ZoneAlarm Question

Ok I hope that this doesn't turn into a this product sucks, use this one, or a You shouldnt use Outlook debate... This is just a question that I was wondering if anyone had thought about or run into.



Here is the scenario:

I have ZoneAlarm Pro Loaded

I am using Outlook 2000 as my mail client

I have MS Word 2000 set as my default email editor

I receive an email with a hyperlink

I click on the hyperlink, ZoneAlarm Pro prompts me to let MS Word access the Internet

I click yes and remember this answer

Latter I receive a document as an attachment that is infected with a macro virus mass-mailer (for sake of this question lets assume that the virus is new and my anti-virus definitions will not catch it)

Since I have already told ZoneAlarm to always allow MS Word to access the Internet will it allow the virus/trojan/whatever to access the Internet and send out multiple copies of it self?

Any comments are welcome.

It shouldn't because that trojan should be leaving as a different program. Unless it uses your Word 2000 to leave. Or if it uses your Outlook program to send the mail then it might get past.
Hope this helps:p

um maybe my reasoning or understanding was all lost with my last test, but i don't know what the quesion is.

-havanger

Havenger-

Sorry if I was not clear the basic question is:

if ZoneAlarm is set to always allow MS Word to access the Internet will it allow a macro virus/trojan/whatever in MS Word to access the Internet thus defeating the blocking of un-solicited outbound traffic?

Thanks

If the macro virus was entirely Word-based, yes. The thing is, though, (as far as I know) you really can't do much on the internet with Word Macros. If somebody really wanted to do something malicious, they would have to have an external program (ex visual basic script) do it which ZoneAlarm would then prompt for.

As far as emails, though, yes - a Word macro could start shooting off emails and if they sent them through Outlook, then you wouldn't be alerted.

BOFH

The answer to your question is, Yes it will be able to access the internet and mail copies of itself (Assuming you have Outlook as always being a to connect). Remember that Office products (Excel, Word, Outlook, Etc) are all interconnected and intergrate Visual Basic for Applications (VBA) therefore a macro virus could have ALMOST the same capabilities as a Visual Basic Program.

Now in regards to Zone Alarm Firewall:
Lets say you have Word , Outlook and Internet Explorer as always being connected...

The the virus could not only propagate itself through email (Courtesy of Outlook) , but it could also have the capabilities of downloading and executing a file from the internet (Courtesy of IE), as well as several other things such as editing the registry, etc, etc.. The possibilites are endless with VBA.

To top this off...If the virus creator anticipated a user having Zone Alarm...they could check to see if it was installed ; and then delete or corrupt it...

At that point it could use FTP (Courtesy of DOS) and download and upload files...

All with a macro.... :)

I hope this has helped to answer your question!

Personal Note: Honestly, I would not use Outlook or Outlook Express for an email client, for the simple fact that almost 95% of the email-propagating virii/worms target Outlook Users

Quote:

---

The the virus could not only propagate itself through email (Courtesy of Outlook) , but it could also have the capabilities of downloading and executing a file from the internet (Courtesy of IE), as well as several other things such as editing the registry, etc, etc.. The possibilites are endless with VBA

---

If I were to create a VB script to use IE to download a file from the internet, would not an IE window pop up? That is, from my experience with VBA (which is not all that much), you cannot easily hide an external program you are executing (IE). Granted, you could minimize it, but most people would probably catch that.

Ok.. First

Quote:

---

If I were to create a VB script to use IE to download a file from the internet...

---

VB Script and VB programming are not the same...VB Script is exactly as its name implies...a "scripting language" although yes, VB Script is based on Visual Basic.. VB Script uses the Windows Scripting Host to execute VBS files. Visual Basic Source is actually compiled to create applications.

Office uses VBA which uses the syntax of the Visual Basic Programming language.

Second..The Ability to Hide Shelled Programs.

If you wanted to run an application "hidden", then this can be achieved by taking advantage of the "vbHide" keyword.

Example:
Shell "[whatever]", vbHide

This would "shell" "whatever" and it would be hidden from the user's view...

Unfortunetly..if you try to download a file using vbHide..you will recieve a File Download Dialog Box...But you will not see IE

There is a way to download a file from the internet..without prompting or recieving a File Download Dialog Box...However I am afraid to post the source... for fear that someone will be tempted to misuse it.

Oddly enough when I was testing the code...I found that Zone Alarm gave me no warning... It did NOT give any alerts (even for Word) I even disallowed internet to M$ Word, and the file was still downloaded to my hard drive without warning...

Interesting isn't it... All from a Word Macro :)

Quote:

---

VB Script and VB programming are not the same

---

Sorry about that - I have to get out of the habit of classifying VB and VBA under just "VB". Thanks for pointing that out.

Definately interesting how everything could be piped through IE without ZoneAlarm knowing. Goes to show you still absolutely need antivirus, firewall, and always keep the antivirus up to date. Even then you have to make sure you are careful what you run.

No Need To Apologize :)

It is interesting how Zone Alarm didn't pick up on the file download...

I think I'm going to test it with Tiny Personal Firewall and see if it is detected. :)

Quote:

---

Originally posted by Simon Templer

If you wanted to run an application "hidden", then this can be achieved by taking advantage of the "vbHide" keyword.

Example:
Shell "[whatever]", vbHide

---

You can use numeric representations in place of 'vbHide', right? I forget what they are, but 0-5 or so, and one means totally hidden, another is minimized, another is maximized with focus, etc...

This kind of example is the main reason I A) Don't use ZoneAlarm and B) Use Eudora. I would like to add that in my search for a TPF-But-Not-TPF replacement firewall that works with my proxy/NAT service, Sygate's firewall is pretty good. I mean, it lets you do everything ZA (free ver) does, but lets you go into the guts with a liberal sprinkling of 'advanced' buttons. Not at advanced as TPF, but certainly a good bridge between ZA and TPF.

Anyway, with Sygate, You could probably tell it that Outlook can only access a certain host, certain port, or within a certain time frame...

That's an idea. Make it ask each time it wants to *SEND* mail to your mailserver... hmmmmm. It would be a lot less annoying than a 'check mail->ask with popup' rule.

Yes... You can use the numerical constants :)

There are six: (In Case Anyone Was Curious)

vbHide = 0
vbNormalFocus = 1
vbMinimizedFocus = 2
vbMaximizedFocus = 3
vbNormalNoFocus = 4
vbMinimizedNoFocus = 6

Oddly, numerical constant 5 is not listed! :)

I am not sure if this would work or not.
But, couldn't you just have ZoneAlarm ask you if you want <insert MS app> to connect to the internet everytime you send an email off?

You can just delete MS Word from your list of programs that are allowed to access the Internet.

If the trojan is still active, ZoneAlarm will prompt you again and ask whwther you want to grant MS Word access to the Internet. Just check the always remember and click no.

Then download a anti-trojan program like TDS and rid yourself of it!

Quote:

---

Originally posted by Simon Templer

I found that Zone Alarm gave me no warning... It did NOT give any alerts (even for Word) I even disallowed internet to M$ Word, and the file was still downloaded to my hard drive without warning...

---

Would your concept still work if you used an external firewall device? As in a product you may have to shell out some cash for rather than.. let's say... Zone Alarm?

I've took a scientific approach and tested the results of my Macro Code and came up with the following:

Scenerio #1
----------------
M$ WORD is set to "ALLOW"

Upon Execution of the Macro: No Alert (Obviously)

Scenerio #2
----------------
M$ WORD is set to "ASK"

Upon Execution of the Macro: An Alert

BUT....

If "YES" is chosen:
The macro will download the file...(obviously)..

But also the following events will occur:
1) After choosing "YES" if the user attempts to engage the "INTERNET BLOCK" the files will still be download.
2) If the user attempts to "DISALLOW ACCESS" via the "PROGRAMS" option, the macro will still download the file.

If "NO" is chosen:

The file will not be downloaded

Note: It's important to clarify that the results of choosing "Yes" in Scenerio #2 will only apply to that particular Zone Alarm session.

I hope this has helped to clarify the abilities of my internet macro, as well clear up any misconceptions that may have been formed do to my previous posts. :)

TeKRoMaNCeR - I'm not sure...I wish I had the abilities to test that...but unfortunetly I don't have the network setup to do so.
Sorry :(