Vulnerability Development mailing list archives

Re: za and spyware (was: no subject)


From: Roy Wilson <rwilson9 () TWCNY RR COM>
Date: Wed, 13 Sep 2000 13:28:57 -0400

On Wed, 13 Sep 2000 08:28:17 -0400, Jonathan Rickman wrote:

I believe I can answer the question regarding ZA with some level of
accuracy by saying NO!!! ZoneAlarm will not detect the outbound
connections, or even warn about them in most cases. I believe (not
absolutely sure) that Tsadbot is the only one that actually connects to
the net on its own. All others, to the best of my knowledge, use your
default browser to establish a "piggyback" connection thus bypassing ZA.
@guard can be configured to stop them provided you know they're connecting
and where they're going.

        I'm not so sure of that - I was of the same opinion, then
noticed that ZA *will* stop a Superchat IRC session from a java webpage
link.  It LOOKS like it's connecting, but when ZA is active it just
sits there with "Connecting" blinking forever.  Hit stop, unload ZA,
retry and it zips right to the site/channel.



Roy Wilson  <Emperor_Wilson () email com> <CM# 1663> <WINS#6>
PGP Key available from certserver.pgp.com or pgpkeys.mit.edu


Current thread: