Slashdot Mirror
Morpheus Hijacks Browsers For Affiliate Links
An anonymous reader submits: "According to this news.com article, morpheus (aka streamcast) has begun silently installing a browser plugin on its users' machines that basically hijacks the web browser even when not running Morpheus. An afflicted browser will sense if a user is going to visit a shopping site like Yahoo! or Amazon, and secretly send them to a different site instead and then redirect them from this site to the user's intended destination. The user will not be aware that this is happening... however the site doing the redirecting will benefit because they are set up as an affiliate partner and will get a commission on the backs of the user. On a horrible scale of 1 - 10 for sleazy business practices, I rate this a 9.
Comments?"
Trillian password files perhaps?
perl -e 'print $i=pack(c5, (41*2), sqrt(7056), (unpack(c,H)-2), oct(115), 10)'
here's arstechnica's forum about it:p c&s=50009562&f=174096756&m=9220974704
http://arstechnica.infopop.net/OpenTopic/page?a=t
So this is based on zero knowledge, but I would guess that that violates the terms of referership (is that a word), considering that fact that that "partner" did not actually refer you to the site.
/.
I think a list should be compiled and reported, I would guess that places like yahoo and amazon could file criminal, if not at least civil, suits against such cheaters. It wouldn't surprise me if they did too, just to make a point, and to try not to jade users to the system....
any thoughts? that's a dumb question this is
http://monkeyserver.com --- weeeeee
Now that Morpheus is just a hacked-up (or down ;-) version of Gnucleus, there's really no point in using it anyway. I don't see what it provides that Gnucleus doesn't, other than annoyance.
Don't blame me, I get all my opinions from my Ouija board.
Oh this is promising, I load up this news article and theres a total of 3 comments posted under it, all of which are below my threshold, I assume all of which are first posts. But anyway back on topic.
I've heard of sneakyness not far off this already. It seems some of the other P2P file sharing programs also like to install sneaky plugins which do things from reporting your every url visited up to popping up windows with ads in them on encoutering certain keywords. Very nasty and can also incur a performance hit.
So Kazaa, the premeir FastTrack client, begun to bundle spyware.
Great, I can deal. I switch to Grokster.
Grokster begins to bundle spyware.
Fuck. Switch to Morpheus.
Morpheus bails from FastTrack, and switches to Gnutella.
Fuck again. Switch back to Grokster, use AdAware.
See that Morpheus, who explicitly claimed that it contained "No Spyware of Any Kind" engage in this type of practice?
I can only laugh at the pitiful wreck that the company/corporation-based P2P programs have become.
Business 101 - try really , really hard to piss off your customers
I'll think of a funny sig later on
The truth of it is this could be seen as a virus. It is just a profitable one. They will get smacked on this one as soon as it comes out in the light of day.
Neck_of_the_Woods
#/usr/local/surf/glassy/overhead
What you don't know can't hurt ya. Most people will still get up and go to work the next day. The crud is going to come down the line, when it waterfalls into a much bigger problems with worse results.
"i can never say no to anyone but you"
Man-in-the-middle attack is the only phrase that flash across my mind... I have no way to check the identity of the "referer".
You can call me a paranoid. Each time when I need to buy stuff online using credit card. I will reboot to a cleaner "environment" -- a clean copy of OpenBSD or something similar. God knows who the hell the various windows plugins are doing..
An afflicted browser will sense if a user is going to visit a shopping site like Yahoo! or Amazon, and secretly send them to a different site instead and then redirect them from this site to the user's intended destination.
The final destination is more or less the same. The difference is the intermediary. Morpheus isn't stopping me from going to Amazon by instead redirecting me to Borders.com...They're just stealing referral dollars.
Honestly, though...I wonder how long it'll be before these online vendors lock out Morpheus' referral IDs, or even worse, deny the connections altogether (since the most recent source IP will be Morpheus' proxy, not your own).
And I assume that if there's a pre-existing Referral ID, Morpheus will strip it out and replace it with its own. Doesn't this constitute actual monetary theft?
"Mod, mod, mod...and another troll bites the dust."
But I keep getting redirected to ZDnet somehow!
[PowerPoint] is a tool for capitalist presentation
This belongs to a new breed of nusiance known as scumware. Check out http://www.scumware.com for more info.
in simple, they arent. lets see...
1) they dont make software, the license it (or now, in the case of gnucleus, steal it).
2) they install bullsh!t spyware everywhere they can
3) they have sleazy management and software developers who know how to use MFC app wizard and modify icons
4) they violate every good business practice known to man
In my book, that does not constitute a software development company.
Morpheus is totally fucked.
Thanks,
--
Matt
Honestly, I had the idea for this a while ago while talking with a friend. I've been waiting for someone else to implement it. Its not that much different than those sites that collect and list internet deals, in the hopes that you'll follow their links and they'll get the referer fee, Like this one.
While I personally see this as a bad thing, since they do it behind the users back, I would probably have no objection to installing something similar for slashdot. I don't exactly feel the need to subscribe, but I would have no objection to them collecting a referrer fee off of my internet purchases.
I guess this is why I entered cnn and ended up on slashdot.
money is to lie and do dirty stuff if your software is free?
Somebody needs to inform Redhat.. apparently nobody told them.
Or better yet: Company X is dishonest. Company X makes product Y. Therefore all companies that make product Y are dishonest.
You, sir, are a moron.
Do not spread "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0" over the internet, thank you.
This isn't that bad really for the user, Yahoo and Amazon will give a commision to somebody anyways. What really annoys me is that this hurts all the other websites in the world. If I give a legitimate referal from my site to Amazon, then I should get the commision, not Morpheus. If this becomes common practice, then it will effectively kill the way that business is done on the web, and in the process take out a ton of small websites that are struggling to stay alive out there.
how else are the developers supposed to make money?
Any... other... way... possible.
[PowerPoint] is a tool for capitalist presentation
feints within feints, wheels within wheels
Under "Tools" -> "Internet Options" -> "Advanced" deselect "Enable third party browser extensions" and reboot. Even if the .dll responsible for the redirection, bpboh.dll, is installed, it won't be able to run.
And what, pray tell, is a fucking 10?
I think someone is being a little um. . . friendly to these jerks. Not that the warez leech kiddies don't deserve it.
Bah
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
From what I can see on their website ..
If I were Amazon, why would I pay 10-15% margin to someone who has not really promoted the product, but has hijacked the links?
They also probably violate this portion of the operating agreement.
These folks really must think that they own the user once the user buys their product, becuase even a "respectable" company like Intuit doesn't seem to have any problem with monkeying around with the private parts of the user's computer for their own purposes. Certainly those icons are paid placements.
Bruce
Bruce Perens.
If I were Amazon, I'd be going after both the affiliates and Morpheus - this sort of thing is called fraud...
-- Ed Carp, N7EKG erc@pobox.com PGP KeyID: 0x0BD32C9B What I'm up to: http://intuitives.mine.nu
I saw something doing that (wierd long url and instant redirect) when I was browsing, esp. when I went to register.com.......I figured some piece of software I had was doing it (figured it was DivX 5 though).....now I know
I'm out of my mind right now, but feel free to leave a message.....
... I use Opera. Although if too many people start using it, I'll haveta find something else.
"Derp de derp."
If this is a 9, I'd hate to see what the submitter considers a 10.
Microsoft.
Yeah, I mean it's not like they aren't providing a service. I mean they're helping people get their music for free, 'cause, you know, music is just digital but programs are, well, they have themes and skins and stuff.
Oh, the irony. Someday I suppose Morpheous will join the BSA and enforce their rights to takeover your browser. That'd be cool.
-- @rjamestaylor on Ello
More evidence that people suck.
If I were a user of Morpheus I'd be looking at filing charges for cracking my computer and using it for unauthorized activities. Companies conducting business like this need to be naild HARD. Teach them a lesson and make an example of them.
And what about the programmers who wrote this 'feature'? Who are they? I wouldn't be opposed to blacklisting them, or at least smearing their names across the headlines. This is sleazy and unethical and shouldn't be tolerated by the rest of us 'respectible' programmers.
Brian
Remember Lexington Green!
Reminds me of a report about KaZaA around the middle of last year. The TopText 'spyware'added yellow links to some words in Internet Explorer. I never dealt with it first-hand, but it sounded very annoying.
Is Morpheus' latest effort at all related? It seems to be based around thr same idea, however the idea of being redirected sounds worse. For exanple, does it work that if you type say, http://www.google.com, you arrive at AltaVista?
What is it with crappy (ex)FastTrack networks and I-can-believe-it's-not-trojan software?
On a horrible scale of 1 - 10 for sleazy business practices, I rate this a 9.
Almost as horrible as stealing Intellectual Property from musicians?
If software which does this sort of sleezy tactic put as a clear, easily obvious disclaimer "You are indirectly paying for this by allowing us free reign over your PC", then I'd wager that about 5 people on the planet Earth would actually install it. Instead, however, companies that do this sort of tactic either sneak it in entirely unintended, or they hide the details 40,000 words deep into a EULA which they know that no one reads, all the while promoting their "free" software. Why stop at redirecting the browser though? I mean surely there's some worthwhile nuggets of information on that harddrive somewhere that could be sold to the highest bidder. All's fair in the land of free software, right? (Why say just free though? Using this "anything goes" justification, anyone who believes that they are providing a more valuable service than they are charging can go nuts)
.NET Framework supposedly offers this but I wouldn't trust it until its evaluated and proven) or a legal solution. It's obvious that a "Dirtier-than-thou" cat fight is taking place with every sleezy vendor out slimeballing the next.
This sort of activity is atrocious, and I don't see how these people aren't facing the same punishment as the Kevin Mitnicks and Melissa virus writers are. Without any doubt there is a serious need for either a technical solution (one could say that it exists by way of Java : Sandbox every application to ensure it has no rights outside of its little world. The
go there, get your copy today! this has got to have some lawyers in a frenzy, but really when you're the crack dealer selling to HS kids, is someone really going to suddenly pay attention now that you're lacing it with some heroin?
...Business 101 - try really , really hard to piss ON your customers!
You're using her as bait, Master!
What's worse is that it had somehow also managed to make it impossible to change his homepage from within IE (the fields were grayed out.) After a quick registry hack he was porn free
Anyway, as long as there's a way for people to make money off the swiss cheese that passes for software security, they're going to do it. The sad thing is most people don't know how to stop these things. The sadder thing is that most people don't remember a time when the internet wasn't about making money (when people were boycotting web sites with banner ads) and don't think there's much wrong with these tactics.
Indeed, the article painted a much different picture than that given by /. It seems to be that this whole issue is actually reversed -- the browser doesn't visit a commerce site in the background - it visits a 'counter' site when you visit a commerce site.
>Thus, when a file swapper visits a site such as
>Radioshack.com, eBay.com or a handful of others,
>their computer visits a separate site behind the
>scenes before loading the final destination site.
>Those separate servers, run by marketing
>companies including Be Free, count how many times
>Morpheus users stop by.
This isn't exactly what the headline lead you to believe...
"Just tell him ya did it! That's what he wants to hear anyway..."
I should get some mod points for that subject :-)
Seriously though, the article says it can only affect IE. This makes sense, given that it's easier to do sneaky things in the registy and elsewhere which, while invisible to the user, will cause drastically different behavior in parts of the operating system, like IE.
Aren't you glad you use Netscape? Don't you wish everyone else did?
(apologies to the old Dial ads)
There is no sig, there is only Zuul.
I won't even be suprised when they start inserting ads into your fave linux distro.
:)
Aaaugh! That'd be the end of the world! Oh no, wait, I have the source code to my fave linux distro, I'll just take those ads right back out.
Ah. Problem solved. You were talking about...stupid?
Sheesh.
But what does my opinion matter, I just vote here. It's not like I have any money or anything.
While visiting astalavista to, um, get a serial number that I'd previously lost from a program I'd bought, I followed a link to a site http://www.cracks.am. When I clicked on the link to download the serial, a dialog popped up asking for my permission to install a program from C2 Media, and certifying that the program had a certificate from Verisign.
Stupidly, I clicked yes, and promptly regretted it. A whole day of browser abuse followed.
* My desktop got taken over by an 'affiliates' homepage
* My desktop got swarmed with icons for adult and gambling sites
* If a site took a long time to load, or got a 404, my browser would end up at the portal http://www.lop.com, part of the 'affiliates' network.
The program didn't leave a listing in the add/remove window. It wasn't in c:\program files.
It had buried itself deep into my windows folder.
Instinctively I searched my disks and registry for lop.com and removed all references. No cure. My browser still kept going to lop.com.
My only cure was radical action. I ran Win2k in a VMware box with disks set to non-persistent. Immediately before saying 'yes' to the installation, I ran the 'InCtrl' install tracker program. Thank God for InCrtrl - after the install was done, I had a list of all files added by this nasty piece of scumware, and had the utmost pleasure in removing it once and for all.
-- In the beginning was the WORD, and the WORD was UNSIGNED, and the main(){} was without form and void...
Screw subscription based system for Slashdot. Just make up interesting articles and put them in the headlines and get the company involved to pay for being a referrer. Slashdot viewers would see great articles like this: Windows XP Home Page: Which Edition Is Right for You? and Target's Deal of the Week. In return, Microsoft and Target pay $0.01 a hit or something. CmdrTaco could retire in a few days!
It's like hijacking hits, but with the slashdot effect.
---- The geek shall inherit the Earth.
...both the original version and the preview. Good ridance.
Somebody really needs to file Federal criminal charges on this. This clearly "exceeds authorized access", as defined in the Federal computer crime law.
Heh... I wonder what website a Morpheus user would find himself at if he clicked here.
Never never never smoke crack before geometry class!
Installing Bearshare also installs two secret spyware apps. One of them does a similar redirection, but is especially evil because it bypasses firewalls like ZoneAlarm. More information about this at cexx.org/newnet.htm and lots of related stuff at the root cexx.org
First, they took an open source app, Gnucleus, and repackaged it as their own, adding nothing while actually degrading the software by adding popup ads.
Second, they started banning from their chat room anyone who mentioned this fact and posted the url to Gnucleus.
Now, they're installing scumware in order to control your browser for their own profit even while you're not using Morpheus.
Anyone left who still wants to argue with me about whether or not Music City is a company of degenerate sleazebags? Anyone who still disagrees with me that the proper course of action is to delete Morpheus and install Gnucleus immediately? (at least until something better comes along).
I hoped the Morpheus name would help gnutella network along but maybe not...
... although I have installed this "Preview Edition" I ran a piece of software and could find no BHO files other than Norton's and Adobe's.
So... my question is where is the spyware?
Get your Unix fortune now!
This is like spammers embedding banner images in their spam and getting paid every time someone opens the email just because the banner was loaded. It's just running the meter and the entity being screwed is the website that is paying them a referral fee.
The article, in one part, reads: "Griffin said the technology is simply taking the old affiliate referral program to a new level. Most of the referrals will happen inside the Morpheus application itself after the new version is launched with a commerce section, he said."
Yeah, right. Most of the referrals will clearly be a result of their sneaky browser add-ons, not because anyone really pays attention to the commerce section of a P2P client. Heck, P2P users generally get as much as they can for FREE--not exactly the target market of much of anyone.
For you windows users, I noticed that Morphesus also installs a program called BDE under "\%Windows%\BDE", and it installs a Registry Key under:
r entVersion\Run".
"HKEY_LOCAL_MACINE\SOFTWARE\Microsoft\Windows\Cur
This key loads the program at startup. The program appears to be some sort of video codec/player.
After reading this article (and noticing redirects being performed on my system - i thought it was something else, not morpheus) I downloaded this utility: BHO Cop which is designed to search out these nasty browser-attached proggies and allow the user to disable them. I found the culprit: bpboh.dll put out by Wurld Media, who, according to their inadequite website, claim the primary goal of their business is to help companies be profitable (very ambiguous, don't you think?).
.dll w/ BHO Cop, relogged in (WinXP) and low and behold, when I go to amazon.com, I end up at the root page rather than a referal page deep in the system.
Well, I disabled the
So - download and run BHO Cop now! who knows what else you might find (Acrobat seems to have dumped something as well)
I'm out of my mind right now, but feel free to leave a message.....
goto http://www.Lavasoft.com and download ad-aware and the latest ref update and have it remove all your spyware from your computer..
Limewire is good. But don't download its Windows installer- that has spyware in it! Instead: install a JVM on your computer, then go to Limewire's page for alternate OS downloads, select "other" as your operating system, and run it using the JVM, without all the crap they bundle in. Most spyware is Windows-specific.
Yeah, it's a shame that P2P only became popular recently, in the age of the MP3. If it had been invented 10-20 years earlier, with RFCs, and had the stature of, say, FTP, people would be thinking of it as a fundamental part of the Internet. Instead we have this horrible situation, where anyone who uses a P2P client is presumed to be a freeloader or a criminal. P2P deserves better than a bunch of spyware-loaded clients that block each other's users from their own networks.
The new Morpheus marketing program is based on a technology called browser helper objects (BHO), which attach themselves to Microsoft's Internet Explorer browser
.dll that will be loaded every time your Internet Explorer starts. It is registered in the windows registry.
.dll file) and then deactivate it.
The Morpheus spyware is just a
So this bho spyware can be removed by using bhocaptor . Bhocaptor displays all bho that are registered within windows registry. So, what you need to do is to select Morpheus bho(a
As bho is an Internet explorer technology, those who are using netscape or mozilla should be immune to this spyware.
This like you asking a guy for directions to the "Stop and Rob", but he gives you directions to his brothers store, "Grab and Run". His brother lets him live in the basement of his house, because he sends lots of business to the "Grab and Run".
You wanted to get some YooHoo but the "Grab and Run" doesn't have any, and you were going to shoplift it anyhow.
Doubly pissed, you report the "Grab and Run" to the authorities (you saw a rack of VCRs in the back room, making copies of Asian snuff films.) The cops come and arrest the owner and throw his ass in jail.
After looking up the address of the "Stop and Rob", you head over there. The brother of the now jailed owner sees you, beats you to the ground, and takes your wallet. In your wallet is an I.O.U. from your boss to an employee that works in the same row of cubes as you. Your wallet is gone, and so is your mugger, so you get up and run over to the "Stop and Rob".
You ask to use the phone, and while the clerk is hitting on some drunk chick with a feather boa, you steal your bottle of YooHoo.
And to think I actually -owned- streamcast.org for a while. Yeesh.
Bowie J. Poag
I just did to remove this....
checkout my post on it: 1 post before you
It worked well, and even told me the name of the dll so I could go delete it myself
I'm out of my mind right now, but feel free to leave a message.....
Taken from download page of Morfeus:
"This ad-supported software includes technology that will serve banner advertisments through the program interface. Morpheus also includes BuyersPort, a shopping portal that may log your IP address, track surfing habits online, and share aggregate user information to third parties. For more information, please refer to BuyersPort's privacy policy."
Ok, we know that morpheus is spyware. Would anyone mind telling me how to find that out? I have a few programs that i would like to test and see if they are whispering behing my back
And you have installed Morphous on your net-unaware computer? :)
Wow, I should not post when knackered.
I have sent the following message to Robin Gross of EFF.
Dear Ms. Gross
I am writing to express my concern that my attempts to financially support EFF have been stolen by Morpheus and similar companies. I have long been careful to use the Amazon Affiliate Button on your front page for all of my book purchases. I have felt that doing this combined to support what I believe in simply and effectively. Since my purchases have been well over $1000 per year for at least the last two years, I know that it has to have been worth at least some money to EFF.
It has recently become apparent that Morpheus et al. have been placing software such as TopText and other scumware on users machines. These programs have the sole purpose of rewriting affiliate links. This effectively redirects the financial benefits of these links to the scumware operators. To put it bluntly, this is theft, no different than if they had taken the affiliate checks and written their own names as payee.
I have supported the EFF for years. I supported Morpheus partly because of EFF's support of them. But I am frankly disgusted by this turn of events. As the Director of the Campaign for Audiovisual Free Expression, and a staff attorney for EFF for Fair Use and Intellectual Property, I believe that you may well be the single best person to let them know they have gone too far. To take a principled stand on Fair Use is one thing. To pump ads to users while using the software is also perfectly legit. To actively steal revenue from other people, companies and organizations, even after the user has supposedly removed the software, without notice is simply beyond comprehension.
Sincerely
Walter Williams
The article said that StreamCast will:
1. Redirect users to another site to collect usage statistics before sending them to the site they wanted to go to. This might be seen as invading people's privacy, but no personal data will be collected, merely usage statistics.
2. Put up a shopping section in Morpheus. That sounds perfectly legitimate to me.
3. Put referrals to online stores inside the browser window in some unspecified manner.
Please note that 1) and 3) are two separate points. They won't redirect you to another site when you're trying to go to Amazon.com, and then claim the referral bonus. The redirection is only for collecting usage statistics.
And the referrals inside the browser window have nothing to do with the redirection.
There's nothing in the article saying that StreamCast will hijack other people's referrals.
There's nothing in the article saying that StreamCast will pretend to refer people to sites (like Amazon.com) when they go there themselves.
www.ebay.com
links to http://www.qksrv.net/image-280514-220264, which has an instant redirect to pages.ebay.com. I played with this in netscape 6.2 and lynx, and they still directly put me towards www.ebay.com. There is definitely redirection occurring here.
www.amazon.com
links to http://www.amazon.com/exec/obidos/subst/home/home. html/104-9801158-34639, while netscape and lynx go similar (but not the same) page in the same sub-directory tree. I'm not sure if there's a url redirect occurring here.
www.barnesandnoble.com
In IE, goes to http://service.bfast.com/bfast/serve?bfmid=2181&so urceid=21425507&categoryid=rn_home, then redirects towards a barnesandnoble.com redirected address. Netscape and lynx still go straight the low level barnesandnoble.com address. There is also definite, blatant redirection occurring here.
So, there you have it- out of just three simple checks, Morpheus went and screwed with two of them. I'm getting this crap off my machine and installing a better gnutella client.
Exactly. Why the hell are people using it anyways? Go here to download the spyware free and opensource version.
Didn't Morpheus' just recently (as in last month) contain a prominent "no spyware" logo?
That sure didn't last long.
The plugin is likely to be found in the directory: /u filename and then delete it from the dir.
\winnt\downloaded program files\
where al the IE plugins are stored. I don't know the correct filename, but you should first de-register it from the registry by using regsvr32
Never underestimate the relief of true separation of Religion and State.
Download IEradicator and get rid of that POS for good.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
TopText is KaZaA's version of this mess so I assume Streamcast is doing basically the same. Specifically, it reads the HTML coming through and does two things. First, any link to an affiliate program it recognizes gets rewritten so that the referal ID is TopText's NOT the site which provided the link and content. Second, the text is searched for keywords which are then rewritten to be links again with a refer ID for TopText. This is the source of the so called Yellow Text links.
/. subscriptions, how bad would it be if all the ad revenue disappeared because Morpheus and KaZaA stole it? Now think about all of the free sites out there trying to live off the referal ads. They will all die if scumware like this becomes standard.
The first one is theft pure and simple. The people like me who write the site are trying to get paid by putting the link there. KaZaA, Morpheus etc are simply stealing scarce and hard earned money from others. The second activity might barely be legit but not likely. For example, if I linked "Buy your books at BN" with my referal ID and TopText then grabbed "books" to point it at Amazon, I have still been robbed.
If my sites didn't make at least some money off the links, they would disappear when the hosting bills come around. For all the screaming about
"Shopping sites in general, as well as many other public sites that depend on referral revenue to operate will lose money as a result of this,"
What utter nonsense. A business is supposed to make money by selling a legitimate product or service. If a significant portion of your revenue comes from "referrals" and not from the sale of a legitimate product or service, then you deserve to go out of business.
there are native gnutella clients that run natively under nearly every operating system.. its kinda dumb to run one under wine when you can run it natively.
kchhrr.
To hell with the idiots downloading porn or warez.
This affects website owners. Many small websites make ends meet by their affiliate links. This will steal that money away. This is one of the few way small webmasters can make money - short of begging.
And aren't we all sick of the virtual begging cup by now? Don't let the last legit way for sites to make money be destroyed. Sites that don't have traffic for banner ads sales, need these sales. They need this income. If this takes off, it will wipe out small sites everywhere.
As an example, look at http://www.gonegold.com
Informative helpful website. IGN pays them squat. But they do make money on their affiliate gaming links. Take them away and who will pay the site's bandwidth? That is the real issue, that is the real fight. And for some smaller sites, this really is a fight for their survival.
By the way- what is the implications that the only thing you have to agree with when installing morpheus is the gnu license. their is no mention of this spyware(even though it is installed).
Chet
...that comes up all the time, particularly with reguard to virii and warez. If you can't trust the software - don't install it. When you run any .exe in Windows, you accept that you do not know that it is going to do - at all! It may format your hard-drives, and mail all your porn to your mother.
/usr/local for others, so I never need to log in as anything but that unpriviledged user.
So, if you don't want all the crap, don't use software you can't trust. How do you know if you can trust it? Well, you could audit the source code and compile it yourself. You could write the software yourself. Or you could get the software maker to sign into a legally binding contract which says that their software will not do anything but its primary intended use (for Morpheus, this would be stealing music), and that they must disclose everything that it's going to do to your computer. Fat chance of that.
What do I do? I run Linux. I only login as a unpriviledged user (I have access to my home directory, that's all.) All the software I install I only install into my home directory (again, as the unpriviledge user.) I'm the sole user of my machine - I don't need to be putting it in
The security then isn't perfect, but strangely enough, most open source projects don't include spyware/scumware of any sort. So I don't worry about it.
Running any priviledged executable is the ultimate shrinkwrap EULA, saying, "I give you permission to do what ever you want to my computer." We'd all be a little better off if people were more paranoid about their computer - but if they don't mind untrusted software messing around, who am I to stop them? Maybe we'll get lucky, and the next version of Morpheus or Kazaa will automagically lock out any user that downloads it. That would provide a nice lesson. Would it be a virus? Well, you chose to download it and run it yourself. So, I say no.
What do you think?
Jake
Dating: while( 1 ){ call_girl(); get_rejected(); drink_40(); } return 0;
I'm a sysadmin in a large call centre which used to tolerate a certain amount of personal use of it's computers. One of the main helpdesk requests to the IS department had was for ghosting's of computers which had been so f**cked up by various bits of spyware. The worst offender by far was Save Now, getting it to uninstall was a pain and even when you did think it was gone, it would reappear sooner or later. We firewalled the Save Now website and any addresses the app connected to to and rather than die after 2-3 attempts the plugin would thrash the firewall contiuously trying to make a connection. We also came across a particular nasty spyware app which had no visible front end but would randomly redirect you to a porn site, thankfully we had Super Scout installed which blocked 99% of porn sites. However this didn't help the poor employee who unknowingly had this crap on his PC as he though he was going to be sacked for looking at porn (we have always had a very, very tough line on porn).
Most of the spyware on the computers was not intentionally installed which is what made it worse. The last straw for us was when we discoverd a Win98, 1ghz Pentium with 256mb RAM and a fast hard drive taking 15 minutes to start as it was loaded with so much spyware/plugins/rubbish and they all wanted to start simultaneously, running a packet sniffer on that particular machine showed that spyware was using over half the bandwidth available. We locked down the network after that barring access to anything known to inolve file sharing, plugins, spyware etc. However there is an interesting side note, we had a retained lawyer with IT specialisms, aparently the UK Computer Misuse Act makes it illegal to alter the contents of a computer without getting the users authority, which was interesting.
It's bad enought these spyware app's stealing money from deserving small websites and let's face it users as well. You just need to see the damage they can do to networks and computers as well, I can see a lot of sysadmins becomming very angry if these sort of applications get more sneaky and nasty in the way the operate.
Maybe I'm reading it wrong, but I took 'refer' to mean simply the HTTP_REFERER header:
...StreamCast can make it look like it is referring traffic...
That simply sounds like, due to a meta or Location: redirect, the browser sends their website as the HTTP_REFERER, thus appearing that they are "refering" traffic, not using an affiliate/referral program.
I could well be wrong... but my first reaction was the less paranoid conclusion. I'm sure if they were actually hijacking affiliate links there would have been a lot more fuss about it by now.
NGWave - Fast Sound Editor for Windows
I have played with a couple of them.
Limewire has spyware/adware hardwired into the program, at least in the Windows version. Re-apearing Reqistry keys shows this.
Seems to be possible to run BearShare without all the snooping. But 3rd party crap is included and you must be careful not to get it installed..
A bit offtopic but still on the subject of spy/adware.
Now even my Logitech comes with a lot of crap that when you try to install their drivers, you have to read carefully right to the end what the diaglog boxes says and even after avoiding all their "helpful" programs there seems to be one or two programs running in the background that you can remove without it having any impact on the functions of the mouse like the webwheel etc. witch by the way will have a date with my packet sniffer one day, I'd be surpriced if they didn't do some monitoring.
That Logitech was really too much, they REALLY tried to shove a lot of junk down your throat. Which made med loose the last ounce of respect for the company. I am a user who knows what to look out for, but I'll bet that 99% of the mouse buyers just answers yes to it all.
BHO Cop 1.0
I ran it this morning and don't seem to have bee infected by their fraud so I don't know what the BHO looks like that belongs to Morpheus, but this app looks pretty helpful.
I'm the big fish in the big pond bitch.
PS. EMI report today that due to falling profits, they're laying off 1800 people. That's eighteen hundred people who have lost their jobs, because of shit like Morpheus allowing easy piracy..
Right. Either that, or the fact that the economy is in the toilet and people aren't buying CDs. We're not really sure which. Let's allow the media empires to make some broad-reaching laws that limit consumer control just in case that's what the cause is.
First, using anyone's work without compensating them in the manner they dictate is immoral and illegal. Software, music, art, etc. PAY FOR THE MUSIC YOU LISTEN TO. Hopefully, pay the artist directly. If necessary, pay thier broker or distributor. But pay, or don't use the work.
Second, listening to music doesn't cost anyone anything. It just doesn't provide the revenue expected. If I just didn't listen to music, would that be costing those people jobs? I can't be held accountable for the effects of NOT buying something, can I?
If EMI cared about those 1800 people, they would take a 10% salary reduction across the executive level. I doubt they did. In reality, I assume the market is slower, technology is better and LESS PEOPLE ARE REQUIRED to do the same job than last year. If you don't need personnel, you let them go.
As I've said before, 95% of the readers of Slashdot are just wanna-be Linux users, who use Windows cos, Oh, using Linux on the desktop is just too tricky in todys world.
Can't someone port it to KDE/Gnome?
If your such a real hardcore linux geek, and better than 95% of the slashdot readership then surely you would be able to port it to linux yourself.
A web browser or an ftp client allow you to steal music and porn. Blank paper and a pen allows you to steal sheet music, books etc.
There is nothing illegal or wrong about p2p software, it's just another way of transferring information.
graspee
I work support for an ISP and gets LOTS of calls abou not being able to browse because of these types of apps, like webhancer....webhancer shows as a running program whagent...how do I see if a customer has this new marketing helper installed/running?
at the end of the day, it's great to go home and fire up my mozilla browser, sometimes it feels real good to be unsupported.
"The Most Fun Possible on 4 wheels" is at SunBuggy in Las Vegas
There's a difference, though.
In Intuit's case, they're trying to be helpful with targetted ads ("If you need a tax program, maybe you need a bank -- try this one") and they're obviously being open about it. Shortcuts on the desktop do not bug me. Highlight - click - drag - delete. (And ideally, this should be lowering the price of the software... fine by me.)
What does bug me is when a program silently installs something named 'cdload.exe' or some other important driver-sounding thing in the background which randomly pops up IE windows every 30 minutes or so, and really confuses the heck out of me (especially when I didn't have IE running in the first place!).
To me, "monkeying around with the computer" really means surreptitiously installing boot-time-start daemons which consume resources and spy/spam/etc actively, not just throw a few links around....
That's the difference between scumware and just selling "sponsored links".
See Fair Software Installation here on SlashDot. This is just the tip of the iceberg -- many, many applications will do this kind of thing. You CANNOT rely on the "good will" of software authors any more. There must be a technical and legal framework in place to prevent these kinds of abuses.
In the world that gave us the Bhopal disaster, the Sonny Bono Copyright Extension act, and the conditions of migrant farm workers, I have trouble rating browser redirection more than a 4.
This is the slippery slope you step onto starting with "it's OK for an ISP to implement a web cache".
Why an ISP should be permitted to modify, redirect or do *anything* to your traffic other than move it to its destination escapes me. I heard lots of handwaving about how OK it was from my ISP when they installed a webcache, but it was basically a load of hooey intended to justify degrading my service and pocketing the profits they made from doing so.
-=Maggie Leber=-
I installed the latest version of Morpheus, and like the bad Internet citizen I am, I did all I could to limit file sharing. In fact, I deleted every directory off the shared directory list. Yes, I fully admit to being a hypocrite who downloads stuff and doesn't share his own.
So what happens? After running Morpheus for a couple of days, I note from Zone Alarm that I've uploaded about 600Mb through Morpheus. How? The hell if I know. Maybe by deleting all of the shared directories Morpheus decided I wanted to share my entire hard drive.
What was uploaded? I have no idea. If were paranoid this would frighten me.
An now someone says that Morpheus can redirect my web browser. Shudder.
144l. ph34r my 133t l3g4l 5k1lz!
Fuckin' picky judges! The Morpheus people work hard on this, and still you leave them with bitter disappointment. What does it take to get a perfect ten?!?
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Read the license closely - you agree to have your search page, your home page, and your favorites HiJacked when you install that crap! In my case the ActiveX applet was NOT signed by a cert that my browser trusted. Needless to say I skipped their "download applet" and went elsewhere. Lot's of P0rn sites are popping up dialogs asking to be made your home page - on one case I saw the dialog had been modifed to say "click yes to proceed". I didn't fall for it but I know someone who did...
A woman I know who has several young kids did a search for "puberty" and when following a link she got into a pop-up site. She must've hit "yes" to one of the dialogs because her homepage was now smut - not that the "Yes" button has default focus. She was in tears by the time I got her straight, she was deathly afraid her kids would see that crap before she could get it fixed. (sigh) Some of this stuff is REALLY sleazy and it's getting worse...
I now use Serials2K instead of going to Asta when I need a number. It has the added bonus of allowing you to input your own serials and store them in an encrypted format. Can be ported to a Palm too!
Build it, Drive it, Improve it! Hybridz.org
Documentation on Browser Helper Objects (BHOs) at MSDN.
S
of redirect since I installed the preview client.
BHO Cop as well as Ad Aware do not find anything.
There were a couple of things I replied no to and I did a custom install.
errr....umm...*whooosh* *whoosh* Is this thing on ?
Well, maybe that's because they effectively do own the user? Operating systems are still designed around the idea that any application has all priviledges the user running it has. This is a good idea if you have small tools -- e.g., cat may read all the files that I have read permission on. When you have larger applications, like a complete office suite, this solution is somewhat less good. Once the user installs software from the internet, this design is a fundamentally flawed one.
Users expect that e.g. on a UNIX system, cat will only read files, and therefore it is a perfect idea to let cat read all files that the user has read permission on. The user's perception will be "I may read this file," when technically it is actually "software I run may read this file."
As soon as the user installs software that does things they don't expect, because the software doesn't advertise all of its functionality, this model breaks. Most users won't even find out, and if they did, they'd probably ask "why is Morpheus allowed to do this?" The user will no longer have the perception that he is doing things, and will have to realize that actually it is the software doing things. The operating system however is still designed around the idea that everything the sofware does was intended by the user. (No, I don't have an idea for a better design.)
Sig (appended to the end of comments I post, 54 chars)
Yes, you do have the source, and you could remove the ads. I wouldn't. Knowing that most linux users hate ads almost as much as paying for anything, I can't imagine a linux distro putting ads in unless it was absolutely necessary. If they need the money that bad, and I'm using their "free" product, I'll look at ads. Even click on some.
Maybe that'd be a decent way to differentiate between d/l iso & boxed sets.
So anyway, smarty-pants (since we're resorting to name-calling). How would *you* make money off a free product that no one pays for? I love Linux, and try to support it in any way I can. And I doubt any *theoretical* distro ads would be spyware.
Whatever.
jred
I'm not a mechanic but I play one in my garage...
Are there any Linux clients that support multi-source downloading other than that hideous blob LimeWire?
:)
:)
That's my main reason for trying to get Gnucleus working under Wine
Speaking of which, Bartok, how'd you get it to work? Did you have to copy any native DLL's, etc? I can get Gnucleus to come up, but the search bar is missing... It's not much use without that
"People that quote themselves in their signatures bother me" - athakur999
It's not even a clone - it's a fork. They didn't even bother to rename the directory in which the source is - it's called gnucleus2 or something:P
0x or or snor perron?!
Uh... any competent network admin would be using the 98 administration kit to lock down all client machines on the network so that no software cannot be installed and run without the admins permission (The IEAK works the same way for IE).
I hear of "networks" having this problem and I'm flaberghasted. Whose running these things? This is a non issue if the IT department actually did their jobs!
Contrary to popular belief, coding is not all free blow-jobs and beer. Those things cost MONEY!
I want plugins that will display content that the basic browser does not. The browser should pass unrecognized content to the appropriate display engine and provide it a wondow to draw into and the plugin should display the content in the window.
WHY CAN THE PLUGIN ALTER BASIC BROWSER FUNCTION?
This has got to be a huge security hole just waiting to be exploited.
I have discovered a truly marvelous sig, unfortunately the sig limit is too small to contain i
If it looks like c|net is taking a stand in this article, perhaps it's because c|net's reporters will lose their jobs if c|net can't generate income through affiliate links. Note that many of the banner and button ads you see on c|net and other web sites (probably including Slashdot) are actually affiliate links -- the site is not getting paid unless sales are generated and tracked to the content site.
When Morpheus or any other app checks the URLs and replaces other affiliate codes with its own, Morpheus is trying to take revenue from someone else, without providing any benefit to the consumer or anyone else.
The good news is that most affiliate managers refuse to pay commissions to any "affiliate" who uses "predatory methods" like this. The affiliate managers realize that smart affiliate sites won't do business with any merchant who pays the "hijackers" in this situation.
The bad news is that if the hijacker replaces the affiliate link, even if the hijacker does not get paid, there is no way for the sale to be credited to the "real" affiliate. The hijacker is also likely to mis-manage the multiple redirects that often happen when a link passes through two or more ad servers (common with affiliate links that look just like paid banner or button advertising).
In the end, if these predatory software tools become more pervasive, content providers will lose all incentive to provide "free" content on the internet.
This issue is not unique to "predatory browser add-ins." Other content providers are threatened with loss of "the benefit of their bargain" in other ways. For example, that the TV networks have battled hard to discourage marketing of TiVo and ReplayTV as "commercial skippers" because if too many people find ways to skip TV commercials, then the advertisers won't pay the rates, and the networks eventually won't be able to spend $10 million on the next episode of "E.R."
Maybe, in the end, we just won't have advertising-supported content like we do now. Certainly, the current revenue model isn't working to pay the salaries of content producers: even with intrusive pop-up and pop-under advertising, and rows of banners and buttons, big content sites often earn net rates of a few pennies per thousand visitors, and some earn only a few mils (tenths of a cent) per thousand visitors. Those earnings might be enough to cover the server and bandwidth costs, but not to pay a single part-time reporter's salary.
So maybe in the end, the only free content will be sponsored directly by big corporations, who have good reason to pay to control the content and viewpoints of the news we read.
Or maybe some of us will break down and start paying for web content, if only someone would come up with some workable mechanism to allow micropayments (payments of a few mils or a penny to view a web site for a day, or to read an article).
-- http://www.MarkWelch.com/ Pleasanton California
Heh heh, it's only open source because they've modified the Gnucleus client to contain the Morpheus artwork and assorted "hidden functionalities" (I doubt that they'd distribute them as open source if they were attempting to obscure them from the public's view). The Slashdot editors accepted a pseudo-fabricated story at the beginning of the month with information about how Morpheus PE was a GPL violation. Apparently, Streamcast had not yet made the source available.
Do you like German cars?
This is tantamount to theft and fraud. Musiccity.... what a bunch of pr0n-ad-spyware warez-mongers. Then again, blame the people that install these closed-source spyware progs. As they say, know what you're installing lest you pickup a virus.
The biggest trick the devil pulled was letting lawyers become politicians so they can write the laws.
10: fucking over billions of people (living and yet to be born) by sacrificing their only habitat for short term financial gain
...
9: torturing people and supporting psychotic murdering tyrants
much, much lower: some scum suckers leaching a few dollars with a Trojan horse
d'oh - I mistyped. IIRC, you're the name-caller here...I believe the word "stupid" is yours as well. My use of the word was intended to show that putting ads in Linux wouldn't confound all of those "stupid" free software advocates out there, and that in fact, they weren't so stupid. As I read my original post, I see that I didn't make that very clear. My bad. But anyways...
:)
So anyway, smarty-pants (since we're resorting to name-calling). How would *you* make money off a free product that no one pays for?
I dunno, I do actual work for a living. Try asking Red Hat, though - they do a pretty good job without putting ads in Linux. (How would that work, BTW? Instead of Tux in the console framebuffer, a pr0n banner? Product jingles when you grep() something? Easily blockable ads on Slashdot? Oh wait a minute...:)
Whatever
Han Solo - "Sorry about the mess" *flips coin*
But what does my opinion matter, I just vote here. It's not like I have any money or anything.
We do use the lockdown kit and have done for quite a while, initially to randomly monitor client machines for dodgy stuff then later to lock machines down. Unforunately it just does not work! Plus there is the social engineering of this scumware which takes advantage of users naievity to make them think the app is of real benefit to them and mentions phrases such as "Will work behind most firewalls" or "This plugin can bypass you network security setting which sometimes blocks innocent programs like this". The sad fact is scumware programmers write their software to bypass security mechanisms sysadmins put in place. We now simply rely on a good old fashioned firewall and signed agreement that says if you install unauthorised software you'll be out the door.
You seem to be operating under the impression that the competent network admin is the entire IT department. It's really easy to crucify the IT department as a bunch of bumbling incompetent fucks, but I can just about guarantee that the techs will want your head after they have to personally service every special request from every user to get this or that item installed. You can sit on your righteous high horse all you like, but once you try to force it into reality, you'll learn real fast that policy decisions have real and unintended consequences.
Admining a couple linux boxes does not make you an IT division.
I've finally had it: until slashdot gets article moderation, I am not coming back.
I have the newest version of lavasoft and it didn't detect it. Morpheus' little redirect fairy wreaked all kinds of havoc on my comp when I used norton firewall to restrict access of the website they send you to- www.inmotiongolf.com. Once I restricted it, xp froze completely and after rebooting, it would freeze everytime once imapi.exe loaded. After a few hours of figuring out what the hell just happened, I reinstall my firewall, uninstall the superevil morpheus, delete c:\windows\bpboh.dll, c:\windows\rdxr020305.dat, and c:\windows\system32\rdxr020305.dat. System clean, no more spyware, no more crashes, and I hope whatever ad wizard decided to throw that little component into the new Morpheus drowns in a pool of his own vomit or better yet stops by my place so I can beat him about the head and neck with my keyboard.