• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

'Zonealarm spying on customers - ZA describes it as just a 'bug'...'

D

Diasper

Senior member
Inquirer article.

Wow is all I can say. If this is true I knew Zonealarm 6 was bad but not like that...

What about pre Zonealarm 6 users (ver 5.5) - I wonder if they are included or not.
 
From the article " The "bug" seems to be present in the retail version of Zone Alarm, so there?s no telling what the freebie gets up to.". So those with the paid for version are affected to.


This is why I have a linux box at all. Builtin open source firewalls/media players etc. that don't report your behavour to the highest bidder. Windows is full of this spying stuff.
 
Latest Pro version here. Am I affected by this?
Click to expand...

From what the articles and what other people are saying - very probably.


Woah, Checkpoint has an office in my building. I should go ask them what the deal is. 😛
Click to expand...

Lol. Yeah go up there and demand people's data back 😛
 
Useful blog entry here:

http://iggyz.com/blog/_archives/2006/1/23/1719960.html

If you can make it all the way through the lack of paragraph breaks it follows on the basic along the lines of nothing to worry about.

That said if for anyone still feeling funny you can disable the firewall contacting home - editing the hosts file should be one way of doing it.

Just out of interest what is the best firewall these days - paid or otherwise?
 
This is suspicious, a check for update only needs to retrieve information not send it.

Our company just does an HTTP GET to a static web page.
 
Originally posted by: DaveSimmons
This is suspicious, a check for update only needs to retrieve information not send it.

Our company just does an HTTP GET to a static web page.
Click to expand...

err...isn't that the same thing? the software sends out a message with the software's current version info to the server checking to see if there is a new version. if there is, it downloads it...
 
that's what they said. "the communication in dispute is a simple encrypted GET..". the only information it's sending, according to them, is the request.
 
Originally posted by: pontifex
Originally posted by: DaveSimmons
This is suspicious, a check for update only needs to retrieve information not send it.

Our company just does an HTTP GET to a static web page.
Click to expand...

err...isn't that the same thing? the software sends out a message with the software's current version info to the server checking to see if there is a new version. if there is, it downloads it...
Click to expand...
No, we just get the latest version available from the server, there is no reason why our software needs to send its own version.

For example, you're running FooBar 1.1.12, you send an HTTP GET to the server (which does NOT need to include anything beyond a URL for a page on the server) and get back a response saying the latest version is 1.1.16. FooBar decides .16 is higher than .12 and tells the user an update is available.

I'm not saying this is the only way version checks can work, just showing that they can be done sending zero information beyond a static page request like GET www.foobar.com/folder/version.htm with empty body and no cookies. We have tens of thousands of users doing it now.
 
Btw didn't the original author say (from whom this whole debacle started) that there was quite a significant amount of data sent - from files growing rather quickly. I may be wrong but I certainly don't know how that would factor in.

If true that doesn't seem readiy explanable/fit into the explained reason. That said this lies outside my area of expertise.
 
Originally posted by: ShotgunSteven
ZoneAlarm screwed up my system so bad I had to reformat. I refuse to use their product again.
Click to expand...

Really? It's not that bad is it? I havent used it since v5, but back then it was quite lightweight and easy to install/uninstall.

Originally posted by: DaveSimmons
No, we just get the latest version available from the server, there is no reason why our software needs to send its own version.
Click to expand...

DaveSimmons works for Chckpoint?
 
omg..here comes the paranoid freaks

its not like some men in black are going to show up at your door, its not like your suddenly going to lose all your assets and be on the run from the government, you all watch too many movies lmao
 
Originally posted by: ShotgunSteven
ZoneAlarm screwed up my system so bad I had to reformat. I refuse to use their product again.
Click to expand...

I've never cared for their products. If you have a little common sense you don't need to use a software firewall anyhow. It's one less piece of software that has to run in the background and annoy you with messages.
 
Originally posted by: Atheus
Originally posted by: DaveSimmons
No, we just get the latest version available from the server, there is no reason why our software needs to send its own version.
Click to expand...
DaveSimmons works for Chckpoint?
Click to expand...
No I work for Respondus, Inc.

I was explaining that a check for update system does not need to send any information to the server, and certainly does not need to send large amounts of encrypted information.

In other words, the ZA folks may be lying.

If they wanted to show their innocence they could reveal the encryption method and private key used so that outsiders could decode the encrypted data and see whether it is more than a version number.
 
Technically data could be transmitted using a GET command too.

GET /server/file?myversion=5.1145?mycreditcardnumber=11111111111111111111

The server knows your credit card number, and it's just a GET command.
 
Originally posted by: xtknight
Technically data could be transmitted using a GET command too.

GET /server/file?myversion=5.1145?mycreditcardnumber=11111111111111111111

The server knows your credit card number, and it's just a GET command.
Click to expand...
True, which is why I mentioned a static page URL, empty body, and no cookies. For completeness I should add no custom headers are sent either 🙂

If you used a packet sniffer on my company's check for update you'd see it GETs an HTM page not a CGI page and that notihing else is sent besides stock browser headers.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top