Internet Security Zone Blog

Demo at DEMO

You can now see the video of the live product demo online and learn first hand what DEMO said about ZoneAlarm ForceField at DEMOfall 07 in San Diego.

Check Point Software Technologies, Ltd.

Dirty socks

Third day, same socks - it wasn't intentional. And it could be worse - these are my running socks that wick moisture and breathe…exceptionally well. But despite the ongoing activities and the practicing and the excitement of DEMOfall 07, I've got to get to Walgreens at some point today for more socks!  Otherwise I will need a ZoneAlarm ForceField around my feet when I'm up on stage demo'ing ZoneAlarm ForceField tomorrow afternoon.

Real people understand ZoneAlarm ForceField

People get it.  That's what's so pleasurable about showing off ZoneAlarm ForceField. Everybody seems to understand that the Internet is a dangerous place and it's only getting more dangerous. People *do* worry when they enter in their credit card number while shopping, or their username and password while banking.  When I began telling co-workers what ZoneAlarm ForceField was over a year ago, they understood it the same way that people I'm talking to here at DEMOfall 07  in San Diego get it.  They love the two-way bubble that the virtualization provides, throwing out all the unwanted crap and spyware that otherwise would hit their actual PC and steal their data - or recruit their PC into a horrible botnet!

I am getting some surprisingly sharp comments from even non-technical people.  They ask what ZoneAlarm ForceField does with files that they want to keep permanently, or with the cookies that remember them when they visit places like Amazon (answer: we make it exactly the same as without ZoneAlarm ForceField - no different).  They ask me what happens if they download something *on purpose* that's bad, because they understand that the "bubble" portion of ZoneAlarm ForceField only stops the things that are *un*solicited.  (answer: we detect dangerous Web sites, we scan downloads for danger, and we actually detect and jam spyware!). It's really nice to have solid answers to this stuff - people are psyched!

I was talking to my friend Caleb on the phone from DEMO today. I had sent him some of the great early press we got.  He told me he thought the product was cool and that he would actually use it - and he doesn't bother with any security right now.  He understood the benefits - and I think he really likes the private browsing feature.

ZoneAlarm ForceField released at DEMO

What better opportunity could a product manager hope for than to get invited to launch at DEMOfall 07!  This is where the hottest emerging products and technologies get revealed in front of the world's press and analysts. It's invitation only.  It's an amazing confirmation of the value of ZoneAlarm ForceField that we got invited. Sure, it also means weeks of stress as Laura, Allison and I prepare for our live presentation there, where the slightest bandwidth blip could send our carefully timed presentation amok.  But hey...(insert trite saying)! :)

How ZoneAlarm® ForceField™ got started

ZoneAlarm ForceField delivers a unique approach to security – not just another take or enhancement of something already out there, but something genuinely new.  So how did this come about?  Here is a rough, high level, story line about how we first decided to build a product like ZoneAlarm ForceField.

• Philosophy: We started as a firewall company, not an antivirus company.  That gave us the perspective of _preventing_ harm from coming to your computer in the first place, which is what firewalls do, rather than only _detecting and removing_ threats that have already gotten onto your PC, which is what antivirus does.
• Need for innovation: Hackers were innovating, finding new ways to attack, but there hadn’t been any truly significant innovations on the security side recently.  We were looking for an innovation that could combat these new attacks as well as attacks that haven’t been invented yet – an innovation that rivaled our initial Firewall and our more recent OSFirewall (mid-2005).
• Use the web: We became more and more interested in using the web to improve our security – to think “beyond the PC” and the bits on the PC.  We have always been a leading edge Internet company: our free ZoneAlarm firewall got more downloads than Napster at one point, and our DefenseNet community helps us identify threats more quickly, more quietly.  In June of 2006, we launched the Identity Protection Center with online services to help prevent and recover from identity theft. 
• Web evolution: The web continued to develop as a more sophisticated platform (“Web 2.0”, AJAX) and hackers were using new technologies and the web in news ways to attack customers: more sophisticated malware, rootkits, botnets, phishing sites, spyware, drive-by downloads, tools to quickly create new viruses, and more.
• Other technologies: We looked at lots of technologies and trends, like “on demand” software as a service, virtualization, communities and social networking, mobile, and much more.  We also looked at internal technologies including things from the enterprise side of Check Point, particularly ICS and virtualization.  We brainstormed with development, marketing, others – we proposed, reviewed and discussed a variety of different technology and company directions we could take.
• Bubbled up: A concept we internally called “Secure Browsing” clearly started to distinguish itself.  One of the enterprise PMs on ICS was particularly interested in a consumer solution with that technology.  Development became more and more interested in using virtualization in new ways to provide protection.  Check Point had already built some impressive technology in that area that we could build on. 
• Definition:  We needed to narrow and more clearly define what we wanted to do.  Product Management created scenarios to show how these technologies could deliver customer benefit.  We concluded that we needed to narrow specifically to the web session itself, not something broader, to provide very strong protection and a great user experience.  Research of this “web only approach”, including flat surveys and some more sophisticated conjoint analysis work done for us by our friends at Incyte Group, showed tremendous customer interest in this concept.

So we decided, in the second half of 2006, to go for it.  And then the real work began (if you don’t count all of that technology that had already been developed) and grew, with teams from Minsk and California joining forces to deliver the first public beta that launched today.

Enjoy.

ZoneAlarm Security Suite 7.0: New AV Engine

ZoneAlarm 7.0 has been released and is available for download. One of the major improvements for 7.0 is the new AV engine. I wanted to provide some extra details about why this improvement is so important.

The Extended Database:
The new AV scanner will scan not just for Viruses, but also Trojans, Keyloggers, Remote access tools (in case someone attempts to install VNC server on your system without your knowledge). This is all done in the AV scan itself and also extends to the on-access scanning. Most other AV scanners limit the on-access scanning to virus-only -- they don't provide on-access scanning for trojans, keyloggers, etc.

This means that if a keylogger (or other malware that isn't specifically a virus) gets loaded on your system and attempts to start, the on-access scanning can catch and quarantine it. After you conduct a scan, in the scan results window, you may see malware with "not-a-virus" pre-pended to the virus name. This usually means it was detected by the Extended Database.

If you have installed a remote access tool like VNC, and it's getting picked up by the scanner (remember, bad guys use these tools on compromised machines as well), you can use "Ignore Always" in the scan result window. This adds that program to the "Exception list" and the scanner will ignore it during subsequent AV scans.

To enable or disable the Extended Database entirely, go to Anti-virus | Main and select Advanced Options. In Advanced Options, go to Scan Options and deselect the check box that says "Enable extended database".

ZoneAlarm products also provide the Anti-spyware scanner which still operates as it did before -- this new function of the Extended Database expands coverage and adds on-access protection for spyware contained in the Extended Database. It's almost like having two independent spyware scanners on your system -- these two powerful, complimentary anti-spyware technologies provide the best protection possible.

Read more about other significant changes in ZoneAlarm Internet Security Suite 7.0.

 

The New Z100G ZoneAlarm Wireless Router

NOTE: Our earlier version of this post had some inaccuracies, so this is a re-post.  Our apologies for any confusion.

Ever wanted a real Check Point enterprise class firewall protecting your home network?

We are pleased to announce our new Z100G ZoneAlarm Wireless Router:

This device is a real machine -- especially compared with some of the other wireless routers passing as firewalls out there today:

• Concurrent Firewall Connections: 4,000
• Gateway Antivirus
• Secure Remote Access to Home PCs
• 2 USB ports
• Check Point SecuRemote™ VPN client
• Print Server
• Real-deal logging and reporting
• VStream Gateway Antivirus - real-time scanning
• Check Point Patented Stateful Inspection Firewall
• Bandwidth Reporting
• Monthly Security Report

Consumers can get the same award winning ease-of-use and protection they expect from ZoneAlarm in a full strength package strong enough for Enterprise networks.

Take a look at the other coverage:

• Press release: Check Point unveils ZoneAlarm Secure Wireless Router
• ZDNet: Check Point debuts wireless-security router for the home
• CrunchGear: ZoneAlarm Secure Wireless Router Z100G: It’s The Software That Makes It Good
• PC Magazine: ZoneAlarm Launches Wireless Router
• TechWhack: ZoneAlarm now selling Secure Wireless Z100G router

Here's a slide that explains some of the key features (I'll try to post some screenshots later):

11/08 UPDATE:

This screenshot shows the logging and reporting tool showing blocked traffic. Note the VStream entry -- it shows malware being blocked as it passes through the gateway (on-the-fly scanning), protecting the systems behind it from attack.

Here is a screenshot of the traffic monitor. It can also help diagnose DDoS attacks or home bandwidth hogs.

Important - Update Your Windows Immediately to Address Internet Explorer Security Issue

Microsoft has released a Windows Update to address a critical security problem in Internet Explorer that came up a few days ago that allows a variety of keyloggers, trojans, etc. to invade PCs. As it's an exploit, the payload (the evil stuff that gets force fed into the browser) can be anything.

How to update your Windows
Here are details and links to the updates.
http://www.microsoft.com/technet/security/Bulletin/MS06-055.mspx
Of course you can also go to Start / Windows Update.

Update your ZoneAlarm if necessary
In our tests we found that ZoneAlarm Internet Security Suite blocked many, if not all, of the trojans with the network firewall and OS Firewall.

Make sure to update your antivirus and anti-spyware in your Internet Security Suite if need be:

1) Open your ZoneAlarm product by double-clicking the icon in the lower righthand corner.
2) Click Anti-virus / Anti-spyware on the left.
3) If you see red "update" links, click them to update.

If you have problems please go to ZoneAlarm user forums where you'll find some helpful people to answer your questions.

Good Reminders About Security on Public Wireless Networks

A New York Times article offers useful reminders that "Web Surfing in Public Places Is a Way to Court Trouble."

When on your own laptop, make sure to maximize your security strength:

• Set your ZoneAlarm firewall to HIGH.
• Add the new wireless network to the "Untrusted" zone.
• In advance, add sensitive data to ZoneAlarm's IDLock (available in ZoneAlarm Internet Security Suite and Pro).
  
  You'll then be warned if your data is being transmitted from your computer at a time when you haven't sent it.
  
  A note about the alerts: If you have short numbers like 1234 you may get warnings since IDLock reports on any data leaving the computer including network traffic.

Problems with Gmail not loading when you try to log in? Check your ZoneAlarm

I thought I'd share my experience with past problems trying to log into Gmail, where it seemed to hang and continually loop instead of loading my inbox.

It's hard to know what's causing problems like this - the browser, the Gmail service itself, other software? In one case I found the answer in Gmail's help: It was my ZoneAlarm blocking an unallowed site (Gmail).

The solution: I simply needed to add Gmail (or rather mail.google.com) to my site list in ZoneAlarm Internet Security Suite.

It takes just a second to fix this for Gmail and other sites you log into often, so you can permanently allow cookies to be set and avoid problems logging into your accounts.

In ZoneAlarm Pro or Internet Security Suite:

1. Click the Privacy tab on the left.
2. Click the Site List tab at the top
3. Click the Add button
4. Add mail.google.com
5. Click the 'X' under 'Persistent Cookie Control' for 'mail.google.com.'
6. Set the cookie control to 'Allowed.' It will become a green checkmark.
7. Clear your browser's cache, and log in to Gmail.

I recommend also reading Gmail help in case it gets updated with other info about this issue. Here's what the screen looks like after you're all set up: