came across (what I consider to be) a security hole in ZoneAlarm AV (and possibly other ZA products as well).How it started was that
I had just played a game (the game is called 'N', but that's irrevelant) but kinda got bored of it so I closed the application and went to view my BitTorrent downloads on Azureus. At that very moment ZA came up with an alert to this extent:
Suspicious Behaviour"Windows NT High Contrast Invocation" is trying to control the keyboard input to the process:C:\Program Files\Azureus\Azureus.exeApplication: sethc.exe
On top of that my keyboard and mouse access to the computer was disabled - no response came from pressing any key or even moving the mouse yet Windows itself had not frozen as I could see the percentage increases of the download amount on Azureus etc. Thus ZA was waiting for my response and yet I could not respond in any way, disconnecting
& reconnecting the input devices from & to my computer had no effect. I then pressed the computer's shutdown button and turned the computer on again, thus restoring the normal state of my computer.I
in an attempt to find out what had gone wrong. The conclusion I came up with is that "sethc.exe" is a Windows accessibility service that activates upon pressing the shift key five times in a row, the process then monitors keystrokes to discover if any are pressed that it has been programmed to recognise. This program then wanted to monitor keyboard access to Azureus thus ZA asked my permission but in doing so ZA places a temporary denial of access to what the program wants to do (which was monitor my keystrokes) until I respond - denying anything to respond to my keystrokes or even mouse movements.
So what was the point of all that? I would like CheckPoint to somehow change the way ZA reacts to programs so that this kind of block doesn't occur (maybe setup ZA by default to know to allow all Microsoft certified programs to do what they want to). Maybe add an option on to the alerts so that if any given alert is not reponded to within an hour or so that the alert will be answered with allow. I've also found it odd that ZA will only place one alert before the user, thus putting all other alerts into pending mode and blocking the requests of other programs until the first alert is answered.
I've also found that when I will be typing a document and a program does something ZA wants an answer to that when the alert comes up it will quickly go away again. Why? Because I just pressed keys which answered the alert, even before I had time to read it. This could possibly allow the movements of programs with evil intent to do what they want. To fix this ZA could be changed to not accept keystrokes as an answer to the alert, or to have a timer of 15s before a keystroke (or even a mouse button press) is accepted as an answer to the alert.
Thanks for reading all of that, I hope you enjoyed it! MonkeyMagic
PS:My OS: Windows XPMy ZA: ZoneAlarm Antivirus 7.0.462.000
Message Edited by MonkeyMagic on 04-14-2008 02:17 PM