Internet Security Zone Blog

How to Travel Safely with Your Laptop this Thanksgiving

ZoneAlarm — Thu, 05 Nov 2009 08:38:12 -0800

By Doctor Security

Travel and Thanksgiving go together like turkey and stuffing. So if you’re like millions of others and going to be on the road or in the air this holiday season, we suggest you take some precautions to prevent the loss or theft of your laptop.

Just so you know why you need to be diligent, here’s the skinny on laptop theft:

1 in 10 are lost or stolen and 97% are never recovered. A recent study found that 12,000 laptops go missing in U.S. airports every week!

Now, you can bet that during the Thanksgiving week when there’s a ton more people hopping on flights, there’s going to be a lot more criminal activity among the crowds, especially in these challenging economic times.

Here are some tips to consider to help you protect yourself against laptop loss/theft as well as what to do if you become the victim:

1) Don’t use a traditional laptop bag that tells a thief exactly where it is (a quality backpack is a good alternative)

2) If you don’t have to access your laptop in a large public place, don’t

3) Don’t pack your laptop with your baggage because you can’t trust that your baggage won’t be tampered with or always arrive at the same time and place you do

4) Stow your computer at your feet, not in an overhead bin where it can easily be taken (often by mistake)

Most of these tips are common sense, but during the rush and stress associated with holiday travel, you might not be on top of your game, especially if traveling with children. So try to be diligent and stay calm. The harried travelers might as well paint targets on their backs.

You should also be smart about what you need to do and have if your mobile computer is lost, stolen or damaged:

1) Back up, back up, back up your important files!! (Leave a back up copy of your important files at home or the office and carry a disk or a thumb drive with you, if you’re going to need to access files while you’re away)

2) Have strong password (8 characters at least and a combo of letter, numbers and special characters like #%*)

3) Encryption software like ZoneAlarm’s Hard Drive Encryption that “makes everything on your computer’s hard drive unreadable to unauthorized eyes”

4) Have your laptop make, model number and serial number so you can identify your property if it’s recovered or turned into lost and found

5) Stickers or unique identifiers on your laptop so you can quickly ascertain your own and make it harder for a thief to fence a stolen one

Happy holidays and safe traveling!

Windows 7 Security: What it Has, and What it Lacks

ZoneAlarm — Wed, 21 Oct 2009 16:09:06 -0700

By John Gable, Director of Consumer Product Management

Welcome Windows 7. We have been waiting and it is finally here!

From a security perspective, Windows 7 is very similar to Vista, though it does include some additional protection particularly when compared to XP such as User Access Control. Read our last blog for more technical details. But from a more basic point of view, here is what you need to know:

* Windows 7 is an operating system, not a security product.

Even Microsoft suggests you get additional security so don’t make the mistake of thinking that you are protected if you get the new operating system.

* Windows 7 does not provide full firewall protection.

It does include an inbound firewall, but that is all you get by default. It also has an outbound firewall, which you can turn on. However, both lack some protections that all strong firewalls include. The Windows 7 firewall does not pass a long list of leak tests (tests designed to mimic actual firewall attacks and therefore leaves you vulnerable).

* Windows 7 does not include antivirus, and even if you add Microsoft’s free antivirus, you only have partial protection.

Separately, Microsoft offers “Security Essentials”. This, like other standalone antivirus products, free or otherwise, detects and removes known viruses. That is good and an essential part of security that everyone should have. However, even the very best antivirus products are less than 70% effective against brand new viruses. That means that you need additional layers of security if you want to be virus-free.

* Windows 7 leaves holes in your browser.

The web browser in Windows 7, Internet Explorer, only blocks known dangerous web sites. That is also true with other browsers like Firefox. They do not block new dangerous web sites that have not yet been identified as dangerous, leaving you vulnerable to new phishing scams that trick you into revealing confidential and financial data.

Windows 7 also does not block downloading files that you think are safe but are in fact dangerous. Nor does it block invisible “drive-by” downloads that happen automatically in the background by taking advantage of known exploits in your browser and plug-ins.

* Windows 7 does not offer identity or data protection.

With almost 10 million identity theft victims last year, identity theft may be the fastest growing crime in the world. Don’t worry, there are many things you can do to protect your identity and your data. For example: antivirus, anti-spyware and anti-phishing solutions offer some protection against this. Furthermore, hard drive encryption (Windows 7 Ultimate includes this for enterprises but does not have a consumer version) is particularly valuable to “mobile” laptop users who take their laptop with them everywhere they go.

Everyone, whether using a laptop, PC, or no computer at all, is vulnerable to offline identity attacks. You should also consider some offline protection like Credit Bureau Monitoring included for no extra charge in many ZoneAlarm products.

Welcome Windows 7. Be sure to enjoy it – just don’t spoil it by not getting the security you need.

Windows 7 Through Security Goggles

ZoneAlarm — Wed, 23 Sep 2009 14:08:06 -0700

By Dameon D. Welch-Abernathy, CISSP, Check Point employee, also known as PhoneBoy of the PhoneBoy.com Blog

Windows 7 is the first Windows release since Windows 95 I have been impressed with. I've been using it on my kids' computers since the public beta was released in January. It has been an exceptionally stable and fast operating system, moreso than Windows XP and Vista.

As bright and shiny as a new operating system is, one must also carefully consider the security implications of moving to a new operating system. In the early stages of the beta, there were few, if any, choices for antivirus, antimalware, and other security tools. Now, as Windows 7 nears commercial release on October 23rd, Check Point as well as other vendors have security solutions that are ready for the new operating system.

Meanwhile, Windows 7 itself brings some important security features and raises one important concern. They do not eliminate the need for security solutions such as ZoneAlarm Extreme Security 2010, but they are important additions none the less.

User Account Control (UAC)

The idea behind UAC is to run the account as a normal user but only elevate rights to administrator precisely when needed. When administrative rights are needed, a confirmation dialog appears asking you to confirm the action. If you are not an administrator user, you are prompted to enter the username and password of such a user.

This feature premiered in Windows Vista, but was considered annoying as it prompted each time a change that required administrative rights. This prompted people to disable this feature, reducing their overall security. In Windows 7, UAC is enabled, but fewer things require a prompt confirming your action. A four-color shield icon shows next to tasks in the Control Panel and buttons in dialogs where administrative rights are needed to complete the action.

UAC is an important security feature. If an unauthorized or unknown program runs and it attempts to modify the system in some way, the program would not be allowed to modify the system. If the program requests higher privileges, UAC will prompt you, asking for confirmation to run the program. The user can say no, thus thwarting any attempt. However, a malicious program that runs as a normal user can still potentially affect your personal data files, which does not require administrative rights to access.

Internet Explorer 8

Windows 7 ships with Internet Explorer 8, which incorporates some security features. It includes the Protected Mode from Internet Explorer 7 (which only operated in Windows Vista), ActiveX Opt-in (also from Internet Explorer 7, which blocks the automatic installation of ActiveX controls) and a private browsing mode.

Protected Mode is a sandbox for the browser itself. The rights of the browsing process in Protected Mode are even more limited than a normal user, allowing the browser to write only in the Temporary Internet Files directory. It cannot install start-up programs or make any configuration changes without going through a broker process.

IE8 also includes a private browsing mode similar to what is included in Safari, Firefox 3.5, and Google Chrome. Specifically, it prevents ones browser history, temporary Internet files, form data, cookies, and login information from being retained by the browser.

ZoneAlarm ForceField provides more comprehensive protection for both Internet Explorer and Firefox. The entire browser session is sandboxed and can simply be discarded when the web browser closes, providing protection from unauthorized software installations and complete privacy by erasing your cache, cookies, history, and passwords.

Bitlocker

A feature present in the Enterprise and Ultimate edition of Windows 7 is Bitlocker. This encrypts all the data on your hard drive so that if the computer is stolen, the data on the hard drive is protected from prying eyes. While this is primarily aimed at corporate customers, home users will typically not have access to this feature unless they purchase an Enterprise or Ultimate edition of Windows.

ZoneAlarm Extreme Security 2010 makes this feature available to everyone, regardless of the version of Windows you bought, and regardless of whether you are using Windows 7 or are sticking with Windows XP or Vista.

64-Bit Windows

Microsoft decided to make some changes to how Windows works to increase security. Because these changes break programs and drivers that previously worked, Microsoft decided to implement these features only in the 64-bit versions of Windows to give software vendors the opportunity to update their software to work with the new restrictions.

64-bit Windows has been around for a few years, but only recently began showing up in consumer PCs. The main reason: users were starting to bump into the 4 GB RAM limit of 32-bit architectures. 64-bit systems can address substantially more RAM, thus more vendors are shipping systems with 64-bit Windows installed by default.

In 64-bit Windows, all hardware and software drivers must be digitally signed by Microsoft. This makes it more difficult for an unknown or malicious driver to be installed in your system.

Data Execution Prevention is also enabled by default. This takes advantage of a feature present on 64-bit processors, which allows programs to mark data segments as "no execute." This makes it more difficult for buffer overflows to cause malicious code to run.

Finally, 64-bit Windows enables Patch Guard by default. In short, it prevents programs from dynamically patching the kernel in memory. This prevents rootkits and the like from installing themselves in the kernel.

The TCP/IP Stack

The TCP/IP stack in Windows XP evolved directly from the TCP/IP stack present in Windows NT 4.0. It has had more than two decades worth of abuse by the hackers of the world. That doesn't mean it isn't susceptible to security issues, but it's also had the benefit of two decades worth of security patches and other improvements. It is a very mature implementation of TCP/IP.

In Windows Vista, Microsoft rewrote the TCP/IP stack from scratch. Windows 7 uses this newer stack as well. This isn't to say the TCP/IP stack in Windows Vista or Windows 7 is less secure than the one in Windows XP, it is simply less mature. It quite simply hasn't had the benefit of two decades worth of hacker review and security patches.

Summary

Microsoft has made some great strides in making a secure, yet useful operating system. However, the hackers will continue to find ways to bypass whatever security measures the operating system puts in place. Operating systems, by their nature, do not evolve as quickly as threats do.

Fortunately, security software such as ZoneAlarm Extreme Security 2010 can react and evolve quickly to protect you from whatever the hackers of the Internet throw your way.

Keeping Laptops Safe

ZoneAlarm — Wed, 16 Sep 2009 00:32:00 -0700

By Robert McHugh, product manager

If you’ve ever had your wallet or purse stolen, your first thought probably isn’t about the lost cash or the value of the wallet itself. Your biggest concern is about what the thief will do with the information in your wallet – credit cards, ATM cards, etc. – and how you can stop them right away.

Similarly, if your laptop is stolen you could be concerned about the cost of the computer and what files haven’t been backed up recently. But what about your personal information on your hard drive? Do you have any bank records, account information, or passwords saved on your laptop? What’s in your email that you wouldn’t want the thief to access? How do you protect this?

There are some simple steps you can take to keep your laptop AND your data secure:

Be inconspicuous. Not long ago, laptop carrying bags were clearly used for one purpose – to carry a laptop - screaming to potential thieves that there’s a valuable computer inside. Now, more and more laptop owners are choosing inconspicuous backpacks and multi-purpose carrying cases to tote their computers more discreetly. As the New York Times recently reported, some users are taking this clandestine carrying theme even further with a bag disguised as a newspaper.

Keep it out of sight. Just as you wouldn’t leave your wallet or iPod sitting exposed in the backseat of your parked car, take the extra precaution to hide your laptop computer. Take it with you if you can, or lock it in your trunk.

Sticker it. If you own a popular model, add some labels or stickers to distinguish your computer. This will help avoid confusion at your local Starbuck’s or at airport security; plus it will be easy to see if someone is walking off with your machine.

Backup and Encrypt your data. This won’t prevent a theft, but it will protect you if that someone gets their hands on your laptop. If you haven’t gotten around to backing up your machine, stop reading right now and back it up!. Encrypting your data ensures that no one but you can access your personal confidential information. Windows password protection won’t stop a thief from getting at your data. Only full encryption of your hard drive will hide everything, including hidden files and deleted items that may contain valuable information.

Laptop thefts have been growing each year as more and more users are going mobile. According to a study by Safeware Insurance Agency, a laptop is stolen every 53 seconds, and only 3% of these are ever returned. Be informed and be prepared so you won’t be part of the statistics.

Quick Safety Tips for Staying Connected While On-the-go

ZoneAlarm — Fri, 07 Aug 2009 09:36:51 -0700

By Liam T, Security Advisor, SecureTec Australasia

We all know that a Wi-Fi hotspot is great for accessing the Internet in public places such as the airport or a coffee shop. But we should all be aware that Wi-Fi hotspots can also be a security concern since a hacker can exploit the wireless access and steal personal information or files from a computer by using a remote attack.

Here are a few simple rules to follow:

Use a good Firewall to protect yourself

A good firewall will protect your PC against inbound and outbound attacks while making your computer invisible. For example, ZoneAlarm Firewall protects you by watching all the traffic that exists or enters your computer and blocks any malicious attacks from the outside.

Disable file sharing in a public area

It is recommended to disable file sharing to protect your personal information while using a public Wi-Fi hotspot. If you are using a ZoneAlarm, you will get a “New Network Detected” window. Just click “Internet” (rather than “Trusted”) and that will automatically disable file sharing. Otherwise, …

If you are running Windows XP follow these steps to turn off file sharing:

Go to the start menu
Access the control panel and go to “Network Connections”
Right click on “Local Area Connection” and click “Properties”
Uncheck File and Printer sharing and click “Ok”

In Windows Vista file sharing is turned off by default when you select your network location type as Public. If you need to change your network location type:

Go to the control panel and access “Network and Sharing Center” on Classic View
Click on the “Customize” link
Set your location to the desired option

Use an encrypted public wireless network

You can check the provider's Web site in the privacy statement to see if they use network encryption and, if they do, what kind of network encryption it is. For the best protection of your personal information it is recommended that you don't send or receive sensitive information from the hotspot. If you do need to enter your personal information on a legit website make sure the website is SSL encrypted. You can tell if a website is SSL encrypted if you can see a padlock on the bottom right corner of the screen and the URL has https instead of http.

Disable your wireless network if you are not using it

If you are not doing any Internet related activities such as surfing the web or using your email it is recommended that you turn it off to reduce the amount of time that it is susceptible to attacks. You can turn off your wireless connection in the “Control Panel.”

Protecting Your Privacy: Web 2.0 Security

ZoneAlarm — Fri, 17 Jul 2009 13:04:25 -0700

By Liam T, Security Advisor, SecureTec Australasia

According to research from Secure Enterprise 2.0 Forum, there has been a significant increase in the number of Web 2.0 attacks over the first quarter of 2009. The report indicates that social networks, wikis, and community blogging services and sites are the most popular social media targets for hackers. As Web 2.0 and social media sites such as Facebook, Twitter and LinkedIn become increasingly popular for personal and professional use, hackers will continue to work harder and smarter to exploit their vulnerabilities.

Attackers focus on gaining unrestricted access to the data stored on the computer to use for financial or identity theft. Cyber criminals are also known to implant malicious code by exploiting well known security weaknesses in the software installed on user’s computers.

Though Web site owners have a responsibility to ensure their sites are secure, users should also adhere to secure practices. When online, consider the following:

- Assess the “value” (to you) of the information stored online:

o Ask yourself whether the information stored online on “all” your websites could be used for malicious purposes.

o As a general rule of thumb, it is never a good idea to put up any information online that you would not want the entire world or your worst enemy to see.

- Isolate different accounts from each other:

o Avoid cross linking your account details. For example: try and avoid publicly listing your email address or linking your MySpace page to your Facebook page. This practice will minimize the chance for the attacker to compromise several of your accounts by infecting one.

o Use different passwords. Way too often, hackers are able to use registration information from one account to compromise another.

- Secure your online logins:

o Use secure and unique “passphrases” for your logons and use unique passphrases for each and every website you log onto, all of which should be as long as possible and contain UPPER CASE, lower case, symbols and numbers (although the numbers 0, 1, 3, 5 are less secure as people use them as numb3r r3plac3m3nts a11 t00 0ft3n).

- Secure your computer against malware and exploits:

o Use a reputable security solution that includes browser protection such as Check Point’s ZoneAlarm Extreme Security (make sure that “Enable Virtualization” is turned on) or ZoneAlarm ForceField which works well alongside other security solutions.

o Ensure you have “all” the latest Microsoft Updates and that your Automatic Updates are turned on in Windows.

o Regularly check that “all” other programs installed on your computer are up to date and secure.

o Avoid installing un-trusted software and browser plug-ins on your computer. Before installing unknown software, it is best to look for reviews about the software at reputable websites such as CNET or PC World etc.

While we can’t always know how secure a “trusted” Web site is, by following a few simple steps social media site users can prevent their accounts from being compromised or used to infect others.

Unpatched Microsoft Video ActiveX Control Vulnerability

ZoneAlarm — Fri, 10 Jul 2009 15:59:40 -0700

By John Gable, Director of Consumer Product Management

There is a new Microsoft exploit that attacks silently in the background (aka, a new drive-by download). Microsoft has not yet deployed a patch and the instructions on how to implement this attack are available online for hackers. Thousands of sites have already been infected with the number increasing.

This vulnerability is within Microsoft DirectShow which runs within the browser via ActiveX. You are vulnerable if you are running Windows XP or Windows Server 2003 unless you have browser virtualization (available in ZoneAlarm Extreme Security. Good anti-virus solutions as standalone or within suites detect and remove the viruses that have so far been delivered through this exploit. Note that this exploit just points to a “hole” in your security – other viruses and malware could be delivered to your PC through this same hole which is why we and others recommend that you take steps to block this hole in the first place. It is not a good idea to rely purely on anti-virus to take care of this.

Of course, you can also just edit your registry. This might be a bit scary and could create problems if you make a mistake. Microsoft has do-it-yourself instructions as well as a “Fix it for me” program you can download to solve the problem.

Lots of news on this, including technical publications like TechWorld and InformationWeek as well as main stream outlets such as USA Today.

For Two Days Only: Follow ZoneAlarm or Check Point on Twitter for a Chance to Win a Copy of ZoneAlarm Extreme Security

ZoneAlarm — Tue, 07 Jul 2009 08:45:19 -0700

By Dameon Welch Abernathy

As the popularity of social media sites such as Twitter has increased, so has the number of hackers who prey on the unsuspecting public to launch various attacks designed to gain access to confidential information. You can find more details on how to protect yourself against these Web-based attacks by reading one of our recent blogs. When you follow Check Point or ZoneAlarm on Twitter, you’ll automatically have the chance to win a ZoneAlarm Extreme Security suite. ZoneAlarm Extreme Security combines computer security and browser security into one, using patent-pending technology for powerful protection.

Here are a few eligibility rules:

Follow ZoneAlarm or Check Point Software Technologies on Twitter by July 9, 2009 at 19:00 GMT. Two lucky winners will be randomly selected.

Employees of Check Point Software Technologies and their immediate families are not eligible to participate in this giveaway.

Only one winner per Twitter account will be awarded.

Winner must provide a shipping address where the prize can be mailed.

All decisions regarding a qualified winner will be made solely by ZoneAlarm and are final.

ZoneAlarm reserves the right to terminate or modify the above terms at any time without notice.

Good Luck!

Twitter Viruses, Scams and Attacks - How to Protect Yourself

ZoneAlarm — Fri, 12 Jun 2009 10:37:53 -0700

By Daniel Armao, Security Advisor (Guest blogger)

Last weekend, Twitter users were the target of a “Best Video” scam in which they were tricked into clicking a link and sent to a website designed to download malware using an Adobe Acrobat PDF exploit. The malware installed was the scareware software called System Security. System Security is a fake antivirus product that is designed to trick the user into buying it by using scare tactics such as fake scanning results.

A week before that, Twitter users were affected by a phishing attempt called “Twittercut.” If a Twitter user clicked on the link the user was then redirected to a phishing website that asked for their username and password.

The increased popularity of social networking sites such as Twitter and Facebook have unfortunately led to an increase in social engineering attacks. Most importantly, these attacks are used to gain financial information, obtain a large number of credentials and leverage e-mail services for spamming activities.

So, don’t be fooled. Let’s talk about the most common ways users are fooled on social networking sites.

- Links can lead you to malicious material such as hidden drive-by downloads that attempt to silently install software onto your computer without you doing anything or knowing about it.

- Links can also lead you to a phishing site designed by scammers to trick a user into revealing confidential information such as account passwords for banking or social networking sites.

- There are downloads that seem perfectly safe, such as a video, screensaver (screensavers are the most notorious) or some even offer to give you security protection, but they are actually malware.

- A link from a friend might not be safe either. Your friend’s computer could have been infected and now is part of a botnet being used to send malware and dangerous links.

- Tweeters often use URL shortening services such as tinyurl.com to obtain a shorter URL that fits within the 140 characters restriction. This means you don’t know what site your are really going to until you are there.

How to protect yourself:

- Do not click on suspicious links.

- Be smart about what links to trust or not:

· Confirm the link. Hover your mouse over the link to see at the bottom of your browser window where it really goes – the text might say “Wells Fargo Bank” but the link might go somewhere else entirely (for example, the link looks like Google, but it’s not).

· Make sure the URL is correct on the address bar of the browser. The safest thing to do if you are not sure is to type the correct website address manually. Be extra cautious if you receive the link via e-mail.

· Do not download or install any software, not even codecs for viewing videos, from an untrusted site.

- Last but not least, get protection for your computer and for your web browser. These are two different things.

· ZoneAlarm ForceField provides a protective layer around your browser, shielding you from drive-by downloads, browser exploits and phishing attempts.

· ZoneAlarm Extreme Security combines computer security and browser security into one.

- If you are infected with malware, change your passwords immediately and download and scan your computer with a top security suite. Always verify that the security you would like to download is legitimate by going to PC Magazine or other computer publications (if it is not well known or reviewed by a noted security publication, don’t get it.)

Enjoy the web, do what you want to do. Just be smart about it and get the protection you need or your fun might come to a quick halt.

ForceField and Gumblar Step Into the Ring…

ZoneAlarm — Fri, 05 Jun 2009 16:03:37 -0700

By Jordy Berson, group product manager, ZoneAlarm products

We just got the results in from our malware testing team. We don’t like to claim victory early, even when we are fairly certain of a win. But now we know (Technical details are in the last paragraph for the “just the facts” folks).

“Are you ready to ruuumble??”

To be sure, it wasn’t the best fight. ForceField won. Easily. There wasn’t even any contact. It made for a snoozer of a fight. But a snoozer is exactly what you want when your identity and security are at risk.

Here’s how it went down:

The victim user went to one of many possible sites. So far, more than 3,000 Web sites have been attacked including a popular entertainment site and sports site. The second the victim arrived on the infected site, Gumblar was waiting. And not for a fair fight.

When you cannot even see the enemy, what chance do you have?

Far from facing its victims, Gumblar sneaks right past you, through a vulnerability in your computer software. Normally, the fight would end here. Gumblar would find a quiet place on your computer and take over. He could then do any number of things as these types of threats do. He could spy on you, watch what sites you go to, record everything you type, open doors to let some of his friends onto your computer, and use *your* computer to attack other computers!

But not this time

The enemy Gumblar faced was ForceField. Not brawny, but definitely wise and clever, ForceField saw right through that invisible cloak and instantly knew Gumblar was an uninvited guest. So when Gumblar snuck onto the victim computer, ForceField did a classic sneak attack of its own. Gumblar ended up on the victim computer, sure enough, but landed straight in jail. Here, Gumblar was completely isolated from the rest of the computer and was unable to do anything at all. This maneuvering on ForceField’s part was done automatically – you as a user had to do nothing to protect yourself.

So were you a victim or not?

· First of all, it is more likely you did NOT hit a Gumblar-infected site than you did**. So take a breath and read on.

· People using ZoneAlarm ForceField as a trial or who own ZoneAlarm ForceField are protected. Right on!

· People using ZoneAlarm Extreme Security get the protection of ForceField as well. But in ZoneAlarm Extreme, you have to activate the virtualization protection as it’s off by default. Go to the Browser Security panel of ZoneAlarm Extreme, click the Settings button, and make sure there’s a checkbox next to “Enable Virtualization.”

· If you are running ZoneAlarm anti-virus: ZoneAlarm anti-virus signatures have been updated to offer an additional layer of automatic protection against Gumblar.

· If you weren’t running ForceField virtualization, see my previous blog “Gumblar – Not a new Parker Brothers game” for details on how to know if you’ve been infected.

**The likelihood of falling victim to a single attack is low. But because there are so many attacks out there, the likelihood you’ll hit one eventually is much greater. So protect yourself! Even if you don’t run ForceField, at least make sure all the software on your computer is always up-to-date!

Gumblar versus ForceField: Just the facts

· We were able to locate an actual Gumblar attack and test ForceField against it. ForceField successfully defended the computer against Gumblar.

· ForceField used virtualization to redirect the automatic, hidden drive-by download so it could not run on the victim computer. It also used heuristics to label the host site as suspicious and warn the user not to download anything from the site or enter personal information into the site (this was done in case Gumblar had a social engineering component to its attack in addition to the drive-by download attack, which in this case it did not).

· Based on this successful test, it is very likely ForceField protects from other variants of Gumblar (though it is the nature of this quickly-evolving business that nobody can ever be 100% certain).

· ZoneAlarm anti-virus signatures have also been updated to offer an additional layer of automatic protection against Gumblar.

· As always, users should ensure they have the latest version of their browser, operating system, Adobe software, and all other software including security software.

Test conditions we used:

1. IE v. 7.0.5730.11

2. Adobe Reader v. 9.0.0

3. ForceField v. 1.3.153.0

Gumblar - Not a New Parker Brothers Game

ZoneAlarm — Tue, 02 Jun 2009 09:00:01 -0700

By Jordy Berson, group product manager, ZoneAlarm products

Gumblar!!

Is it an outrageously fun new board game that combines Jenga and Cranium to test your right brain, left brain and "Parkinson's-proneness" all at once? No. But this fun-sounding little guy could test your computer security, your identity theft protection and your ability to reformat your computer. And it could definitely bring outrage!

Gumblar is another multi-faceted, everywhere-you-want-to-be online, ninja-quiet Web site attack that can wreak havoc on your life. It begins in what seems to be one or a combination of Russian, Latvian and Chinese kitchens where it is then embedded into vulnerable Web sites. Which Web sites? So far, ones you've probably never heard of. But if we know anything about such attacks, we know any Web site can fall victim. Google, Yahoo, and the Miami Dolphins are just a sampling of sites that have been compromised by other attacks. (So yes, it can happen to you.)

So...what's the big deal?

Well, news says (CNET by Elinor Mills, CBR by Kevin White, plenty more) Gumblar sneaks onto your PC when you visit a Web site, injects itself into your browser and intercepts traffic between you and the Web sites you visit. That means anything you type is seen (unless it's encrypted, which most reputable bank and shop sites are). But it can also redirect you to malicious Web sites that look like real Web sites, which can download more malicious code to your PC. The net net? Play with Gumblar and you can lose your identity, unwittingly attack other computers, definitely lose money and maybe lose your mind! (“Mom, Gumblar won't stop hitting me!”)

Seemingly contrary to its spunky, extroverted name,

Gumblar won't announce itself when it hits your computer. So you've got to go digging. The CNET friends give this advice (as reported by Elinor Mills):

To find out if a computer is infected:

1) Locate sqlsodbc.chm in the Windows system folder (by default under Windows XP, the location is C:\Windows\System32\);

2) Obtain the Sha1 of the installed sqlsodbc.chm. FileAlyzer is a free tool that can be used to obtain the SHA1 of a file;

3) Compare the obtained Sha1 to the list located on the ScanSafe STAT Blog;

4) If the SHA1 and corresponding file size do not match with a pair on the reference list, it could be an indication of a Gumblar infection.

You can also just, you know, "do a full reformat and reinstallation" of your operation system

That would definitely test your right brain in a way that Cranium can't. If all this sounds like less fun than a long game of Monopoly, may I and my Check Point ZoneAlarm friends (and your grandmother) use an old adage? "An ounce of prevention is worth hundreds of megabytes of cure." In this case, that ounce ranges from 6 MB to about 70 MB depending on the Check Point product (ZoneAlarm ForceField and ZoneAlarm Extreme Security, respectively) but is smaller than the ounces you get from most other security companies. And in the context of, "not all protection is created equally," this happens to be an area where ZoneAlarm shines. Because we've got ForceField, baby!

If Gumblar, Conficker, Hungry Hippo or the red-nosed "Operation" guy try to sneak onto your computer, ForceField browser security - with less than a proverbial lift of a finger - is designed to redirect those jokers straight to a sandbox. But in this sandbox, nobody is allowed to play. Sorry, Gumblar! Meanwhile, we'll be gathering more data and will update you on the protection ForceField provides against Gumblar and its variants.

Tinyurl.com Blocked, Might Distribute Spyware

ZoneAlarm — Thu, 21 May 2009 11:15:40 -0700

By John Gable, Director of Consumer Products

ZoneAlarm blocks a web site that you want to visit. For example, some users have noted that ZoneAlarm blocks them when they go to TinyURL.com. Why would ZoneAlarm do this, and what do I do if that happens?

Spyware has occasionally been downloaded from TinyURL.com or a partner site (TinyURL often redirects users to other sites). To protect you from this threat, ZoneAlarm warns you about it and blocks that specific Web site. But people might still want to use TinyURL.com anyway – after all it’s a useful tool for posting short urls on Twitter. Well, you still can.

Go to www.tinyURL.com. If the site is blocked, you should see a balloon pop up in the lower right corner of your screen. If you click on it, you will go to an interface where you can add tinyURL.com as an exception which allows you to access the site. You can also manually get to that interface within the product by doing the following:

1) Right click or double click the ZoneAlarm icon in your system tray.

2) In the ZoneAlarm control screen, click Anti-virus/spyware, and then click “Spy Site Blocking”. If it has blocked you from a website, it will show you the name of the web site with an X showing that it was blocked.

3) If you want to go to that web site, click on top of the web site access and change it from Block to Allow.

That’s it. This way ZoneAlarm can protect you from potentially dangerous downloads but still let you go where you want.