# ZoneAlarm: How robust is this PC firewall? **URL:** \ **Category:** Factual Questions\ **Created:** [September 10, 2003, 1:17am UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649 "2003-09-10T01:17:31Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Mort\_Furd](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Mort\_Furd](https://boards.straightdope.com/u/Mort_Furd)\ **Post date:** [September 10, 2003, 10:48am UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/21 "2003-09-10T10:48:04Z")
> [@](#): > > \*Originally posted by Anthracite \* > ZoneAlarm is good stuff, and if I didn’t use **hardware firewalls** exclusively (which I find superior, but that’s a whole other debate), I would use it instead. Which are software firewalls embedded in an appliance. The real difference is that being on a seperate system, an all out attack that results in a crash or compromise of the firewall leaves your working system untouched. Also, since the embedded system is usually in ROM or FLASH on the hardware, it is much more difficult to compromise one and make a permanent change to the hardware. The weak spot in any firewall is that there might be some way of intentionally mis-forming a data packet that will crash the firewall software. If it can be done, then there’s a good chance it can be done so as to execute program code that was in the packet. With a PC based firewall, the chances are then good that the attacker can then get into your system and install some kind of worm or find someway to leave a permanent hole in your firewall - which he can then return to and attack later. That won’t happen on a “hardware” firewall. It is far more difficult to make it do something permanent. On the other hand, some firewall manufacturers leave a back door in the appliance, and a default password so that they can get in and update software - or so that the system’s real Admin can do the same from outside. Bad ideas, both, but I’ve read of instances where it happened. Gouda: Assuming you only connect to the Internet through your hub PC, you should be fine. If the any of the other PCs are connected so as to be able to connect to the Internet directly (have their own modem or DSL connection ,etc.) then you most definitely need a firewall on each. ---
**Author:** ![El\_Zagna](https://avatars.discourse-cdn.com/v4/letter/e/d2c977/32.png) [@El\_Zagna](https://boards.straightdope.com/u/El_Zagna)\ **Post date:** [September 10, 2003, 1:00pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/22 "2003-09-10T13:00:44Z")
Great information all around. Thanks folks. While 1000 intrusions a week sounded like an awful lot to me, once I did the math it came to 6 per hour for a system that’s on 24/7. That’s not too outrageous. I just installed McAfee’s Virus Scan and it comes with McAfee’s own firewall (Guardian), and I’m guessing that Norton’s anti virus software comes with a firewall too. Is ZoneAlarm enough better that McAfee’s or Norton’s firewalls that I should replace them with ZA? ---
**Author:** ![Anonymous\_Coward](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@Anonymous\_Coward](https://boards.straightdope.com/u/Anonymous_Coward)\ **Post date:** [September 10, 2003, 1:34pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/23 "2003-09-10T13:34:24Z")
> [@](#): > > \*Originally posted by gouda \* > \*\*I have a 3 computer LAN in my little office. I have a proxy server on the hub computer through which the other two computers are connected. I have ZoneAlarm installed on the hub - do I need to install it on the client machines too? > > Absolute non-geek here - I’m not even sure whether what I’ve just typed makes sense or not! \*\* Are you using the Internet Connection Sharing feature of your OS? Zonealarm Standard (the free one) will not act as a firewall for your ICS clients. Only Zonealarm Pro will do that. I recommend you buy a hardware internet sharing device like a Linksys router. They are really cheap now, easy to set up, and you don’t need to leave your proxy server on all the time in order to have internet access on your client PCs. ---
**Author:** ![gouda](https://avatars.discourse-cdn.com/v4/letter/g/c77e96/32.png) [@gouda](https://boards.straightdope.com/u/gouda)\ **Post date:** [September 10, 2003, 3:00pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/24 "2003-09-10T15:00:59Z")
**Mort Fyrd** , I connect via the hub only. It’s the only direct connection to the net. **A. Coward** , nope, I’m not using ICS (anymore). I’m using WinGate, which won’t install until ICS is deactivated. I did think of getting a router, but they still cost almost twice as much as a switch here. Thanks! ---
**Author:** ![Phlosphr](https://avatars.discourse-cdn.com/v4/letter/p/c68b51/32.png) [@Phlosphr](https://boards.straightdope.com/u/Phlosphr)\ **Post date:** [September 10, 2003, 4:59pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/25 "2003-09-10T16:59:54Z")
> [@](#): > > \*Originally posted by Q.E.D. \* > \*\*No, I honestly don’t think they could. But nor would they really need to. If they wanted the data on your computer, they’d simply come and confiscate it. \*\* I may not be a computer Guru, but I would assume that with a budget like the one the Federal Government has, I’d think they could get into your machine even with Zone Alarm. If not in the front door certainly in the back door. Maybe trickling down a registered users list or find out where you go often enough and do it that way…no? ---
**Author:** ![asterion](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@asterion](https://boards.straightdope.com/u/asterion)\ **Post date:** [September 10, 2003, 5:03pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/26 "2003-09-10T17:03:17Z")
If I may hijack a bit, I’ve got a couple questions: 1. I’ve never been able to get ZoneAlaram to work properly with my school network. I can use ZoneAlarm and surf the net or I can connect to the school network and surf the net but not both. Any idea how I can get the firewall on full time and still get the connection to the network? 2. If I were to buy or build a hardware firewall, how would I do it and use it? ---
**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\ **Post date:** [September 10, 2003, 5:11pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/27 "2003-09-10T17:11:31Z")
> [@](#): > > \*Originally posted by asterion \* > \*\*2. If I were to buy or build a hardware firewall, how would I do it and use it? \*\* NAT hardware firewalls are built in to most network routers these days. Chances are your school alread runs one through which you are connected to the internet. As for your first question, I’d ask your schools IT people, as they’d have more knowledge about their own network. ---
**Author:** ![Shrinking\_Violet](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Shrinking\_Violet](https://boards.straightdope.com/u/Shrinking_Violet)\ **Post date:** [September 10, 2003, 5:14pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/28 "2003-09-10T17:14:13Z")
> [@](#): > > \*Originally posted by rsa \* > \*\*ZoneAlarm will make your computer appear like it doesn’t exist. > > You can test your invisablity here: [GRC | ShieldsUP! — Internet Vulnerability Profiling  ](https://grc.com/x/ne.dll?bh0bkyd2) > \*\* I have had ZoneAlarm installed and running for years, so I clicked on the above link to test it. But I’m puzzled … If I click on the “file-sharing” option the result I get is _“All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet.”_ However, if I click on “All Service Ports” it shows three ports open (the rest are closed) … none of which are Port 113 as mentioned on the page re ZoneAlarm. What’s going on here? 😕 (Please use words of one syllable … 😃 ) Julie ---
**Author:** ![Anonymous\_Coward](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@Anonymous\_Coward](https://boards.straightdope.com/u/Anonymous_Coward)\ **Post date:** [September 10, 2003, 5:29pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/29 "2003-09-10T17:29:33Z")
You probably have configured Zonealarm to allow certain programs to act as a server, which opens up those ports to the internet. If you let us know what ports are open, we may be able to tell you what program is using it. ---
**Author:** ![Anonymous\_Coward](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@Anonymous\_Coward](https://boards.straightdope.com/u/Anonymous_Coward)\ **Post date:** [September 10, 2003, 5:32pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/30 "2003-09-10T17:32:55Z")
> [@](#): > > \*Originally posted by gouda \* > \*\ ***Mort Fyrd** , I connect via the hub only. It’s the only direct connection to the net. > > **A. Coward** , nope, I’m not using ICS (anymore). I’m using WinGate, which won’t install until ICS is deactivated. I did think of getting a router, but they still cost almost twice as much as a switch here. > > Thanks! \*\* If I recall correctly, Wingate has it’s own firewall capabilities. You should not need Zonealarm at all… ---
**Author:** ![Black\_Train\_Song](https://avatars.discourse-cdn.com/v4/letter/b/4da419/32.png) [@Black\_Train\_Song](https://boards.straightdope.com/u/Black_Train_Song)\ **Post date:** [September 10, 2003, 5:51pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/31 "2003-09-10T17:51:11Z")
Next time ZA stops an intrusion click “more info” and I think it takes you to a website describing the exact nature of that intrusion and what the likely source is. ---
**Author:** ![rowrrbazzle](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rowrrbazzle/32/414_2.png) [@rowrrbazzle](https://boards.straightdope.com/u/rowrrbazzle)\ **Post date:** [September 10, 2003, 6:35pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/32 "2003-09-10T18:35:14Z")
After a very high number of hits on August 13 due to the worm, things quieted down for about a week. I then began getting a lot of hits to my port 0 (possibly a ping request), almost all with IP addresses on my ISP (comcast/attbi - I guess the source IP could be spoofed). For example, I had my computer on all day on Saturday, September 7, from 10:30 AM to midnight. ZoneAlarm recorded 204 hits. 182 of those were the ping requests, leaving 18 as other access attempts. So I was averaging 1 ping request about every 5 minutes. I’ve never had this volume on a regular basis before. I now turn the pop-up notice off because it was getting intrusive. Is this some kind of half-baked denial of service attack? ---
**Author:** ![Mort\_Furd](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Mort\_Furd](https://boards.straightdope.com/u/Mort_Furd)\ **Post date:** [September 10, 2003, 10:31pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/33 "2003-09-10T22:31:38Z")
> [@](#): > > \*Originally posted by rowrrbazzle \* > After a very high number of hits on August 13 due to the worm, things quieted down for about a week. I then began getting a lot of hits to my port 0 (possibly a ping request), almost all with IP addresses on my ISP (comcast/attbi - I guess the source IP could be spoofed). A ping request comes in on port 8. Check the protocol for those hits. If it is ICMP, then what you’ve got is a ping RESPONSE coming in. If that is the case, then one of two things is going on: Either someone is trying to probe your system using a spoofed answer for a request you never made or else you’ve got a run-away ping program on your PC pinging the hell out of your ISP. I vote for the attack. Someone may also be trying to use you as part of a distributed denial of service attack. They send out ping requests to a gazillion IP addresses with the source address spoofed. The PCs who receive the request all send back reject messages - overloading the server at the spoofed address. The goal may also be to overwhelm the victim’s routers. They do this by specifying a multicast source (basically a block of IP addresses.) When your machine rejects the packet, the routers along the back path broadcast your reject to ALL of the addresses in the block. Overload city. All in all a great whacking mess, and another good reason to have a firewall. You are set to drop packets rather than rejecting them, right? ---
**Author:** ![Mort\_Furd](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Mort\_Furd](https://boards.straightdope.com/u/Mort_Furd)\ **Post date:** [September 10, 2003, 10:44pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/34 "2003-09-10T22:44:39Z")
BTW: Zone Alarm seems to do pretty well in the robustness department - these guys don’t show any advisories: [http://www.securityfocus.com/](http://www.securityfocus.com/) ---
**Author:** ![Shrinking\_Violet](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Shrinking\_Violet](https://boards.straightdope.com/u/Shrinking_Violet)\ **Post date:** [September 11, 2003, 1:30pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/35 "2003-09-11T13:30:09Z")
> [@](#): > > \*Originally posted by Anonymous Coward \* > \*\*You probably have configured Zonealarm to allow certain programs to act as a server, which opens up those ports to the internet. > > If you let us know what ports are open, we may be able to tell you what program is using it. \*\* Hi **Anonymous Coward** … the open ports are 22, 80 & 554. Thanks in advance for any light you can shed. 🙂 Julie ---
**Author:** ![Anonymous\_Coward](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@Anonymous\_Coward](https://boards.straightdope.com/u/Anonymous_Coward)\ **Post date:** [September 11, 2003, 1:57pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/36 "2003-09-11T13:57:38Z")
Well, we’ll see what we can do. I’ll list the most common uses for these ports. Port 22 is commonly used for SSH, for secure telneting. Are you runnning a telnet server? Port 80 is usually a web server, however it could be SSH again. Not likely but possible. Port 554 is usually used for RTSP (Real Time Streaming Protocol). This is usually open for Realplayer or Quicktime. If you have no idea what is going on with these and want to close the ports, try going though your Zonealarm program permissions and check which programs are checked to allow server access to the internet. You can then disable them one at at time and run the ShieldsUp scan and see if that plugs the hole. ---
**Author:** ![LordVor](https://avatars.discourse-cdn.com/v4/letter/l/90ced4/32.png) [@LordVor](https://boards.straightdope.com/u/LordVor)\ **Post date:** [September 11, 2003, 2:24pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/37 "2003-09-11T14:24:05Z")
> [@](#): > > \*Originally posted by Phlosphr \* > \*\*I may not be a computer Guru, but I would assume that with a budget like the one the Federal Government has, I’d think they could get into your machine even with Zone Alarm. If not in the front door certainly in the back door. Maybe trickling down a registered users list or find out where you go often enough and do it that way…no? \*\* But the thing is, if ZoneAlarm (or any popular security tool) had a “back door”, it would be useless. The ZoneAlarm developers would have to know of it, and the government agencies who would take advantage of it would have to know of it, and that’s enough people that it means that the hackers of the world would know of it through leaks if they didn’t discover it themselves. The Government isn’t going to deal with breaking into your computer remotely if they decide that they need to know what’s on it, they’re going to use the Patriot Act to get a secret search warrent, break into your house while you’re not home, make a copy of your hard drive, and then leave and never tell you they were there. -lv ---
**Author:** ![Shrinking\_Violet](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Shrinking\_Violet](https://boards.straightdope.com/u/Shrinking_Violet)\ **Post date:** [September 11, 2003, 3:03pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/38 "2003-09-11T15:03:34Z")
> [@](#): > > \*Originally posted by Anonymous Coward \* > \*\*Well, we’ll see what we can do. I’ll list the most common uses for these ports. > > Port 22 is commonly used for SSH, for secure telneting. Are you runnning a telnet server? > > Port 80 is usually a web server, however it could be SSH again. Not likely but possible. > > Port 554 is usually used for RTSP (Real Time Streaming Protocol). This is usually open for Realplayer or Quicktime. > > If you have no idea what is going on with these and want to close the ports, try going though your Zonealarm program permissions and check which programs are checked to allow server access to the internet. You can then disable them one at at time and run the ShieldsUp scan and see if that plugs the hole. \*\* Hi **Anonymous Coward** and thanks for the fast reply. Re port 554 - I don’t have Realplayer installed. I have just uninstalled Quicktime (never got it to work right, anyway :dubious: ), but that port is still showing up as “open”. Re ports 22 & 80 - I don’t know what a “telnet server” is 😕 but the only program I have allowed access to the Internet, apart from IE and AVG, is CyberSitter, which is only enabled when my daughter is online. I think this could be it? In which case, no problemo. 🙂 Thanks for your help. Julie ---
**Author:** ![Sarcastro](https://avatars.discourse-cdn.com/v4/letter/s/e495f1/32.png) [@Sarcastro](https://boards.straightdope.com/u/Sarcastro)\ **Post date:** [September 11, 2003, 3:25pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/39 "2003-09-11T15:25:45Z")
> [@](#): > > \*Originally posted by gouda \* > \*\*I did think of getting a router, but they still cost almost twice as much as a switch here. > \*\* As one who recently purchased a router, let me recommend you get one if you can free up the money (I got a LinkSys one for $70 - I’m sure it could be had cheaper online or during a sale - or if you got the model that doesn’t also have Wi-fi\*). The setup could not be easier, and it adds an extra layer of protection, which can’t hurt. \*_I bought the 802.11b model, so I can check my email from the toilet if I want to with my laptop, which I now believe to be the true, modern American dream. Only have once, just to test the signal, but it’s nice to know that I **can**._ ---
**Author:** ![Mort\_Furd](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Mort\_Furd](https://boards.straightdope.com/u/Mort_Furd)\ **Post date:** [September 11, 2003, 3:32pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/40 "2003-09-11T15:32:26Z")
Shrinking Violet: Cork those holes. You are not running a web server, so none of the ports that are open are neccessary. You only need to open holes for outbound stuff. The inbound stuff allows your PC to respond to requests from outside - and you don’t want to do that unless you are intentionally running a server. [Previous page](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649.md?page=1) [Next page](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649.md?page=3)