Zonealarm!

Printable View

February 23rd, 2002, 02:56 AM
I am a cracker

Zonealarm!

When I get on the internet from my mom's house she has (AOL) and Zonealarm (version 2.6) for a firewall, now recently every time she sign's on the internet as soon as it's connected this is what it say's

(not just this number but other one's as well)

The firewall has blocked routed traffic from 209.244.0.3 (DNS) to 63.215.221.200 (UDP Port 1722).

(for as long as she's on the net the firewall will keep reporting it popping up)

Time: 2/22/02 6:57:16 PM Now I know how to read all this and I understand it The firewall has blocked routed traffic from 63.215.221.200 (TCP Port 1671) to 64.136.16.72 (TCP Port 8505) [TCP Flags: S].

Occurred: 4 times between 2/22/02 6:53:18 PM and 2/22/02 6:53:38 PM

sometimes it says Occurred : 80 times within a matter of minutes I

I looked and did the dos thing nbtstat netstat etc...REgedit stuff msconfig thinggy control+alt+delete thing to she has anti-virus software.

The firewall has blocked routed traffic from 63.208.30.230 (TCP Port 1770) to 64.136.16.72 (TCP Port 8505) [TCP Flags: S].

Occurred: 3 times between 2/22/02 8:00:00 PM and 2/22/02 8:00:08 PM

I think it's my ISP or something messing around thats why I don't want to scan port's and do other stuff because if I do I am gonna wanna shut it down.. tired of it!

The firewall has blocked routed traffic from 172.154.112.81 (TCP Port 1151) to 205.188.50.141 (AOL) [TCP Flags: S].

Occurred: 58 times between 2/22/02 8:21:48 PM and 2/22/02 8:22:10 PM
Like right now AS I am writing this
help?
February 23rd, 2002, 03:01 AM
[WebCarnage]

Wern't you just the "ZoneAlarm-Hacker-Expert" just the other week mate?

Surely with your extensive knowledge on firewalls, you should know not to advise your own mother to use one that does no good, a resource hog you might say.

[P.S - Check under "Programs" and scroll down until you see your [mom's] ISP...then click on it to set ZoneAlarm to allow it access to the internet. :p Crazy eh? ...I dunno..ZA can be such a pain at times]
February 23rd, 2002, 03:04 AM
Ghost_25inf

not to worry as long as its being blocked.
February 23rd, 2002, 03:23 AM
echelon3

I did a trace on that IP ZoneAlarm is reporting to you and it came up as an ISP. Some ISP's do portscans on your computer every now and then (dunno why). ZoneAlarm is the crappest firewall in my opinion as it bogs down everything and does nothing. I use Norton Firewall 2002 Corporate Edition.
February 23rd, 2002, 03:40 AM
Vorlin

Quote:

Some ISP's do portscans on your computer every now and then (dunno why).

I'd say to make sure that their clients aren't running server-side programs like webservers, ftp servers, etc without paying for it.
February 23rd, 2002, 03:40 AM
3ntropy

Just as webcarnage said, I thought you were the ""expert"" on the poor security of zone alarm. Weren't you?
February 23rd, 2002, 04:53 AM
I am a cracker

Quote:

Wern't you just the "ZoneAlarm-Hacker-Expert" just the other week mate?Surely with your extensive knowledge on firewalls, you should know not to advise your own mother to use one that does no good, a resource hog you might say. Just as webcarnage said, I thought you were the ""expert"" on the poor security of zone alarm. Weren't you.

I am not the "Zonealarm-Hacker-Expert", I never said I was and never claimed to be neither, I advised my mother to use Zonealarm a while-ago because she is not to good with computers and that anyone can operate zonealarm (and configure) I know it has "spy-ware" inserted in it.She does nothing wrong so she ain't worried about it. I just came down to her house for this weekend and since I'm here I'll fix it for here. Mostly other firewalls are harder to operate!
February 23rd, 2002, 09:46 AM
darkes

Quote:

Originally posted here by I am a cracker

I am not the "Zonealarm-Hacker-Expert", I never said I was and never claimed to be neither, I advised my mother to use Zonealarm a while-ago because she is not to good with computers and that anyone can operate zonealarm (and configure) I know it has "spy-ware" inserted in it.She does nothing wrong so she ain't worried about it. I just came down to her house for this weekend and since I'm here I'll fix it for here. Mostly other firewalls are harder to operate!

Looking at your original description, this does seem a little odd, but I've never used AOL (and don't ever intend to), so I suppose they could be doing something strange.
What are you doing when this happens?
Does everything work, or do some types of requests fail?
What software configuration are you running?
In reply to echelon3/WebCarnage, I would have thought this showed that ZA is working as it is blocking suspect traffic. If you don't want to see the pop ups, you can disable them (you can always look at the log afterwards).
Curious about your comment about 'spy-ware' - perhaps you'd like to expand on this?
I've recommended ZA to friends in the UK who are not very computer literate on the grounds that some protection is better than nothing, and I've never seen anything like this.
February 23rd, 2002, 10:05 AM
I am a cracker

Quote:

Looking at your original description, this does seem a little odd, but I've never used AOL (and don't ever intend to), so I suppose they could be doing something strange. What are you doing when this happens?
Does everything work, or do some types of requests fail?
What software configuration are you running?
In reply to echelon3/WebCarnage, I would have thought this showed that ZA is working as it is blocking suspect traffic. If you don't want to see tCurious about your comment about 'spy-ware' - perhaps you'd like to expand on this?
I've recommended ZA to friends in the UK who are not very computer literate on the grounds that some protection is better than nothing, and I've never seen anything like this.he pop ups, you can disable them (you can always look at the log afterwards).

