Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

WARNING! - Firewalls are useless

Dec 8, 2005 7:29PM PST

I recently installed RealPlayer, and took note of the fact that their EULA mentions:

6. FIREWALL CONFIGURATION. The Software configures certain firewall applications such that the user is not alerted when the Software requests or receives data necessary for playback of content over the UDP protocol.

After installation, I checked, and sure enough, ZoneAlarm listed several Real components, with Internet access enabled!

If Real can do it, then so can a virus or any other malware, rendering ZoneAlarm totally useless.

It would appear that this weakness is not limited to ZoneAlarm, but is one that's inherent in all firewalls. Here's what Marc Maiffret, Chief Hacking Officer at eEye Digital Security, had to say when I informed him of my findings (I'm quoting him with his permission):

There is no personal firewall out there that will stop local code from being able to communicate out to the network if it wants to. ZoneAlarm is easy to bypass to communicate out to the world.

The problem is that most other people still believe in things like ZoneAlarm... I can't understand why.

(End of quote)

And there's no easy solution. You can check ZoneAlarm's programs listing to see which ones have permission to access the Internet, but it's highly unlikely that you'll recognize all the program names listed there - even the legitimate ones. And even if you check on a regular basis, if you find a rogue program there with Internet access, the damage may already have been done. It may have already sent out your passwords, credit card numbers, etc.

It's important to spread the word. People need to know that their systems aren't as secure as they think they are. And with enough publicity and pressure, maybe the companies writing firewall software will address the problem.

Discussion is locked

- Collapse -
The solution is actually quite easy...
Dec 16, 2005 1:33PM PST

Just don't use programs with creepy EULAs.

- Collapse -
Needs just a little more...
Dec 18, 2005 9:05PM PST

I think that solution circumvents the problem that the original poster was referring to. The problem is that if Real can make changes to his firewall while notifying him, a virus or spyware can do it without notifying him. To this I must say the only good solution is not to run as the administrator all the time like most people do, then be careful about what you install when you are running as the administrator. I know there are people who say this is not necessary but i cannot agree unless the computer is not connected to the internet.

- Collapse -
RealPlayer?
Dec 16, 2005 9:04PM PST

Well your first and main problem is, you're using RealPlayer! Get rid of that and you'll get rid of some problems.

- Collapse -
Firewalls?
Dec 16, 2005 10:14PM PST

I don't believe they are worthless, my Zone Alarm seems let me know anything updating etc. I did remove Real Player from my computor sometime back as it was a problem. Any software can be a problem sometime.

- Collapse -
Sometimes ya need it...
Dec 18, 2005 2:36AM PST

Some sites ya go to, you need to have RealPlayer installed in order to view the audio-visuals.

The steps Griff mentioned up above will help minimize any problem one would have. Just make sure your player's settings are properly UN-checked.

- Collapse -
Who wants a firewall to block everything?
Dec 18, 2005 9:52PM PST

When you use internet explorer is it blocked, no. Is the information scanned, yes it is.
When you use real player is it blocked, no. Is the information sent by real player any different to the information sent by internet explorer, no not really. And is the information still scanned, yes.
So you would trust one program, yet not another despite the fact they are both doing the same thing.

These programs are allowed through for two reasons. The firewall tends to allow programs you personally installed through as long as they are not on a blacklist of harmfull programs or as long as no malicious code is detected. If this gives you a virus its your own fault for installing the program in the first place.
Secondly the firewall asks you for permission for a perticular program. If it doesnt ask you, it doesnt grant full access, just access to internet content. Also its still scanned. Anyway if it doesnt ask you consider swapping to a different firewall, or changing the settings so it does ask you.

- Collapse -
Firewall
Dec 19, 2005 3:24PM PST

Real Player is a piece of s##it and always will be
if it operates the same in the future.

- Collapse -
True, but.....
Dec 21, 2005 12:56AM PST

All this may well be true, but still only a fool would go online (especailly with hi-speed) and not have any kind of firewall.
How do I cope? I few tricks and programs sure help.
1) After installing all software going into my software Norton's firewall and removing ANY entry for that program (I found I can block most the next time I start it up and see if the program works... most still do even with blocked access firewall rules)
2) That's why having a good AV pgm is needed now a days. Keep it up to date and running.
2) Use at least 2 good adware/spyware removers on hand
Personally I use 3 WinkDon't turn you nose up at some of the good freeware ones.
3) Run at least monthly checks for viruses and spyware
I try to at least every other week.
4) And probably the most important....SS ("Surf Smart")
Don't click on those pop-ups saying the world is going to end if you don't ;-D

- Collapse -
Real Player
Dec 21, 2005 4:27PM PST

I can't believe i read this whole thing.
There are likely thousands of others out there who have also read all your posts an learned a lot.
I don't use Real Player however at some time i may, who knows?
I did copy the post by Grif to file for reference should i deside later to go that route.
You fellows dont realize how many of us read an learn from your posts here. I for one appreciate you and your vast pooled knowledge. I also appreciate the military fellow because without him an his fellow solders we all would not be enjoying these computers.
I did my bit there, nothing big just bobbed around in the Gulf of Tonkin on Yankee station a few tours.
As with freedom the internet is not free. We all pay in time served trying to keep these things working as they should. Your posts help us dummies out here an again we all appreciate it. One question. It has been mentioned about Zone Alarm an Stop all internet activity as opposed to engage internet lock. Just what is the difference? I been using Engage internet lock when i am away from my computer. Should i be using Stop all internet activity?
Now there is a dumb question i suppose but as noted above, i am a dummy on these things. With the help from forums like this one i have not had to call the plumber YET.
Thanks, itseasy

- Collapse -
One other thought
Dec 21, 2005 11:08PM PST

I know there are people who disagree with me on this one, but I think it is more important than any other single security measure and I cannot repeat it enough.

In windows, by default, every user has administrator rights. Change this default. You should have one single user with administrator rights and you should be logged in as that administrator only to do administrative things (install programs, configure your system...).

You should have another user (or other users) for every day use (surfing the internet, playing games, office work...).

That way, even if you download a nasty of some kind as the regular user (say, in an office macro) its ability to do damage will be significantly reduced.

Any professionally administered network is set up this way, and for good reason. Mac OS X, BSD, Linux, and Solaris are considered more secure than Windows ones at least partially because they do this by default.

Just a thought

- Collapse -
WARNING! - Firewalls are useless
Dec 23, 2005 2:17AM PST

I hope that someone from ZoneAlarm comments about this issue. I would like to know what their company has to say about these allegations. For users to communicate via the Internet, we have to allow for one or more programs to opearte from our computers over the Internet. It seems plausible that we have to make the ultimate decision as whether or not to install programs that send and recieve information via the Internet. It would be good for the Internet community to have a listing of programs and companies that could be trusted, but someone has to paid to put this into effect and constantly checked and updated. Is it feasible, I do not know. I have beenusing ZoneAlarm, probably since its inception. I must say that using ZoneAlarm along with reasonable Anti-Virus, Spy Ware deterrents,and so forth, I have never suffered a security violation from which I found myself unable to recover. I have never lost passwords and so forth. I have caught phishing attempts and other attempts at security breaches from outside sources. I could not have stopped or thwarted these attempts without products like ZoneAlarm, Spyware deterrents, and anti-virus software. Finally, it is the user that must remain eternally vigilante. The easiest way for an intruder to break into a system is to have a user install mal-ware on his/her computer. At this time, no amount of security is good enough to over ride the human decision making process. Rela Player lets you know that it will be communicating back and forthe to the Internet. If you use Zone Alarm and tkae the time to try and understand what it will do and what it will not do, I think that the user will be safer. I also use Norton Internet Security as a solution on my wireless systems. It is not perfect, but I know that it works well enough to let me make the decision as whther or not a program should communicate with the Internet. Again, the user is the weak link and the ultimate decision maker. I hope a fire wall producer/vender speaks out on this issue. I know and understand the limitations of fire walls and other security software, but it is better than walking between the rain drops without a raincoat.

- Collapse -
the work of the devil
Dec 24, 2005 3:56PM PST

I have always considered the Real player to be the work of the devil, one of the most intrusive apps known to mankind. I try to avoid it like the plague.

- Collapse -
Well a shocker for ppl
Jan 2, 2006 11:12AM PST

I have a trojan virus in my windows folder.Whenever I get it in a folder that I can delete I delete it.I am letting the virus be there.I have let the firewall on LOW SECURITY coz if u leave it in medium mode it constantly asks u to give permission.By the way I have AVG PAID VERSION.STOP - SIGN HAS TO FIRST PICK UP THE VIRUS THEN ONLY AVG PICKS IT UP.CAN SOMEONE ALSO TELL ME WHY SYSTEM MECHANIC PROFESSIONAL IS SO SLOW?I have found a lot of adware and spyware but I never remove it as it may affect my programs.So what do u think abt me?

- Collapse -
Update to my original post
Mar 5, 2014 12:50AM PST

This is an old thread, but the situation hasn't changed. The reason I'm updating it is twofold.

1) All these years later, this critical flaw remains, and it needs to be addressed. A number of people who replied to my original post missed the point. RealPlayer wasn't the issue. The issue was - and still is - that if legitimate programs can set ZoneAlarm to allow them access to the Internet and the Trusted Zone, so can viruses and other malware, such as password-stealing programs.

2) One person who replied insisted that ZoneAlarm Pro, which has a password feature that the free version doesn't, can't have its setting played around with without entering the password. At the time, I couldn't challenge his statement, since I didn't have the Pro version. I've since had a chance to use the Pro version (though I haven't tested the current one), and found that programs were able to set ZoneAlarm Pro to allow them access to the Internet and the Trusted Zone, despite the fact that ZoneAlarm was supposedly password-protected.