ZoneAlarm Sniffs Out Spyware Behavior - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

06:50 PM

ZoneAlarm Sniffs Out Spyware Behavior

Zone Labs targets consumers and small businesses with a proactive approach that bases its defense on firewall technology.

Zone Labs Wednesday rolled out an anti-spyware product for consumers and small businesses that takes a proactive approach by basing its defense on firewall technology.

"Our approach looks at the behavior of spyware, not at a database of definition signatures," said Gregor Freund, the chief technology officer of Zone Labs, which is part of the Redwood City, Calif.-based Check Point Software.

Rather than rely on spyware- and adware-specific definitions to detect and delete unwanted programs after they've gotten a foothold on a PC, the new ZoneAlarm Anti-Spyware looks for some 20 different spyware "behaviors," said Freund. That insures malicious code isn't inserted into applications, processes, Windows services, or the operating system's kernel.

"The basic foundation of any spyware prevention has to be the firewall, because it goes beyond reactive signature-based technologies," said Freund.

AntiSpyware uses Zone Lab's new OSFirewall technology -- which also is used in its ZoneAlarm and ZoneAlarm Pro personal firewalls -- to detect possible spyware.

Backup defenses include a blacklist/whitelist maintained on Zone Labs servers, and a home-grown conventional signature-based scanning engine, said Freund. The first time an application attempts to connect to the Internet, for example, AntiSpyware pings those servers to check against a 60,000-item blacklist and a 30,000-item whitelist.

"Our response is within a half a second," said Freund, who said that Zone Labs has been ramping up its server capacity to handle loads in excess of its current 30 million requests per day.

Defenses that depend exclusively on after-the-fact scanning for adware and spyware are doomed to fail at some point, Freund said.

"Signatures have a difficult time matching the rapid changes in spyware, which can mutate as many as ten times a day," he said. "Spyware's also using new technologies to embed its code in a system. Spyware makers are beginning to use rootkits, for example.

"And we just don't think it's acceptable for spyware to run wild until the next scheduled scan. You can't allow code like this running on your machine for 24 hours. That's like closing the barn door after the horse is gone."

Zone Labs, which also sells an Integrity line of enterprise-grade security software, will move this anti-spyware approach into those products too, said Freund. While he refused to comment on a specific date, he promised it would be "pretty soon."

ZoneAlarm Anti-Spyware is available immediately at $30 per individual user. It runs on Windows 98 SE, Windows ME, Windows 2000 Pro, and Windows XP.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
The State of IT & Cybersecurity Operations 2020
The State of IT & Cybersecurity Operations 2020
Download this report from InformationWeek, in partnership with Dark Reading, to learn more about how today's IT operations teams work with cybersecurity operations, what technologies they are using, and how they communicate and share responsibility--or create risk by failing to do so. Get it now!
IT Careers: 10 Industries with Job Openings Right Now
Cynthia Harvey, Freelance Journalist, InformationWeek,  5/27/2020
How 5G Rollout May Benefit Businesses More than Consumers
Joao-Pierre S. Ruth, Senior Writer,  5/21/2020
IT Leadership in Education: Getting Online School Right
Jessica Davis, Senior Editor, Enterprise Apps,  5/20/2020
Register for InformationWeek Newsletters
Current Issue
Key to Cloud Success: The Right Management
This IT Trend highlights some of the steps IT teams can take to keep their cloud environments running in a safe, efficient manner.
White Papers
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll