Knock! Knock!... Nobody Home!!! (Zone Labs ZoneAlarm)

Member Name: MichaelR

Product:	Zone Labs ZoneAlarm
Date:	19/02/01 (239 review reads)
Rating:

Advantages: FREE!, easy to set up, easy to use, very little processing power required.

Disadvantages: None

So firewalls….

Many of you may be staring at the screen with a blank face right now, wondering what a firewall is, what it does, and whether you need one.

I can answer the last question easily enough – yes you do need one!

As to the other questions:

A firewall is basically a small program that helps to protect you against outside forces.

“Outside Forces?” all sounds very strange and mysterious eh? Outside forces as I have chosen to label them come in two major forms. The first manifestation of which is simply websites and other servers that you have visited trying to discover whether you are still connected, and if not, where you have gone. This is harmless enough. The second manifestation comes in an altogether more sinister form – the dark and deadly form of the hacker / cracker / snooper.

The second of these manifestations can be further subdivided. Most individuals that try to gain access to your machine are just indulging in a bit of amateur hour snooping – they’re mostly just people trying to prove to themselves that they can break into other people’s systems. They’re usually using pre-made tools (or Toolz!) and just having a look around. They’re pretty harmless really.

The second class of hacker is the nasty one that is out to make mischief. These are the people that get off on screwing up other people’s systems. Nasty people that like to just set off nasty payloads to destroy your precious data. Whilst they may be a pain – they don’t cause permanent damage. The worst that will happen is that you have a night of re-installing to look forward to. Obviously you want to avoid this if at all possible though.

The third class is the most dangerous. These are the pros. The people who are out to steal bank details, credit card numbers, passwords etc. These are the people who can hurt you… the ones you really want
to guard against.

Fortunately, there aren’t many of them out there. But even one is too many, and so you need to protect yourself.

This is where a firewall comes in.

Now, most hackers do not have a specific target – they are not looking for you, they’re just looking for anyone who looks vulnerable – and anyone without a firewall is vulnerable.

They basically search out vulnerable computers by using a scanning program. This works just like a radio scanner really – you know the type. What it does, is it ‘listens’ to different port numbers across a wide spectrum of IP (Internet Protocol) addresses, and sometimes also scans ranges of other popular protocols, such as POP, IMAP, (the two most popular e-mail protocols, Post Office Protocol and Internet Message Access Protocol) and Telnet.

The scanner works something like a sonar system. It sends out a ‘ping’ and waits to see if a ‘ping’ comes back. If it does, then the hacker knows that there is something out there - and that something could be YOU!

There are a great many scanning programs out there – pre-made and available for download, so anyone can scan ports really. This is where you get all those people playing amateur hacker from.

There are only a few ports that are openly used in modern Internet Communications. They’re mainly TCP/IP ports, and used for HTTP transfer (that’s just web pages etc) so you really don’t need all these other ports that the hackers are exploiting.

What a firewall does is it closes off all the ports except the ones that you are actually using. Therefore, when you are scanned, you appear to be invisible. Think of it as someone with a radar trying to find a bomber plane. If you have a firewall, then you’ve got a stealth bomber!

If you’re invisible, then no ‘ping’ goes back to the scanner, and it simply
moves onto the next IP address.

What’s good about ZoneAlarm, this particular firewall, is that it also restricts which programs can access the Internet from your computer – therefore if something suspicious comes up and asks permission to connect, you can refuse it and take appropriate action, such as running a virus killer or manually removing the program.

So not only is ZoneAlarm a firewall then, it’s also a sort of backup Trojan detector.

Trojan’s are basically infiltration programs. You can think of them as viruses that are worked manually. They are often spread in the same way as viruses, i.e. via e-mail and such like, but they are designed to allow someone a ‘back-door’ into your system, rather than being designed to perform a pre-programmed task.

Trojan’s are a tool in the arsenal of the professional hacker, as they allow the hacker to see when you’re on-line, and also allow the hacker to look directly into your system and extract the data that he or she wishes to have. This is all very discreet and can be performed without you ever knowing, as data is often duplicated rather than being simply extracted.

There is a particularly effective one known as “Back Orifice”. This is a client-server program that works with ICQ. The hacker keeps the server program, and sends out clients. The client carries a payload that renames your ICQ launch program to something else, and takes the name of the ICQ launcher for itself. Therefore, when you start windows, the shell extension in the Start-up folder loads the Back Orifice Client. This then chains the ICQ launcher, which launches ICQ, so you never know it’s there.

The only way you might cotton on is if you discover the extra file, but when you have hundreds of thousands of files, you’re hardly likely to notice until something weird happens.

This Trojan has the ability therefore to tell a h
acker when you are on-line, as well as allowing him or her remote access to your computer when it is switched on and is on-line.

ZoneAlarm is one of the best firewalls available, and it is FREE to home users. It is a breeze to install, and it offers varying security levels to meet your specific needs. Port scanning is blocked at all security levels though, and this is the main thing that you want a good firewall to do.

Every time you run a program that tries to connect to the Internet, or any Local Area Network that you may be on, it will ask you if you wish to grant this program access to the network. You can grant, refuse, always grant, or always refuse, so in the case of something like Internet Explorer, you can hit “Always Grant” and ZoneAlarm will remember in future that Internet Explorer is allowed to access the Internet.

You can also select whether you wish for programs to be allowed to act as servers or not (some have to be allowed to). Again, you have the yes/no/always yes/always no options.

The really great thing about the latest version of ZoneAlarm though is that it allows you to keep your Local Network and Internet settings separate, so for example you might allow Word to act as a server over your LAN, which you know to be safe, but not over the Internet.

There are also some other nifty features, such as an automatic Internet lock that comes into force when you’ve been away from your computer for a while, and you can manually set the time period. (Inactivity is an open invitation to hackers) This lock stops ALL Internet access whist it is on, although you can set privileges so that programs are allowed to pass through the lock.

There is also a ‘Panic Button’, which immediately stops all data flow. Useful if you’re visibly being attacked…

There’s extensive on-line help, should you need it, as well as help and very speedy and personalised support
available on the web.

You can also log all the scans your computer receives into a text file, and in the event of trouble, this can be sent to Zone Labs for analysis, and can help in catching any culprits.

Also, you can choose to be alerted whenever you are scanned, but I have this option turned off, as you will soon discover that you can be scanned up to 10 times a second, and it becomes annoying.

It can also tell you which ports you are using, and what programs are listening to which ports.

It’s just such a great little program, with so many great features, which at the same time is so very easy to set up and use, even for the least technically minded user. You never even know it’s there once it’s installed either. It just sits there and does its job without visibly slowing down your computer or your Internet connection.

I just cannot recommend this program highly enough.

Get yourself this and a copy of Norton AntiVirus 2000 (see separate op) or 2001, and then you’ll have the best protection available to you.

Get yourself along to http://www.zonelabs.com to download this excellent FREE program, or just to learn more.

You’ll wonder how you ever went so long without it.

Summary: