Protect yourself from internet nasties! (Part one) (Zone Labs ZoneAlarm)

Member Name: hugon

Product:	Zone Labs ZoneAlarm
Date:	08/08/01 (852 review reads)
Rating:

Advantages: Free, Comprehensive protection against unauthorised access of your computer, Easy to set up

Disadvantages: Uses some more of your system's memory

After a friend managed to contract a Trojan horse, leaving his computer open to abuse by any hacker with a port scanner, I decided to get wise to net security. It was something I had neglected for far too long, I didn’t even have ant virus software; it was time to start looking after the computer. With Windows XP apparently being even easier to gain access than current Windows platforms, Internet security should be something to think about for all Internet users.

The first thing I did was visit http://www.symantec.com/securitycheck/. This is an online security check from Symantec, who provide the Norton range of utilities. I’ll honestly say that I was shocked to find out how open and at risk my computer was from being attacked. After installing the ZoneAlarm program, I was pleased to find my computer almost completely secure, much more secure and safe than before.

A firewall works by blocking access to and from the internet, except by pieces of software that the user has authorised to do so. It also hides any ports not currently in use by any programs so that the computer is not at risk from any port scanners looking for an easy way into your computer.

I visited http://www.zonealarm.com to download ZoneLab’s free piece of software and finally get a firewall on my computer (free for personal use, $19.95 if you want to use it for a business). It’s a 2.6 MB download, which should take no longer than 15 minutes on a 56K modem. It’s compatible with Windows 95/98/ME/2000/NT, so no messing around trying to find the right download for your operating system.

I have found the program quick and very stable. It has yet to crash on me, and there is no slow down for either the computer or internet access. It also integrates well with my other software, such as by banner and pop up blocking software.

Installation is quick and easy, it asks you a few questions, like how you access the Internet, and then it
adds itself to your start up menu and will kick into action whenever you try to access the Internet. It sits in your system tray and monitors all traffic leaving your computer and trying to access your computer. Clicking on the icon in the system try will bring up the program dialogue box and allow you to configure the program.

The first few times you run your normal programs, you will be prompted each time you run them, as to whether you want to allow them to access the internet. Each time you open a program, for example, Internet Explorer, ZoneAlarm brings up a prompt asking you if you want to allow it to connect to the Internet. It’s worth checking the box to remember your selection, otherwise you will get the prompt each time you try to open the program, which can be annoying. If you want to change the privileges a program holds, all you need to do is open the program and go to the programs page, find the relevant program and change it. Programs can either access the Internet every time, none of the time, or prompt you every time. As well as stopping nasty programs like Trojans gaining access to the Internet, this program will also prompt you when various spy ware programs try to access the Internet and relay data back to their servers about your habits. Blocking these programs from accessing the Internet prevents them from collecting your data. File sharing programs such as Morpheus and Napster will have to also be allowed to set up a file server otherwise they will not work correctly.

Each time another computer tries to access yours, a dialogue box pops up telling you how they are trying to access, as well as logging their IP address, so you can detect who they are and report them to their ISP. The more info button on the pop up will analyse the attempted access and tell you where they are coming from and in some cases the company owning the IP address. If the pop ups annoy you, you can turn them off. For convenience, all attempts to a
ccess your computer are placed in a log file on your hard disk, as well as being visible in the Alerts section of the program, where you can clear out the alerts and delete the log file if it has become too big. This section also logs the total amount of data uploaded or downloaded during each day.

The security settings section of the program allows you to change the security settings for your computer. The default settings should be perfectly satisfactory for the average user – there are settings both for the Internet and for computers on a network. For computers on a network, you can adjust whether computers are allowed access to your hard drive, whether you are visible on the network, to stop other users on the network viewing or playing with your files. To the stand-alone home user, this isn’t really a lot of use. The Internet security is by default set to high – not allowing Internet access to your computer from outside, and allowing you to stop all access to the Internet either form your computer or from the Internet itself.

Security also allows you to use mailsafe- a function where all emails that have files at risk from infecting you with viruses – e.g. exe, vbs and so on, are automatically quarantined to give you a chance to take action before you use them and they cause damage. It works by changing the extension to zl plus a number or letter. With emails one of the main sources of danger for viruses, especially those that copy themselves and email themselves to everyone in your address book, this is a blessing as even files coming from trusted sources can be a danger these days.

The lock feature is an emergency button should the firewall be breached, which prevents access to and from the Internet from your computer while you sort out the problem. It blocks all traffic, even from those applications that you have granted access to. It is also recommended that you use this option if you are going to be away
from the computer and leave it connected to the Internet that you use this option, although this will stop you being able to download files and email whilst you are away. However, programs can be configured so that they are allowed to pass the lock feature by checking the “pass lock” box in the programs menu. The lock can be set to automatically turn itself on after a certain length of time if your computer has been inactive in case your forget to activate it.

The program uses stealth to hide all ports on your computer that are not being used by any programs, preventing any scanners searching from open ports from actually seeing your computer. Trojans work by using ports on the computer, which if left open can allow people scanning for open ports access to your computer. By hiding the ports, it means the port scanners don’t even know you’re there. The Symantec security check reported that all known ports used by Trojans where invisible when I tested with the ZoneAlarm firewall operating.

I’ve been lucky so far not to have to deal with any dangerous attacks on my computer, I get a couple of attempted tries to access my computer each time I’m on the internet, but ZoneAlarm blocks them all successfully. It gives me an extra piece of mind that I’m safe when I’m on the Internet, but the attempts to access your computer do open your eyes as to how at risk you can be from the less honest users of the Internet.

This is the firewall recommended by Steve Gibson (http://www.grc.com), a respected expert on internet security, as it can recognise when some Trojans disguise themselves as legitimate software to try and access the internet. ZoneAlarm recognises the program has changed and alerts you about it trying to access the Internet. GRC.com also has a small program you can download which attempts to simulate a Trojan trying to connect with another computer, and ZoneAlarm successful intercepted and stop
ped it.

It’s easier than ever to access other people’s computers, as you can download programs such as SubSeven and Back Orifice which require only a few pieces of data changed and then the infected file can be joined to a legitimate file and sent off. Once installed, it opens the relevant port and sends a message to the person that infected you each time you go online, and once you are, it is easy for them to get a list of your passwords, delete files, and generally mess around. It isn’t worth the risk, and I recommend all Internet users, no matter how infrequently you use the Internet, to get a decent virus checker and install this firewall.

Summary: