusted that program from the day it came out. I will allways use a hardware firewall.
permalink · 2004-06-16 14:52:56 · Reply to this

LordSoth3

join:2003-05-29
London, KY

Re: I never liked ZoneAlarm

Well, in all honesty I will stick with Kerio 2.15 I see really no other firewall that I need besides it at this point. How can you guys even compare Zone alarm to Kerio for that matter? With Kerio you control what is going in and out, bottom line!

Ditch the ZoneAlarm newbie firewall and go with something a little more advanced such as Kerio 2.15

Nuff said

And come on, comparing windows firewall to Kerio? There is no comparison, Kerio eats the windows firewall for lunch and then spits it back out and laughs.

Come on guys, you guys that know about packets, filtering, networking protocols and the such should be able to see that Kerio or Outpost is by far superior to windows firewall for Zone Alarm.

Zone Alarm is meant to be a newbie firewall, simple at that. Remember that next time you get hacked and you wish you installed and was running a hardware firewall or Kerio with proxomotron.
permalink · 2004-06-16 19:40:15 · Print · Reply to this

Combat Chuck
Too Many Cannibals
Premium
join:2001-11-29
Erie, PA		 Will that hardware firewall let you block a particular piece of software from phoning home?
--
Japan-- Now with 30% more climbable telephone poles!!
permalink · 2004-06-16 20:41:58 · Reply to this

PunkGod

join:2003-02-02

Re: I never liked ZoneAlarm

said by Combat Chuck See Profile:
Will that hardware firewall let you block a particular piece of software from phoning home?
Yes but it doesn't have that problem. I'm using a cisco firewall.
permalink · 2004-06-16 22:26:05 · Reply to this

LordSoth3

join:2003-05-29
London, KY

Re: I never liked ZoneAlarm

I like Cisco You can be extremely strict with what you want to let out or in as with any application. I would say you can deny that program from phoning home pretty easily even with a software firewall if you know what you are doing.
permalink · 2004-06-17 19:16:27 · Reply to this
Forums » Alarming ZoneAlarm?page: 1 · 2

Friday, 09-Jan 05:35:27 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 9 years online! © 1999-2009 dslreports.com.republican-creole