TurboTax DRM Writes to Your Boot Sector?!
ltwally writes "As reported on Slashdot (amongst other sites) recently, the latest version of TurboTax is laden with DRM software. Even worse, however, is that it apparently writes to your hard drive's boot-sector , as reported at Extreme Tech here. As I'm sure most Slashdotters already know, the boot-sector is often times used for silly things like boot-loaders and such. "
CDilla's LMS does this too, although I'm not completely convinced it's the bootsector. Still, nothing short of a low level format clears it, so it probably is.
Resistance is futile. Reactance buggers it up.
This software does NOT write to your boot sector. It writes to sector 33 on the track which contiains the boot sector.
This is certainly a Bad Thing, but not nearly as bad as writing to the boot sector would be.
Tarsnap: Online backups for the truly paranoid
If you insist on using TurboTax, use their web-based vesion; it's alway current and no software gets installed on your PC.
Personally, even though I've been using TurboTax for over 10 years, I will be using a different tax preparerer this year. I find their association with this kind of DRM crap distastful.
Can You Say Linux? I Knew That You Could.
~jeff
As I understand it, a program running as Administrator on NT can elevate its privileges to LocalSystem and do just about anything, such as write sectors to physical drives.
Will I retire or break 10K?
I vaguely remember reading on a Mac site that the TurboTax packaging rather explicitly states that the product will not run in any kind of Windows emulator (the article of course was talking about Connectix Virtual PC).
If that's the case, this boot-sector thing might be a major part of the reason why.
~Philly
.. any word on how it impacts a dual-boot box? So far, so good. I've got TT installed in WIN98. I run a triple-boot WIN98/RH8.0/Mandrake9.0, using RedHat's Grub. Works fine, boots fine.
Intuit's still a bunch of SOBs for doing such a dangerous thing, though.
"If, therefore, any be unhappy, let him remember that he is unhappy by reason of himself alone."
~Epictetus
Use their Web service instead of installing their software...
My wife does our taxes. We have an LLC, really a microbusiness that does less than $30k/yr [this year it'll be $25k]. From that you knock off expenses, ebay fraud [paypal, please take a bow], and the like.
Anyhow, just doing minimum compliance with the law, no massively complicated deductions, you have to do things like calculate "minimum alternative taxes", and such... it's taken my wife since December, 2 hours or so each day, about 3 days a week... so I guess that would be 36 hours so far. She's still not done.
Yeah, she's doing it analog. I don't think turbo tax *would* help a whole lot, especially since a major part of her job is reading and rereading all the IRS documents to find out their new rules this year, and how she has to expense this, deduct that, cannot expense and *must* deduct t'other, *must* expense the third, or fill in a form explaining why she isn't expensing it, and so on and so forth.
I dunno. If you count the cost of her time as $20/hour, then without us owing anything, the cost of taxes would be $720 and counting.
Anyhow, lemme finish up with a link and a comment:
http://www.givemeliberty.org : absolutely right, legally correct based on written law, but it'd be incredibly stupid to join. Lots of our rules have nothing to do with law, if you get my drift. Better just to leave.
Correct Horse Battery Staple: 72 bits of entropy. Enter "Correct H" into google. When it generates the phrase, that's
Check out this on the turbo tax support site.
Infact, only an os installer should write to the boot sector, anything else should be considered a virus. Infact many bioses have the option to detect and block attempts to write to the bootsector under the name of bootsector virus protection.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Huh? A sector on a disk does not contain other sectors. Therefore, there cannot be a sector 33 of the boot sector.
Perhaps you mean that that sector 33 in the boot-information track or cylinder is overwritten. That would seem to make more sense.
Washington, DC: It's like Hollywood for ugly people.
I would bet the farm on the fact you could do it with VMWare. I have found that OSes installed on VMware have no knowledge of their host operating systems, nor does any disk activity from the VMware OS have any affect on the host's partitions/drives, because the 'disk' is actually just a file.
Because the mac version was $10 more AND none of the rebates in store would apply.
Karma: Chameleon (mostly due to the fact that you come and go).
it writes to the boot *track,* so it's not going to munge your partition table, but may well munge other important boot records.
Nothing belongs in that *track* other than boot information. Period.
KFG
like, by the article and stuff, it doesn't write to the MBR. It writes to sector 33 of the boot *track.*
The problem is that since the entire track is reserved for boot information, not just the sector holding your MBR, things like LILO and GRUB may be residing there as well.
Boot loaders are legitimate boot records. Software registration codes are not. They don't belong in the boot track, whether they write to the MBR or not.
KFG
Win4Lin recently added support for TurboTax. It virtualizes writes to cylinder 0 into a special file in your home directory. So you can safely run TurboTax without it actually doing anything dangerous to your hard drive.
Yep, it works with VMware. That's how I installed it, after reading the earlier /. story. One thing, though, you need to turn off the "hardware acceleration" in the VM configuration while starting the program (after that, you can turn acceleration back on).
After reading the earlier stories about locking to a particular machine, and possibly installing spyware, I figured I'd either return the thing or install it under VMware. The geek in me won out, so I decided to see how it'd work under VMware. I'm sure glad I didn't install it on a PC directly.
-Steve
Democracy is a poor substitute for liberty.
I am sorry that it took us so long to respond to your e-mail. You expressed concern about how product activation will impede your ability to access your tax files in future years.
- If you reinstall TurboTax after October 15, 2003, you will not need to purchase a new product license. TurboTax 2002 products that currently require product activation will be activated free of charge, thus allowing anyone to install TurboTax on any computer without needing to purchase a product license. (Example: You activate TurboTax on your home computer and complete your taxes in March of 2003. The following December, you install TurboTax on a new computer. Because you installed TurboTax after October 15, you will not need to purchase a product license.)
- If you purchase a new computer or a new hard disk for your current computer, Intuit technical support agents can assist you in reinstalling and reactivating TurboTax at no additional cost.
- If you reformat your hard disk or replace your current operating system, in most cases reactivation will take place without you needing to contact Intuit.
- If you reinstall the same version of TurboTax on the same computer that it was previously activated on, you do not need to purchase a new product license.
- If you install TurboTax on another computer before October 16, 2003, you need to purchase a new product license only if you want to print from within TurboTax, electronically file, or save your tax return as a
.pdf file from that computer.
I hope this information answers your questions. If you would like to get more information about product activation, please see the Product Activation page at http://www.turbotaxsupport.com/default.asp?platfoYou are a valued customer and your opinion matters. If I can answer any additional concerns that you may have, please let me know.
Sincerely,
AnnabelG
Tax Development, TurboTax
Yeah, right.
The defragger runs as a native NT application, not a win32 application - it needs this because it needs to be able to run before the win32 layer is loaded up. You don't need to do that kind of thing to write to the boot track, you just need Admin privledges. Details on the difference between the NT API and the win32 wrapper API for it can be found at Sysinternals.com. You can do some nifty stuff with an NT-native application, like writing Registry entries that can only be removed or modified by other NT applications, and not by anything running in the win32 layer.
If you're not running vmware from a privledged account and haven't given an unprivledged account write access to the raw device, vmware will have insufficient permissions to do such a write. This is why you don't run things as root. Maybe someday MS will have the default account not have Admin privledges. Oh well.
Copyright Violation:"theft, piracy"::Anti-Trust Violation:"thermonuclear price terrorism"<-Overly dramatic language.
I just sent this to public_relations@intuit.com, if other people do the same, InTuit will get the message that the upsets customers. No garauntee they will stop, but at least they'll no it upsets us.
7 3,881243, 00.asp
1 549232.shtm l?tid=185
"I'm a potential customer for TurboTax software. A recent discussion held at the Slashdot forum indicates that TurboTax is laden with DRM (Digital Rights Management) components, and even goes so far as to write to the boot sector of the hard drive. I wanted to know how InTuit responds to this. I can't support a company who would include such measures in their software. I understand the need to prevent piracy, but writing to the boot sector is something that only disk partitioning software and operating system installers should do. I'm eager to hear InTuits response on this matter, as it will be the deciding factor in whether I buy InTuit software.
Here are some links to the sites I am obtaining information from.
Original article claiming the action:
http://www.extremetech.com/article2/0,39
Pursuant discussion on Slashdot:
http://slashdot.org/articles/03/02/16/
PS - I'm posting a copy of this to the Slashdot forum, and intend to forward the reply to Slashdot as well."
The technical reasons (such as making physical writes to the hard drive, etc) for not using this product are compelling, but I believe the legal and social reasons for avoiding it are even more compelling.
"Digital rights management" in this form essentially strips me of the right of first sale (the doctrine that makes it legal for video stores to rent out videos that they have purchased or for you to resell a book once you are done reading it). Once I purchase this software I should be free to do whatever I darn well please with it, *and* once I'm done with it, I should be free to sell it, give it away, or whatever I wish as long as I don't keep a copy for myself. By preventing any of these actions, "DRM" tramples on consumers' rights and should be resisted any without technical flaws that could render your computer unbootable.
I sure am glad I have procrastinated in doing my taxes... Looks like I'll be checking out Intuit's competition this year.
Even worse: In otherwords, no, you can't sue them. They can do whatever the heck they want to your computer and it is not their responsibility to fix it. That's the *cough* beaty of EULAs...
"Men lie."
"Yeah, about sleeping with other women, but never about bioluminescent plankton."
-Dan Brown
Get This.
TurboTax also broke my DX8.1 install. Turns out, those fancy movies that come with it are Macrovision encoded. NT user? check your Services for a magical new service (I can't remember the name, I've long since ripped it a new one) which even if you disable it, running turbotax fires it right back up to automatic. Lord this gives me a new reason to get a full refund from them. How can one tell if their bootsector has some extra bits in it?
A year ago I bought the then new Logitech dual pickup optical mouse and installed the drivers from the included CD. The install looked kind of suspicious so I ran ad-aware. It reported some kind of spyware components so I removed them. The system was clean before I installed the drivers.
This really blew my mind at the time. I can see someone who provides free software doing that using the excuse that they need to make money and pay the employees, etc. But spyware with a $49.99 USA mouse ! Jeez...............
A few lawsuits for system damage by SafeCast right now wouldn't hurt either.
So what is a good utility to inspect and clean all this crap off of boot sectors 1-63, even if it does make limited-time demos forget their earlier installs?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
So no, nothing more nefarious than making games work.
Sticking feathers up your butt does not make you a chicken - Tyler Durden
Don't thank me, thank Google Sets. :)
4 0FormT axes com
TaxACT
TurboTax
TaxCut
Taxslayer
Taxcut Deluxe
TurboTax Deluxe
HD Vest
E1040 com
TaxBrain
CompleteTax
e1065
TaxesByCPA
10
TaxLogic
FileSafe
eTax YourPace
EZTaxMachine
Tax Engine
AccuTax
TaxConnection
TaxGaga
FileYour
1040 net
Taxes1 com
Of course, it doesn't work! So maybe someone at Inuit browses Slashdot. Ahahaha! Right! ---- Hi, I have just finished doing quite a bit of reading, both at Intuit.com and through other resources, about the copy protection method Intuit used on the recent version of TurboTax. While Intuit may be concerned about lost sales of TurboTax due to copying, I can cite at least one example of a lost sale due to this copy protection. Me. I had been purchasing and using TurboTax for 6 years but will do so no longer. As the copy protection Intuit used on TurboTax definitely DOES affect the use of my system by writing information in the boot sector area, I luckily have avoid the problem by not using the product. So whoever decided the use of the copy protection was a good idea should be held accountable, because I am sure sales will be detrimentally affected. And those numbers will be clear. As I am sure you are aware, most people do not bother writing to vendors to express displeasure about certain business practices. Hopefully, my note is merely one expression of a lot more silent ex-Intuit customers. Thank you. ----
This is not a problem on my Mac.
It fucked up my f-prot installation.
On top of that, the one-click update just sat there, so I had to download the update program and run it manually. That farked up the turbotax installation entirely. It wouldn't even run anymore. It was in the task list, but nothing worked.
Uninstalled it and reinstalled it a few times, but it didn't help. Followed the instructions on the website completely, but no luck. I spent the entire day yesterday trying to get turbotax to work.
I *had* planned on getting my taxes done this weekend. That plan was shot to hell.
I uninstalled it, and took it back to Walmart today. They didn't give me a hassle over the fact that it had been opened. I was surprised but pleased about that, since the in2it web site refund page seems to require an order number.
I hope they ship it back rather than selling it to someone else, since the drm activation took place. That serial number won't work for anyone else now.
I will never purchase turbotax again. All this hassle for a stinking $20 one-use product. They might eliminate the 5-20% piracy that might have existed, but only at the cost of losing 60% of their sales.
The undocumented VMWare I/O port communication mechanism can also be (and is) used to determine whether an application is running under VMWare. The relatively simple code to implement this was posted to the Honeypots security list.
Pretty much everybody who has ever pressed the line of tax protest that you describe, has done time for it. I think it was irresponsible of you not to mention that detail.
-fb Everything not expressly forbidden is now mandatory.
"60-Day Money-Back Guarantee: Try TurboTax software. If you're not satisfied, return it within 60 days of purchase with your dated receipt for a full refund."
So even those of you who already opened the box are covered! I recommend returning this nonsense at the first opportunity. If the salesman gives you any flack, just point them at this text on the box.
I installed Autocad 2000i on a computer a couple of years ago. Anyway, the user managed to completely screw up his computer in such a way that we had to reformat and reinstall Windows 2000 (even FDISK was used). When the OS was reinstalled we tried installing Autocad but the software informed us that our 30-day trial period had ended and we must contact Autodesk to register. So... where was the info written to?
Now, I for one doubt those claims (Partition Magic would surely be able to zap the software, and the software wouldn't run if Linux was installed etc) but if it is true then who knows what else could be written to inaccessible (by the user at least) parts of the hard-disk?
One way to get rid of copy protection like this is to first make a full file backup of your hard drive that you are going to modify.
Use a disk tool like drivepro to wipe the first 10 cylinders of the disk (this will completely destroy all data on your hard disk) you would then need to reinstall your os and restore your file backup (Do not allow it to write/overwrite any boot files or hidden files on your boot drive root directory, be aware that after the restore, running any program that writes to an area outside of the file system will probably re-install the copy protection data back to the sector.
*This is just personal opinion of how you could in theory, recover and reinstall a Copy Protected product and in no way should this opinion be taken as seriously or as fact. I also assume no responsibly for any damage, or legal action this interpretation of opinion may cause*