Internet Security Zone Blog

The New Z100G ZoneAlarm Wireless Router

NOTE: Our earlier version of this post had some inaccuracies, so this is a re-post.  Our apologies for any confusion.

Ever wanted a real Check Point enterprise class firewall protecting your home network?

We are pleased to announce our new Z100G ZoneAlarm Wireless Router:

This device is a real machine -- especially compared with some of the other wireless routers passing as firewalls out there today:

• Concurrent Firewall Connections: 4,000
• Gateway Antivirus
• Secure Remote Access to Home PCs
• 2 USB ports
• Check Point SecuRemote™ VPN client
• Print Server
• Real-deal logging and reporting
• VStream Gateway Antivirus - real-time scanning
• Check Point Patented Stateful Inspection Firewall
• Bandwidth Reporting
• Monthly Security Report

Consumers can get the same award winning ease-of-use and protection they expect from ZoneAlarm in a full strength package strong enough for Enterprise networks.

Take a look at the other coverage:

• Press release: Check Point unveils ZoneAlarm Secure Wireless Router
• ZDNet: Check Point debuts wireless-security router for the home
• CrunchGear: ZoneAlarm Secure Wireless Router Z100G: It’s The Software That Makes It Good
• PC Magazine: ZoneAlarm Launches Wireless Router
• TechWhack: ZoneAlarm now selling Secure Wireless Z100G router

Here's a slide that explains some of the key features (I'll try to post some screenshots later):

11/08 UPDATE:

This screenshot shows the logging and reporting tool showing blocked traffic. Note the VStream entry -- it shows malware being blocked as it passes through the gateway (on-the-fly scanning), protecting the systems behind it from attack.

Here is a screenshot of the traffic monitor. It can also help diagnose DDoS attacks or home bandwidth hogs.

Locked Your Credit Report Access? Make Sure to Leave Time for Credit Checks

Because of my identity theft, I'd frozen my credit reports at all three bureaus so no one could apply for credit in my name without unfreezing them.

If you lose the PIN number they give you when you freeze your credit you are in BIG trouble in terms of hassle and wasted time.

It turns out credit card companies do not know in advance, or won't tell you, which bureau they will check your credit on. Or perhaps they check all three. In any event you will need to individually unfreeze your credit lock temporarily at Experian, Equifax, and TransUnion if you need to have your credit checked.

I easily unfroze my credit reports at 2 of the bureaus, using a PIN they had given me. But for the third bureau I could not find my letter with the PIN.

Of course that was the one that the credit card company wanted to check.

This particular bureau has no way to reach humans. I finally was owning up to the fact that I'd have to mail them a certified letter with all the proof that I'm me - when their recording said "include your PIN."

They had no instructions if you don't know your PIN.

Thankfully the letter from them finally appeared stuck in my 3" high stack of identity theft papers.

I gleefully called the credit card company back to say I'd gotten the credit freeze lifted. "Has it been 5 business days since the lift?" the guy asked.

"No 5 minutes." I said.

Call back in 5 days he told me. And so it goes on.

So follow their advice to plan ahead if you're going to need your credit checked. I learned the hard way that YES this is true.

ZoneAlarm Security Suite Integrates Kaspersky Antivirus

PC World has a story:

While we haven’t looked at it yet, version 7.0 looks promising since Zone Labs is integrating the top-performing Kaspersky antivirus engine. (To get an idea of how it performs, read our review of Kaspersky Internet Security 6.0.) The Kasperksy engine replaces a lackluster version of the CA antivirus engine that was integrated into ZoneAlarm 6.0.

PC Magazine also has a report with some additional technical details:

The OSFirewall behavior-based protection, introduced in version 6, gains additional malware-mashing power. ZAISS's SmartDefense Advisor feature automatically configures program control for hundreds of thousands of known applications. A pre-install system scan automatically configures access for known programs present on the system.

By default ZAISS now starts in Learning Mode, which further cuts back on firewall confirmation popups.

If you would like to test the Beta, you can do so here. Just make sure you are ready to submit feedback and bug reports -- it is a beta after all.

Here's a screenshot:

Malware for Sale

Discussing the state of malware with the press, we often explain the big, highly visible worms of the past are falling out of favor with attackers, being replaced with hack-for-hire type work. Attackers have found they can make more money creating trojans and setting up spamnets (using home PCs, DDoS botnets) than creating highly visible worms (iloveu virus).

This recent post to full-disclosure (security/vulnerability mailing list) provides a good example:

---------- Forwarded message ----------
From: [redacted]
Date: Nov 12, 2006 11:20 AM
Subject: [Full-disclosure] Keylogger

Yesterday I finished programming a keylogger, and have decided to sell it online for a small price.  I have posted here because I believe people would be interested in a hacking tool such as this - keyloggers are the easiest and quickest way to obtain an email password.  Here are its features:

-> Undetectable by ALL antivirus products in use today.
-> Remains on victim's computer permanently (adds to startup).
-> Bypasses Windows Firewall.
-> Sends logs via email to your chosen email account.
-> Logs include computer information, current window name, and of course
logged keystrokes.
-> Logs are sent hourly.
-> Displays fake error message to user.

My pricing plans are:

-> $11 = Keylogger.
-> $16 = Keylogger + Source code.
-> +$5 to either for access to all future updates.

I only accept paypal/credit card.

Fortunately, OSFirewall will warn you if something attempts to log your keystrokes -- without the need for AV/AS signatures:

Here's what happens after you select "Deny":

If it's 10 years old, do I need to shred?

Back in the olden days (a year ago), I would have easily thrown out old non-confidential school documents and work records with ancient addresses on them, instead of shredding them.

However now I know that when you're a victim one identity theft, credit reporting agencies authenticate you by you confirming several old addresses.  Yesterday I bit the bullet and decided to shred a foot high stack of documents.

How do you shred 10 years worth of documents?
Curious if there are shredding services for consumers needing massive amounts of documents destroyed, I searched for "document shredding" and my city. There do seem to be such services around the country.

Some other ideas:

1) If you live in cold climates, there's always the option of making "paper logs" if you have someone to roll up your paper to burn - in your fireplace that is.

2) A company called Shred It had a COMMUNITY SHRED event last year with WalMart, offering free shredding.  They say to contact your local  Shred It to see if this will be going on again.

3) While I would never advocate using your employer's confidential shredding bins to dump your personal files, you might decide that's an option.  :)

What else do you need to shred?
The FTC has a comprehensive laundry list of the kinds of documents you should shred:

"When you discard receipts, copies of credit applications, insurance forms, physician statements, bank checks and statements, expired charge cards, credit offers you get in the mail and mailing labels from magazines, tear or shred them."

The mailing labels from magazines are particularly important to shred, and some magazine websites do not require authentication to change the address. (Yes, believe it or not it's true.)

Recently a friend threw out some checks from a bank account he had closed 10 years earlier. Somehow a dumpster diver found them and ended up using his identity to throw a party in a nearby hotel. Amazingly the police found and arrested the thief.

The bottom line is if someone could find mail and call up the sender to say "Oh I've changed my address. It's XYZ" that could be the start of your identity being stolen. Rather than worry, it's simpler to remove yourself from as many mailing lists as possible then shred all instances of your address. Or to me it is anyway!