As a member of AOL I say never get this ISP it's sorry the techincal help you are better to figure it out yourself. "All I am doing is surfing the web" not hacking cracking nothing illegal like that. The only thing that don't work is my mom's browser the (aol) browser.. Zonealarm, has spy-ware inserted in it It seems that ZA comes with two spy dlls that according to the their manufacturer. I found these two: C:WINDOWSSYSTEMVSMONAPI.DLL C:WINDOWSSYSTEMVSUTIL.DLL Had been left on my system . It seems that my system configuration and maybe the activity is logged to the file Iamdb.rbd, then transmitted. (not 100% sure though)

Quote:

They are watching us!

reply
February 23rd, 2002, 12:50 PM
darkes

Quote:

Originally posted here by I am a cracker

As a member of AOL I say never get this ISP it's sorry the techincal help you are better to figure it out yourself. "All I am doing is surfing the web" not hacking cracking nothing illegal like that. The only thing that don't work is my mom's browser the (aol) browser.. Zonealarm, has spy-ware inserted in it It seems that ZA comes with two spy dlls that according to the their manufacturer. I found these two: C:WINDOWSSYSTEMVSMONAPI.DLL C:WINDOWSSYSTEMVSUTIL.DLL Had been left on my system . It seems that my system configuration and maybe the activity is logged to the file Iamdb.rbd, then transmitted. (not 100% sure though)

reply

Ah ha, so you are complaining about what is left behind when you uninstall ZA. You are correct that this does not uninstall cleanly, but I'm not convinced there is any sinister intent here. I could be wrong here, but I don't think that any information about your system is sent elsewhere - anyone else care to comment?
February 24th, 2002, 11:04 PM
[WebCarnage]

I was doing a little research and found this.

The risks of using an AOL client behind a firewall

Many users wish to use AOL client or AIM (AOL Instant Messenger) behind the company firewall. However, opening the firewall for an AOL client can present a security risk to the entire network. AOL client connects to the AOL server at port 5190. This is usually easy enough for the administrator to configure the firewall to allow this port (5190), and the client will work properly. However, the AOL client establishes an IP tunnel to the AOL server and creates a VPN between the AOL network, and the Client's network (with the assistance of the AOL client of course), this basically allows complete communication between the client and the remote server (the AOL client receives an IP address on the
virtual network, and therefore there is no way the firewall can limit this communication), and this also means that the client is now exposed to all kinds of IP based attacks, such as nukes, access to personal web servers and ftp servers, and much more, from anyone on the Internet (All they have to figure out is the Virtual IP address given by the AOL server).

The firewall is basically helpless against this, because this is all going through port 5190 which was allowed for communication by the administrator. To see it in action, start your AOL client, and run "winipcfg" (under Windows 95) to see you have a new adapter (besides the dial-up-adapter or network adapter you used to connect to the Internet with). This adapter will have its own IP and gateway information. AOL's home page is at: www.aol.com For information on how to connect AOL client through a firewall, go here

Hope it helps.
February 24th, 2002, 11:32 PM
cmnoop

Zonealarm is a useless program made by idiots for idiots.

Also 'your moms house' is quite obviously your house as your say 14.

You use AOL and Zonealrm [which you can *disable*] and we should ph33r j00r skillzzzzz!

Hell no! Youre nothing but a glorified imbecile!

Go home little boy.
February 25th, 2002, 04:11 PM
iNViCTuS

Hey Cracker,

Have you told your mom yet about that porn site you were thinking about starting?

http://www.antionline.com/showthread...hreadid=219851

I'll bet she would be proud...
February 25th, 2002, 04:25 PM
Focmaester

Zonealarm isn´t such a bad product, the point is that they offered free personal firewalls for pc users and became very popular. So what do blackhats target? ZA users, Sygate makes a great firewall, but for how long? as oon as everyone switches then Sygate wil be the main target. And you can´t blame everything on the programs, sometimes it´s the OS´s fault.
February 25th, 2002, 04:48 PM
valhallen

lol @ iNViCTuS :)
February 25th, 2002, 05:05 PM
NetSyn

cracker stop wasteing your time here you are not and probly never will be accepted here by anyone here that is respected. You are caught on to many lies and you post stupid crap about how your going to hack us all and put virii you admit to writeing on our computers... Your nothing more then a 13 year old with sub7 and winnuke with a bug ego cause u have infected other ignorant people with the backdoor and made them think you were "elite". Get over yourself and grow up kid!

Anyone disagree with me id love to hear it and before they do please look in his profile and check out his last few post ;) then tell me if u still think im wrong.

_NetSyN_
February 25th, 2002, 05:41 PM
KorpDeath

Quote:

Originally posted here by Focmaester
Zonealarm isn´t such a bad product, the point is that they offered free personal firewalls for pc users and became very popular. So what do blackhats target? ZA users, Sygate makes a great firewall, but for how long? as oon as everyone switches then Sygate wil be the main target. And you can´t blame everything on the programs, sometimes it´s the OS´s fault.

It's not because ZA is the most widely used. you are mistaken. It's because the underlying technology is crap. The mutex engine won't work for much longer. the inherent weaknesses in it are too much to overcome. Anyway, I'm done bashing ZA.

P.S. NetSyn - You couldn't be more right..... :D :thumbsup: