Slashdot Mirror

← Back to Stories (view on slashdot.org)

Zone Alarm Vs 180 Solutions: Zango hooks?

Posted by Hemos on from the deconstructing-postmodern-spyware dept.

Sub-Seven writes "Found at Vitalsecurity.org, they detail how a Microsoft MVP pulled the Zango file to pieces, and discovered some interesting facts about exactly what a "simple" fun and games application does to a machine that its running on. Hooking into Windows OneCare and Microsoft Antispyware? What's that all about? "

7 of 166 comments (clear)

  1. Software firewalls?! by FatSean · · Score: 4, Interesting

    Um...not sure what's going on here...but I think software firewalls have to be one of the silliest 'security products' out there. I still can't believe cable companies don't distribute modem/routers to users and remotely configure them to block the commonly exploited ports and protocols.

    My conspiracy theory is that they have big investments in the software firewall companies...and in existing non-router cablemodems.

    SO we suffer.

    --
    Blar.
  2. This is worse than Spyware by HexaByte · · Score: 5, Interesting
    From the article:

    180Solutions was complaining that "ZoneAlarm was advising that our 180search Assistant "is trying to monitor your mouse movements and keyboard strokes" well let's see after reading the above ... that description looks right to me.

    This is worse than spyware. This could be used to transmit your account codes and PINs, passwords, etc.

    Sounds like stealware(TM) to me!

    --
    HexaByte - he's a square and a half!
  3. Re:What's the hook being used for? by Ytsejam-03 · · Score: 3, Interesting
    The question is, does Zango use that hook to collect mouse and key info, even for a short time, or are they using the hook for other purposes? What would those purposes be?
    Yes, my thoughts exactly. The longer 180 fails to disclose this information, the more it looks like they are doing something nasty.

    That said, I see no evidence that Zango is specifically targeting Windows OneCare or Microsoft Antispyware as TFA implies. The fact that zangohook.dll is being loaded into these processes is *NOT* evidence of this. Zango is setting a system-wide hook, which means that their hook DLL (zangohook.dll) will be automatically loaded into every process in the system that generates one of the events they are trying to hook.

    There are legitimate uses for system-wide hooks. Many Single Sign-On products use them, for instance. The real question is, why exactly does Zango need to set a system-wide hook in the first place? I can't think of any legitimate reasons.
  4. Re:Oh my - A Microsoft MVP! by value_added · · Score: 5, Interesting

    For anyone who doesn't know, you become a Microsoft MPV largely by being an unemployed loser - the more time you can waste away providing pro-Microsoft answers on Microsoft's message boards ...

    The MCSE jokes on /. are admittedly funny at times, but this is as unfunny as it is unfair. First, only web weenies would refer to news groups as message boards. Second, those groups are an invaluable resource, being freely available, active, and representing a wide cross section of experience, they're one fo the few places where you can find honest and up-to-date information. And third, while Microsoft does offer a pseudo subscription-based pricing for "guaranteed responses" (from the MVPs, among others), most posts are the result of volunteer efforts.

    Perhaps the next time you send a question off to debian-users, for example, hoping for an answer from one of the "regulars", you avoid suggesting that any of them must be an unemployed loser for bothering to respond. Unless playing the part of a troll is somehow more rewarding.

    If it sounds like I'm pissed off, yeah, I am. Having to defend something Microsoft related on /. is annoying enough without being forced to justify the efforts of those trying to help others, irrespective of the venue or their individual capacity.

    As for anyone else using Windows and is unfamiliar with usenet, I'd suggest exploring the ms.public hierarchy with whatever news client you have available, and get into the habit of reading a few of them before applying the latest patch or service pack, or are otherwise trying to resolve an issue or trying to learn something. The top posting is murder, but the information is free and unlikely to be available to the same extent anywhere else.

  5. Re:What's the hook being used for? by arkanes · · Score: 3, Interesting

    There are a number of things you might install a CBT hook for, even legitimate ones, but with the hook installed it absolutely is "monitoring" all keypresses and mouse moves. This is going to hinge on the definition of monitoring - Windows is calling a hook within the Zango code and notifying it of all the events it registered the hook for (which looks like system wide mouse and key events), however, Zango is quite likely ignoring everything except very specific events. Personally, I'd still call that monitoring.

  6. Give players the choice by giafly · · Score: 3, Interesting
    1. Provide one set of servers where players can compete if they submit to anti-cheat scanning.
    2. And different server(s) for the libertarians, script kiddies and cheaters.
    --
    Reduce, reuse, cycle
  7. Some extra info at gripe2ed.com by Rob+the+Bold · · Score: 3, Interesting

    Ed Foster's Gripe Log is following the Zone Alarm v. 180 story, and he has a much more readable summary at his site: http://www.gripe2ed.com/scoop/story/2005/12/5/8255 5/7508

    --
    I am not a crackpot.